commit 457391b0380335d5e9a5babdec90ac53928b23b4 Author: Linus Torvalds Date: Sun Apr 23 12:02:52 2023 -0700 Linux 6.3 commit 0da6e5fd6c3726723e275603426e09178940dace Author: Linus Torvalds Date: Sun Apr 23 09:56:20 2023 -0700 gcc: disable '-Warray-bounds' for gcc-13 too We started disabling '-Warray-bounds' for gcc-12 originally on s390, because it resulted in some warnings that weren't realistically fixable (commit 8b202ee21839: "s390: disable -Warray-bounds"). That s390-specific issue was then found to be less common elsewhere, but generic (see f0be87c42cbd: "gcc-12: disable '-Warray-bounds' universally for now"), and then later expanded the version check was expanded to gcc-11 (5a41237ad1d4: "gcc: disable -Warray-bounds for gcc-11 too"). And it turns out that I was much too optimistic in thinking that it's all going to go away, and here we are with gcc-13 showing all the same issues. So instead of expanding this one version at a time, let's just disable it for gcc-11+, and put an end limit to it only when we actually find a solution. Yes, I'm sure some of this is because the kernel just does odd things (like our "container_of()" use, but also knowingly playing games with things like linker tables and array layouts). And yes, some of the warnings are likely signs of real bugs, but when there are hundreds of false positives, that doesn't really help. Oh well. Signed-off-by: Linus Torvalds commit 8296ac9256aa1e9305033720de77ee5419a80f6f Merge: 5ad250f1fe92f 9cedc5e89a59d Author: Linus Torvalds Date: Sun Apr 23 08:22:25 2023 -0700 Merge tag 'kbuild-fixes-v6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix the prefix in the kernel source tarball - Fix a typo in the copyright file in Debian package * tag 'kbuild-fixes-v6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: use proper prefix for tarballs to fix rpm-pkg build error kbuild: deb-pkg: Fix a spell typo in mkdebian script commit 5ad250f1fe92f21de09dabcd329e681d15aed9a4 Merge: 97249f05b2738 e3c026be4d3ca Author: Linus Torvalds Date: Sun Apr 23 08:15:33 2023 -0700 Merge tag 'irq_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Borislav Petkov: - Remove an over-zealous sanity check of the array of MSI-X vectors to be allocated for a device * tag 'irq_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: PCI/MSI: Remove over-zealous hardware size check in pci_msix_validate_entries() commit 97249f05b27385b7f870d8e2e6062e26e5f132e8 Merge: d6b78224c65e3 c22ef5684b64a Author: Linus Torvalds Date: Sun Apr 23 08:03:57 2023 -0700 Merge tag 'x86_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov - Fix for older binutils which do not support C-syntax constant suffixes * tag 'x86_urgent_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternatives: Do not use integer constant suffixes in inline asm commit d6b78224c65e395db6aa66ea74522d9899c8aefb Merge: 622322f53c6d9 5dc63e56a9cf8 Author: Linus Torvalds Date: Sun Apr 23 07:46:52 2023 -0700 Merge tag 'input-for-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a check in pegasus-notetaker driver to validate the type of pipe when probing a new device - a fix for Cypress touch controller to correctly parse maximum number of touches. * tag 'input-for-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: cyttsp5 - fix sensing configuration data structure Input: pegasus-notetaker - check pipe type when probing commit 9cedc5e89a59da72bfecdb76bfaa5a28a273029d Author: Masahiro Yamada Date: Thu Apr 20 02:04:24 2023 +0900 kbuild: use proper prefix for tarballs to fix rpm-pkg build error Since commit f8d94c4e403c ("kbuild: do not create intermediate *.tar for source tarballs"), 'make rpm-pkg' fails because the prefix of the source tarball is 'linux.tar/' instead of 'linux/'. $(basename $@) strips only '.gz' from the filename linux.tar.gz. You need to strip two suffixes from compressed tarballs and one suffix from uncompressed tarballs (for example 'perf-6.3.0.tar' generated by 'make perf-tar-src-pkg'). One tricky fix might be --prefix=$(firstword $(subst .tar, ,$@))/ but I think it is better to hard-code the prefix. Fixes: f8d94c4e403c ("kbuild: do not create intermediate *.tar for source tarballs") Reported-by: Jiwei Sun Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 8b824220bd6641976676ae7a1e925db63eb89c4b Author: Woody Suwalski Date: Fri Mar 31 10:15:40 2023 -0400 kbuild: deb-pkg: Fix a spell typo in mkdebian script Signed-off-by: Woody Suwalski Signed-off-by: Masahiro Yamada commit 622322f53c6d9ddd3c2a4aad852b3e1adbd56da7 Merge: 2caeeb9d4a1bc 6dcbd0a69c84a Author: Linus Torvalds Date: Sat Apr 22 19:11:47 2023 -0700 Merge tag 'mips-fixes_6.3_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fix from Thomas Bogendoerfer: "Fix for link errors" * tag 'mips-fixes_6.3_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Define RUNTIME_DISCARD_EXIT in LD script commit 2caeeb9d4a1bccd923b7918427f9e9ef7151ddd8 Merge: 84ebdb8e0d9ca 265b97cbc22e0 Author: Linus Torvalds Date: Sat Apr 22 09:27:46 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Two serious ARM fixes: - Plug a buffer overflow due to the use of the user-provided register width for firmware regs. Outright reject accesses where the user register width does not match the kernel representation. - Protect non-atomic RMW operations on vCPU flags against preemption, as an update to the flags by an intervening preemption could be lost" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg() KVM: arm64: Make vcpu flag updates non-preemptible commit 84ebdb8e0d9ca261d73677f345814505af172ae0 Merge: 8e41e0a575664 023fc150a39ff Author: Linus Torvalds Date: Sat Apr 22 09:18:35 2023 -0700 Merge tag '6.3-rc7-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Three small smb3 client fixes: - two important fixes for unbuffered read regression with the iov_iter changes (e.g. read soon after mount in some multichannel scenarios) - DFS prefix path fix (also for stable)" * tag '6.3-rc7-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: Reapply lost fix from commit 30b2b2196d6e cifs: Fix unbuffered read cifs: avoid dup prefix path in dfs_get_automount_devname() commit 265b97cbc22e0f67f79a71443b60dc1237ca5ee6 Merge: 0bf9601f8ef07 a25bc8486f9c0 Author: Paolo Bonzini Date: Fri Apr 21 19:19:02 2023 -0400 Merge tag 'kvmarm-fixes-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.3, part #4 - Plug a buffer overflow due to the use of the user-provided register width for firmware regs. Outright reject accesses where the user register width does not match the kernel representation. - Protect non-atomic RMW operations on vCPU flags against preemption, as an update to the flags by an intervening preemption could be lost. commit 6dcbd0a69c84a8ae7a442840a8cf6b1379dc8f16 Author: Jiaxun Yang Date: Sat Apr 8 21:33:48 2023 +0100 MIPS: Define RUNTIME_DISCARD_EXIT in LD script MIPS's exit sections are discarded at runtime as well. Fixes link error: `.exit.text' referenced in section `__jump_table' of fs/fuse/inode.o: defined in discarded section `.exit.text' of fs/fuse/inode.o Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") Reported-by: "kernelci.org bot" Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 8e41e0a575664d26bb87e012c39435c4c3914ed9 Author: Linus Torvalds Date: Fri Apr 21 13:39:10 2023 -0700 Revert "ACPICA: Events: Support fixed PCIe wake event" This reverts commit 5c62d5aab8752e5ee7bfbe75ed6060db1c787f98. This broke wake-on-lan for multiple people, and for much too long. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217069 Link: https://lore.kernel.org/all/754225a2-95a9-2c36-1886-7da1a78308c2@loongson.cn/ Link: https://github.com/acpica/acpica/pull/866 Cc: Rafael J. Wysocki Cc: Jianmin Lv Cc: Huacai Chen Cc: Bob Moore Cc: stable@kernel.org # 6.2 Signed-off-by: Linus Torvalds commit c337b23f32c87320dffd389e4f0f793db35f0a9b Merge: 334e5a8206af9 ef9cddfe57d86 Author: Linus Torvalds Date: Fri Apr 21 10:47:21 2023 -0700 Merge tag 'for-6.3-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Two patches fixing the problem with aync discard. The default settings had a low IOPS limit and processing a large batch to discard would take a long time. On laptops this can cause increased power consumption due to disk activity. As async discard has been on by default since 6.2 this likely affects a lot of users. Summary: - increase the default IOPS limit 10x which reportedly helped - setting the sysfs IOPS value to 0 now does not throttle anymore allowing the discards to be processed at full speed. Previously there was an arbitrary 6 hour target for processing the pending batch" * tag 'for-6.3-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: reinterpret async discard iops_limit=0 as no delay btrfs: set default discard iops_limit to 1000 commit 334e5a8206af93818fd384300666cc203f08f035 Merge: 8fd06d441e35c 81ea1222f2fa5 Author: Linus Torvalds Date: Fri Apr 21 10:05:52 2023 -0700 Merge tag 'block-6.3-2023-04-21' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "Just a single revert of a patch from the 6.3 series" * tag 'block-6.3-2023-04-21' of git://git.kernel.dk/linux: Revert "block: Merge bio before checking ->cached_rq" commit 8fd06d441e35cc9543b410f9cb9aaa8e54ece38d Merge: bdc83e00f0a19 a042d7feae7ef Author: Linus Torvalds Date: Fri Apr 21 10:00:18 2023 -0700 Merge tag 'char-misc-6.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some last-minute tiny driver fixes for 6.3-final. They include fixes for some fpga and iio drivers: - fpga bridge driver fix - fpga dfl error reporting fix - fpga m10bmc driver fix - fpga xilinx driver fix - iio light driver fix - iio dac fwhandle leak fix - iio adc driver fix All of these have been in linux-next for a few weeks with no reported problems" * tag 'char-misc-6.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: iio: light: tsl2772: fix reading proximity-diodes from device tree fpga: bridge: properly initialize bridge device before populating children iio: dac: ad5755: Add missing fwnode_handle_put() iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() fpga: xilinx-pr-decoupler: Use readl wrapper instead of pure readl fpga: dfl-pci: Drop redundant pci_enable_pcie_error_reporting() fpga: m10bmc-sec: Fix rsu_send_data() to return FW_UPLOAD_ERR_HW_ERROR commit bdc83e00f0a195b85e7879b65a4ca7a6520fe135 Merge: a14e151910dd9 2ce987d7eeb16 Author: Linus Torvalds Date: Fri Apr 21 09:50:47 2023 -0700 Merge tag 'gpio-fixes-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - use raw_spinlocks in regmaps that are used in interrupt context in gpio-104-idi-48 and gpio-104-dio-48e * tag 'gpio-fixes-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: 104-idi-48: Enable use_raw_spinlock for idi48_regmap_config gpio: 104-dio-48e: Enable use_raw_spinlock for dio48e_regmap_config commit a14e151910dd967311dbdfe6d95dcd04e777db84 Merge: 5a43001c01691 2ae147d643d32 Author: Linus Torvalds Date: Fri Apr 21 09:34:49 2023 -0700 Merge tag 'sound-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Just a few fixes: all small and device-specific (ASoC FSL, SOF, and HD-audio quirks), should be safe to apply at the last minute" * tag 'sound-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook ASoC: fsl_asrc_dma: fix potential null-ptr-deref ASoC: fsl_sai: Fix pins setting for i.MX8QM platform ALSA: hda/realtek: Remove specific patch for Dell Precision 3260 ASoC: max98373: change power down sequence for smart amp ASoC: SOF: pm: Tear down pipelines only if DSP was active ASoC: SOF: ipc4-topology: Clarify bind failure caused by missing fw_module commit 5a43001c01691dcbd396541e6faa2c0077378f48 Author: Ekaterina Orlova Date: Fri Apr 21 15:35:39 2023 +0100 ASN.1: Fix check for strdup() success It seems there is a misprint in the check of strdup() return code that can lead to NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4520c6a49af8 ("X.509: Add simple ASN.1 grammar compiler") Signed-off-by: Ekaterina Orlova Cc: David Woodhouse Cc: James Bottomley Cc: Jarkko Sakkinen Cc: keyrings@vger.kernel.org Cc: linux-kbuild@vger.kernel.org Link: https://lore.kernel.org/r/20230315172130.140-1-vorobushek.ok@gmail.com/ Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 2af3e53a4dc08657f1b46f97f04ff4a0ab3cad8d Merge: b7bc77e2f2c71 00a4bd000e78a Author: Linus Torvalds Date: Thu Apr 20 19:15:58 2023 -0700 Merge tag 'drm-fixes-2023-04-21' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This is the regular and hopefully last round of fixes for 6.3. Pretty small, a few amdgpu, one i915, one nouveau, one rockchip and one gpu scheduler fix: nouveau: - fix dma-resv timeout rockchip: - fix suspend/resume sched: - fix timeout handling i915: - Fix fast wake AUX sync len amdgpu: - GPU reset fix - DCN 3.1.5 line buffer fix - Display fix for single channel memory configs - Fix a possible divide by 0" * tag 'drm-fixes-2023-04-21' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: fix a divided-by-zero error drm/amd/display: limit timing for single dimm memory drm/amd/display: set dcn315 lb bpp to 48 drm/amdgpu: Fix desktop freezed after gpu-reset drm/rockchip: vop2: Use regcache_sync() to fix suspend/resume drm/nouveau: fix incorrect conversion to dma_resv_wait_timeout() drm/rockchip: vop2: fix suspend/resume drm/i915: Fix fast wake AUX sync len drm/sched: Check scheduler ready before calling timeout handling commit 00a4bd000e78a3a898e60bdc13e2852c8044a38c Merge: 3b1f2be527ce0 0b5dfe12755f8 Author: Dave Airlie Date: Fri Apr 21 11:13:24 2023 +1000 Merge tag 'amd-drm-fixes-6.3-2023-04-19' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.3-2023-04-19: amdgpu: - GPU reset fix - DCN 3.1.5 line buffer fix - Display fix for single channel memory configs - Fix a possible divide by 0 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230420031717.7790-1-alexander.deucher@amd.com commit 3b1f2be527ce04e7d8dce6fad6be16fa59058713 Merge: f126f41cec1b6 e1c71f8f91804 Author: Dave Airlie Date: Fri Apr 21 10:37:23 2023 +1000 Merge tag 'drm-intel-fixes-2023-04-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.3 final: - Fix fast wake AUX sync len Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87354w1b76.fsf@intel.com commit f126f41cec1b6fa04c1d06517ec8f3e19908c5f7 Merge: 6a8f57ae2eb07 b63a553e8f5aa Author: Dave Airlie Date: Fri Apr 21 09:57:37 2023 +1000 Merge tag 'drm-misc-fixes-2023-04-20-2' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * nouveau: fix dma-resv timeout * rockchip: fix suspend/resume * sched: fix timeout handling Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230420083114.GA17651@linux-uq9g commit b7bc77e2f2c714c82aa723445d98fa4c2fb63e90 Merge: 0f2a4af27b649 0d21e71a91deb Author: Linus Torvalds Date: Thu Apr 20 15:36:23 2023 -0700 Merge tag 'pci-v6.3-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Previously we ignored PCI devices if the DT "status" property or the ACPI _STA method said it was not present. Per spec, _STA cannot be used for that purpose, and using it that way caused regressions, so skip the _STA check (Rob Herring) * tag 'pci-v6.3-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Restrict device disabled status check to DT commit ef9cddfe57d86aac6b509b550136395669159b30 Author: Boris Burkov Date: Wed Apr 5 12:43:59 2023 -0700 btrfs: reinterpret async discard iops_limit=0 as no delay Currently, a limit of 0 results in a hard coded metering over 6 hours. Since the default is a set limit, I suspect no one truly depends on this rather arbitrary setting. Repurpose it for an arguably more useful "unlimited" mode, where the delay is 0. Note that if block groups are too new, or go fully empty, there is still a delay associated with those conditions. Those delays implement heuristics for not trimming a region we are relatively likely to fully overwrite soon. CC: stable@vger.kernel.org # 6.2+ Reviewed-by: Neal Gompa Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit e9f59429b87d35cf23ae9ca19629bd686a1c0304 Author: Boris Burkov Date: Wed Apr 5 12:43:58 2023 -0700 btrfs: set default discard iops_limit to 1000 Previously, the default was a relatively conservative 10. This results in a 100ms delay, so with ~300 discards in a commit, it takes the full 30s till the next commit to finish the discards. On a workstation, this results in the disk never going idle, wasting power/battery, etc. Set the default to 1000, which results in using the smallest possible delay, currently, which is 1ms. This has shown to not pathologically keep the disk busy by the original reporter. Link: https://lore.kernel.org/linux-btrfs/Y%2F+n1wS%2F4XAH7X1p@nz/ Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182228 CC: stable@vger.kernel.org # 6.2+ Reviewed-by: Neal Gompa Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0f2a4af27b649c13ba76431552fe49c60120d0f6 Author: Toke Høiland-Jørgensen Date: Thu Apr 13 23:41:18 2023 +0200 wifi: ath9k: Don't mark channelmap stack variable read-only in ath9k_mci_update_wlan_channels() This partially reverts commit e161d4b60ae3a5356e07202e0bfedb5fad82c6aa. Turns out the channelmap variable is not actually read-only, it's modified through the MCI_GPM_CLR_CHANNEL_BIT() macro further down in the function, so making it read-only causes page faults when that code is hit. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217183 Link: https://lore.kernel.org/r/20230413214118.153781-1-toke@toke.dk Fixes: e161d4b60ae3 ("wifi: ath9k: Make arrays prof_prio and channelmap static const") Cc: stable@vger.kernel.org Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Linus Torvalds commit 6a66fdd29ea1695d615fcc93dccfb6dbe2f53b1d Merge: 23309d600db1a d966c3cab924f Author: Linus Torvalds Date: Thu Apr 20 12:46:18 2023 -0700 Merge tag 'rust-fixes-6.3' of https://github.com/Rust-for-Linux/linux Pull Rust fixes from Miguel Ojeda: "Most of these are straightforward. The last one is more complex, but it only touches Rust + GCC builds which are for the moment best-effort. - Code: Missing 'extern "C"' fix. - Scripts: 'is_rust_module.sh' and 'generate_rust_analyzer.py' fixes. - A couple trivial fixes - Build: Rust + GCC build fix and 'grep' warning fix" * tag 'rust-fixes-6.3' of https://github.com/Rust-for-Linux/linux: rust: allow to use INIT_STACK_ALL_ZERO rust: fix regexp in scripts/is_rust_module.sh rust: build: Fix grep warning scripts: generate_rust_analyzer: Handle sub-modules with no Makefile rust: kernel: Mark rust_fmt_argument as extern "C" rust: sort uml documentation arch support table rust: str: fix requierments->requirements typo commit 0d21e71a91debc87e88437a2cf9c6f34f8bf012f Author: Rob Herring Date: Wed Apr 19 14:35:13 2023 -0500 PCI: Restrict device disabled status check to DT Commit 6fffbc7ae137 ("PCI: Honor firmware's device disabled status") checked the firmware device status for both DT and ACPI devices. That caused a regression in some ACPI systems. The exact reason isn't clear. It's possibly a firmware bug. For now, at least, refactor the check to be for DT based systems only. Note that the original implementation leaked a refcount which is now correctly handled. [bhelgaas: Per ACPI r6.5, sec 6.3.7, for devices on an enumerable bus, _STA must return with bit[0] ("device is present") set] Link: https://lore.kernel.org/all/m2fs9lgndw.fsf@gmail.com/ Fixes: 6fffbc7ae137 ("PCI: Honor firmware's device disabled status") Link: https://lore.kernel.org/r/20230419193513.708818-1-robh@kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=217317 Reported-by: Donald Hunter Reported-by: Vitaly Kuznetsov Tested-by: Donald Hunter Tested-by: Vitaly Kuznetsov Signed-off-by: Rob Herring Signed-off-by: Bjorn Helgaas Cc: Binbin Zhou Cc: Liu Peibao Cc: Huacai Chen commit 23309d600db1abb73b77ca35db96133b7fc35959 Merge: cb0856346a60f 927cdea5d2095 Author: Linus Torvalds Date: Thu Apr 20 11:03:51 2023 -0700 Merge tag 'net-6.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter and bpf. There are a few fixes for new code bugs, including the Mellanox one noted in the last networking pull. No known regressions outstanding. Current release - regressions: - sched: clear actions pointer in miss cookie init fail - mptcp: fix accept vs worker race - bpf: fix bpf_arch_text_poke() with new_addr == NULL on s390 - eth: bnxt_en: fix a possible NULL pointer dereference in unload path - eth: veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag Current release - new code bugs: - eth: revert "net/mlx5: Enable management PF initialization" Previous releases - regressions: - netfilter: fix recent physdev match breakage - bpf: fix incorrect verifier pruning due to missing register precision taints - eth: virtio_net: fix overflow inside xdp_linearize_page() - eth: cxgb4: fix use after free bugs caused by circular dependency problem - eth: mlxsw: pci: fix possible crash during initialization Previous releases - always broken: - sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg - netfilter: validate catch-all set elements - bridge: don't notify FDB entries with "master dynamic" - eth: bonding: fix memory leak when changing bond type to ethernet - eth: i40e: fix accessing vsi->active_filters without holding lock Misc: - Mat is back as MPTCP co-maintainer" * tag 'net-6.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (33 commits) net: bridge: switchdev: don't notify FDB entries with "master dynamic" Revert "net/mlx5: Enable management PF initialization" MAINTAINERS: Resume MPTCP co-maintainer role mailmap: add entries for Mat Martineau e1000e: Disable TSO on i219-LM card to increase speed bnxt_en: fix free-runnig PHC mode net: dsa: microchip: ksz8795: Correctly handle huge frame configuration bpf: Fix incorrect verifier pruning due to missing register precision taints hamradio: drop ISA_DMA_API dependency mlxsw: pci: Fix possible crash during initialization mptcp: fix accept vs worker race mptcp: stops worker on unaccepted sockets at listener close net: rpl: fix rpl header size calculation net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() bonding: Fix memory leak when changing bond type to Ethernet veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() bnxt_en: Fix a possible NULL pointer dereference in unload path bnxt_en: Do not initialize PTP on older P3/P4 chips netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements ... commit 81ea1222f2fa5006f4b9759c2fe1ec154109622d Author: Ming Lei Date: Thu Apr 20 19:20:18 2023 +0800 Revert "block: Merge bio before checking ->cached_rq" This reverts commit 23f3e3272e7a4d9fb870485cd6df1e4f9539282c. blk-mq sched bio merge still needs request to grab queue usage counter, so we can't simply call blk_mq_attempt_bio_merge() when queue usage counter isn't held. Fixes: 23f3e3272e7a ("block: Merge bio before checking ->cached_rq") Cc: Xiao Ni Reported-by: Yi Zhang Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230420112018.1108058-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 927cdea5d2095287ddd5246e5aa68eb5d68db2be Author: Vladimir Oltean Date: Tue Apr 18 18:59:02 2023 +0300 net: bridge: switchdev: don't notify FDB entries with "master dynamic" There is a structural problem in switchdev, where the flag bits in struct switchdev_notifier_fdb_info (added_by_user, is_local etc) only represent a simplified / denatured view of what's in struct net_bridge_fdb_entry :: flags (BR_FDB_ADDED_BY_USER, BR_FDB_LOCAL etc). Each time we want to pass more information about struct net_bridge_fdb_entry :: flags to struct switchdev_notifier_fdb_info (here, BR_FDB_STATIC), we find that FDB entries were already notified to switchdev with no regard to this flag, and thus, switchdev drivers had no indication whether the notified entries were static or not. For example, this command: ip link add br0 type bridge && ip link set swp0 master br0 bridge fdb add dev swp0 00:01:02:03:04:05 master dynamic has never worked as intended with switchdev. It causes a struct net_bridge_fdb_entry to be passed to br_switchdev_fdb_notify() which has a single flag set: BR_FDB_ADDED_BY_USER. This is further passed to the switchdev notifier chain, where interested drivers have no choice but to assume this is a static (does not age) and sticky (does not migrate) FDB entry. So currently, all drivers offload it to hardware as such, as can be seen below ("offload" is set). bridge fdb get 00:01:02:03:04:05 dev swp0 master 00:01:02:03:04:05 dev swp0 offload master br0 The software FDB entry expires $ageing_time centiseconds after the kernel last sees a packet with this MAC SA, and the bridge notifies its deletion as well, so it eventually disappears from hardware too. This is a problem, because it is actually desirable to start offloading "master dynamic" FDB entries correctly - they should expire $ageing_time centiseconds after the *hardware* port last sees a packet with this MAC SA - and this is how the current incorrect behavior was discovered. With an offloaded data plane, it can be expected that software only sees exception path packets, so an otherwise active dynamic FDB entry would be aged out by software sooner than it should. With the change in place, these FDB entries are no longer offloaded: bridge fdb get 00:01:02:03:04:05 dev swp0 master 00:01:02:03:04:05 dev swp0 master br0 and this also constitutes a better way (assuming a backport to stable kernels) for user space to determine whether the kernel has the capability of doing something sane with these or not. As opposed to "master dynamic" FDB entries, on the current behavior of which no one currently depends on (which can be deduced from the lack of kselftests), Ido Schimmel explains that entries with the "extern_learn" flag (BR_FDB_ADDED_BY_EXT_LEARN) should still be notified to switchdev, since the spectrum driver listens to them (and this is kind of okay, because although they are treated identically to "static", they are expected to not age, and to roam). Fixes: 6b26b51b1d13 ("net: bridge: Add support for notifying devices about FDB add/del") Link: https://lore.kernel.org/netdev/20230327115206.jk5q5l753aoelwus@skbuf/ Signed-off-by: Vladimir Oltean Reviewed-by: Jesse Brandeburg Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Link: https://lore.kernel.org/r/20230418155902.898627-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 2ae147d643d326f74d93ba4f72a405f25f2677ea Author: Andy Chi Date: Thu Apr 20 11:59:41 2023 +0800 ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook There is a HP ProBook 455 G10 which using ALC236 codec and need the ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mute LED and micmute LED work. Signed-off-by: Andy Chi Cc: Link: https://lore.kernel.org/r/20230420035942.66817-1-andy.chi@canonical.com Signed-off-by: Takashi Iwai commit 990cbca00226ff15fa2b24caffd099d05f2e2395 Merge: bc66b591903e1 86a24e99c9723 Author: Takashi Iwai Date: Thu Apr 20 07:11:30 2023 +0200 Merge tag 'asoc-fix-v6.3-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.3 A few remaining small fixes for v6.3, all small driver specific ones. commit f52cc627b832e08a7bcf1b7e81e650ec308fe1d8 Author: Jakub Kicinski Date: Thu Apr 13 15:25:47 2023 -0700 Revert "net/mlx5: Enable management PF initialization" This reverts commit fe998a3c77b9f989a30a2a01fb00d3729a6d53a4. Paul reports that it causes a regression with IB on CX4 and FW 12.18.1000. In addition I think that the concept of "management PF" is not fully accepted and requires a discussion. Fixes: fe998a3c77b9 ("net/mlx5: Enable management PF initialization") Reported-by: Paul Moore Link: https://lore.kernel.org/all/CAHC9VhQ7A4+msL38WpbOMYjAqLp0EtOjeLh4Dc6SQtD6OUvCQg@mail.gmail.com/ Link: https://lore.kernel.org/r/20230413222547.56901-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9d94769081a65aacd54552dbdeeca2544f70442b Merge: 52b37ae8aa679 71b547f561247 Author: Jakub Kicinski Date: Wed Apr 19 18:22:18 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== bpf 2023-04-19 We've added 3 non-merge commits during the last 6 day(s) which contain a total of 3 files changed, 34 insertions(+), 9 deletions(-). The main changes are: 1) Fix a crash on s390's bpf_arch_text_poke() under a NULL new_addr, from Ilya Leoshkevich. 2) Fix a bug in BPF verifier's precision tracker, from Daniel Borkmann and Andrii Nakryiko. 3) Fix a regression in veth's xdp_features which led to a broken BPF CI selftest, from Lorenzo Bianconi. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix incorrect verifier pruning due to missing register precision taints veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL ==================== Link: https://lore.kernel.org/r/20230419195847.27060-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 52b37ae8aa6797a8183e8554672797045e81d9ae Author: Mat Martineau Date: Tue Apr 18 16:13:18 2023 -0700 MAINTAINERS: Resume MPTCP co-maintainer role I'm returning to the MPTCP maintainer role I held for most of the subsytem's history. This time I'm using my kernel.org email address. Acked-by: Matthieu Baerts Link: https://lore.kernel.org/mptcp/af85e467-8d0a-4eba-b5f8-e2f2c5d24984@tessares.net/ Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230418231318.115331-1-martineau@kernel.org Signed-off-by: Jakub Kicinski commit 7b3aba7ea336d069b30b91502d47792c280bae2b Author: Matthieu Baerts Date: Tue Apr 18 10:36:59 2023 +0200 mailmap: add entries for Mat Martineau Map Mat's old corporate addresses to his kernel.org one. Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20230418-upstream-net-20230418-mailmap-mat-v1-1-13ca5dc83037@tessares.net Signed-off-by: Jakub Kicinski commit 7b97174d0ef798ba7f802c07527ae378923e5ebc Merge: 67d47b95119ad c86c00c693550 Author: Jakub Kicinski Date: Wed Apr 19 17:57:05 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-04-17 (i40e) This series contains updates to i40e only. Alex moves setting of active filters to occur under lock and checks/takes error path in rebuild if re-initializing the misc interrupt vector failed. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: fix i40e_setup_misc_vector() error handling i40e: fix accessing vsi->active_filters without holding lock ==================== Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230417205245.1030733-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit cb0856346a60fe3eb837ba5e73588a41f81ac05f Merge: 23990b1affd2d ef832747a82df Author: Linus Torvalds Date: Wed Apr 19 17:55:45 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-04-19-16-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "22 hotfixes. 19 are cc:stable and the remainder address issues which were introduced during this merge cycle, or aren't considered suitable for -stable backporting. 19 are for MM and the remainder are for other subsystems" * tag 'mm-hotfixes-stable-2023-04-19-16-36' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (22 commits) nilfs2: initialize unused bytes in segment summary blocks mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages mm/mmap: regression fix for unmapped_area{_topdown} maple_tree: fix mas_empty_area() search maple_tree: make maple state reusable after mas_empty_area_rev() mm: kmsan: handle alloc failures in kmsan_ioremap_page_range() mm: kmsan: handle alloc failures in kmsan_vmap_pages_range_noflush() tools/Makefile: do missed s/vm/mm/ mm: fix memory leak on mm_init error handling mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock kernel/sys.c: fix and improve control flow in __sys_setres[ug]id() Revert "userfaultfd: don't fail on unrecognized features" writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs maple_tree: fix a potential memory leak, OOB access, or other unpredictable bug tools/mm/page_owner_sort.c: fix TGID output when cull=tg is used mailmap: update jtoppins' entry to reference correct email mm/mempolicy: fix use-after-free of VMA iterator mm/huge_memory.c: warn with pr_warn_ratelimited instead of VM_WARN_ON_ONCE_FOLIO mm/mprotect: fix do_mprotect_pkey() return on error mm/khugepaged: check again on anon uffd-wp during isolation ... commit 67d47b95119ad589b0a0b16b88b1dd9a04061ced Author: Sebastian Basierski Date: Mon Apr 17 13:53:45 2023 -0700 e1000e: Disable TSO on i219-LM card to increase speed While using i219-LM card currently it was only possible to achieve about 60% of maximum speed due to regression introduced in Linux 5.8. This was caused by TSO not being disabled by default despite commit f29801030ac6 ("e1000e: Disable TSO for buffer overrun workaround"). Fix that by disabling TSO during driver probe. Fixes: f29801030ac6 ("e1000e: Disable TSO for buffer overrun workaround") Signed-off-by: Sebastian Basierski Signed-off-by: Mateusz Palczewski Tested-by: Naama Meir Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230417205345.1030801-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 8c154d272c3e03b100baaf1df473f22a78fa403e Author: Vadim Fedorenko Date: Tue Apr 18 13:25:11 2023 -0700 bnxt_en: fix free-runnig PHC mode The patch in fixes changed the way real-time mode is chosen for PHC on the NIC. Apparently there is one more use case of the check outside of ptp part of the driver which was not converted to the new macro and is making a lot of noise in free-running mode. Fixes: 131db4991622 ("bnxt_en: reset PHC frequency in free-running mode") Signed-off-by: Vadim Fedorenko Reviewed-by: Michael Chan Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230418202511.1544735-1-vadfed@meta.com Signed-off-by: Jakub Kicinski commit 23990b1affd2dc8f5e59048d4d4bef05f6e1c544 Merge: 72b4fb4c883d5 359f5b0d4e26b Author: Linus Torvalds Date: Wed Apr 19 13:49:31 2023 -0700 Merge tag 'spi-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fix from Mark Brown: "A small fix in the error handling for the rockchip driver, ensuring we don't leak clock enables if we fail to request the interrupt for the device" * tag 'spi-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-rockchip: Fix missing unwind goto in rockchip_sfc_probe() commit 72b4fb4c883d5deac74f5267e486f5dee1bffd5f Merge: 789b4a41c247e 7c7504067c709 Author: Linus Torvalds Date: Wed Apr 19 13:35:48 2023 -0700 Merge tag 'regulator-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A few driver specific fixes, one build coverage issue and a couple of 'someone typed in the wrong number' style errors in describing devices to the subsystem" * tag 'regulator-fix-v6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: sm5703: Fix missing n_voltages for fixed regulators regulator: fan53555: Fix wrong TCS_SLEW_MASK regulator: fan53555: Explicitly include bits header commit 3d2f8f1f184c60508f7af3022536651d7ac2dd07 Author: Christophe JAILLET Date: Mon Apr 17 20:19:33 2023 +0200 net: dsa: microchip: ksz8795: Correctly handle huge frame configuration Because of the logic in place, SW_HUGE_PACKET can never be set. (If the first condition is true, then the 2nd one is also true, but is not executed) Change the logic and update each bit individually. Fixes: 29d1e85f45e0 ("net: dsa: microchip: ksz8: add MTU configuration support") Signed-off-by: Christophe JAILLET Reviewed-by: Oleksij Rempel Reviewed-by: Simon Horman Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/43107d9e8b5b8b05f0cbd4e1f47a2bb88c8747b2.1681755535.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit d966c3cab924fb750fefef11e77a6fa07dd5420e Author: Andrea Righi Date: Fri Feb 10 22:51:41 2023 +0100 rust: allow to use INIT_STACK_ALL_ZERO With CONFIG_INIT_STACK_ALL_ZERO enabled, bindgen passes -ftrivial-auto-var-init=zero to clang, that triggers the following error: error: '-ftrivial-auto-var-init=zero' hasn't been enabled; enable it at your own peril for benchmarking purpose only with '-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang' However, this additional option that is currently required by clang is deprecated since clang-16 and going to be removed in the future, likely with clang-18. So, make sure bindgen is using this extra option if the major version of the libclang used by bindgen is < 16. In this way we can enable CONFIG_INIT_STACK_ALL_ZERO with CONFIG_RUST without triggering any build error. Link: https://github.com/llvm/llvm-project/issues/44842 Link: https://github.com/llvm/llvm-project/blob/llvmorg-16.0.0-rc2/clang/docs/ReleaseNotes.rst#deprecated-compiler-flags Signed-off-by: Andrea Righi Reviewed-by: Kees Cook [Changed to < 16, added link and reworded] Signed-off-by: Miguel Ojeda commit ccc4505454db10402d5284f22d8b7db62e636fc5 Author: Andrea Righi Date: Fri Feb 10 16:26:22 2023 +0100 rust: fix regexp in scripts/is_rust_module.sh nm can use "R" or "r" to show read-only data sections, but scripts/is_rust_module.sh can only recognize "r", so with some versions of binutils it can fail to detect if a module is a Rust module or not. Right now we're using this script only to determine if we need to skip BTF generation (that is disabled globally if CONFIG_RUST is enabled), but it's still nice to fix this script to do the proper job. Moreover, with this patch applied I can also relax the constraint of "RUST depends on !DEBUG_INFO_BTF" and build a kernel with Rust and BTF enabled at the same time (of course BTF generation is still skipped for Rust modules). [ Miguel: The actual reason is likely to be a change on the Rust compiler between 1.61.0 and 1.62.0: echo '#[used] static S: () = ();' | rustup run 1.61.0 rustc --emit=obj --crate-type=lib - && nm rust_out.o echo '#[used] static S: () = ();' | rustup run 1.62.0 rustc --emit=obj --crate-type=lib - && nm rust_out.o Gives: 0000000000000000 r _ZN8rust_out1S17h48027ce0da975467E 0000000000000000 R _ZN8rust_out1S17h58e1f3d9c0e97cefE See https://godbolt.org/z/KE6jneoo4. ] Signed-off-by: Andrea Righi Reviewed-by: Vincenzo Palazzo Reviewed-by: Eric Curtin Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Miguel Ojeda commit 71b547f561247897a0a14f3082730156c0533fed Author: Daniel Borkmann Date: Tue Apr 11 15:24:13 2023 +0000 bpf: Fix incorrect verifier pruning due to missing register precision taints Juan Jose et al reported an issue found via fuzzing where the verifier's pruning logic prematurely marks a program path as safe. Consider the following program: 0: (b7) r6 = 1024 1: (b7) r7 = 0 2: (b7) r8 = 0 3: (b7) r9 = -2147483648 4: (97) r6 %= 1025 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 7: (97) r6 %= 1 8: (b7) r9 = 0 9: (bd) if r6 <= r9 goto pc+1 10: (b7) r6 = 0 11: (b7) r0 = 0 12: (63) *(u32 *)(r10 -4) = r0 13: (18) r4 = 0xffff888103693400 // map_ptr(ks=4,vs=48) 15: (bf) r1 = r4 16: (bf) r2 = r10 17: (07) r2 += -4 18: (85) call bpf_map_lookup_elem#1 19: (55) if r0 != 0x0 goto pc+1 20: (95) exit 21: (77) r6 >>= 10 22: (27) r6 *= 8192 23: (bf) r1 = r0 24: (0f) r0 += r6 25: (79) r3 = *(u64 *)(r0 +0) 26: (7b) *(u64 *)(r1 +0) = r3 27: (95) exit The verifier treats this as safe, leading to oob read/write access due to an incorrect verifier conclusion: func#0 @0 0: R1=ctx(off=0,imm=0) R10=fp0 0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff00000000; 0xffffffff)) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0 20: (95) exit from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? 21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0) 24: (0f) r0 += r6 last_idx 24 first_idx 19 regs=40 stack=0 before 23: (bf) r1 = r0 regs=40 stack=0 before 22: (27) r6 *= 8192 regs=40 stack=0 before 21: (77) r6 >>= 10 regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1 parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 regs=40 stack=0 before 10: (b7) r6 = 0 25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 27: (95) exit from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 11 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 frame 0: propagating r6 last_idx 19 first_idx 11 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9 regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=0 R10=fp0 last_idx 8 first_idx 0 regs=40 stack=0 before 8: (b7) r9 = 0 regs=40 stack=0 before 7: (97) r6 %= 1 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=40 stack=0 before 5: (05) goto pc+0 regs=40 stack=0 before 4: (97) r6 %= 1025 regs=40 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 19: safe frame 0: propagating r6 last_idx 9 first_idx 0 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=40 stack=0 before 5: (05) goto pc+0 regs=40 stack=0 before 4: (97) r6 %= 1025 regs=40 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 from 6 to 9: safe verification time 110 usec stack depth 4 processed 36 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2 The verifier considers this program as safe by mistakenly pruning unsafe code paths. In the above func#0, code lines 0-10 are of interest. In line 0-3 registers r6 to r9 are initialized with known scalar values. In line 4 the register r6 is reset to an unknown scalar given the verifier does not track modulo operations. Due to this, the verifier can also not determine precisely which branches in line 6 and 9 are taken, therefore it needs to explore them both. As can be seen, the verifier starts with exploring the false/fall-through paths first. The 'from 19 to 21' path has both r6=0 and r9=0 and the pointer arithmetic on r0 += r6 is therefore considered safe. Given the arithmetic, r6 is correctly marked for precision tracking where backtracking kicks in where it walks back the current path all the way where r6 was set to 0 in the fall-through branch. Next, the pruning logics pops the path 'from 9 to 11' from the stack. Also here, the state of the registers is the same, that is, r6=0 and r9=0, so that at line 19 the path can be pruned as it is considered safe. It is interesting to note that the conditional in line 9 turned r6 into a more precise state, that is, in the fall-through path at the beginning of line 10, it is R6=scalar(umin=1), and in the branch-taken path (which is analyzed here) at the beginning of line 11, r6 turned into a known const r6=0 as r9=0 prior to that and therefore (unsigned) r6 <= 0 concludes that r6 must be 0 (**): [...] ; R6_w=scalar() 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 [...] from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 [...] The next path is 'from 6 to 9'. The verifier considers the old and current state equivalent, and therefore prunes the search incorrectly. Looking into the two states which are being compared by the pruning logic at line 9, the old state consists of R6_rwD=Pscalar() R9_rwD=0 R10=fp0 and the new state consists of R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0. While r6 had the reg->precise flag correctly set in the old state, r9 did not. Both r6'es are considered as equivalent given the old one is a superset of the current, more precise one, however, r9's actual values (0 vs 0x80000000) mismatch. Given the old r9 did not have reg->precise flag set, the verifier does not consider the register as contributing to the precision state of r6, and therefore it considered both r9 states as equivalent. However, for this specific pruned path (which is also the actual path taken at runtime), register r6 will be 0x400 and r9 0x80000000 when reaching line 21, thus oob-accessing the map. The purpose of precision tracking is to initially mark registers (including spilled ones) as imprecise to help verifier's pruning logic finding equivalent states it can then prune if they don't contribute to the program's safety aspects. For example, if registers are used for pointer arithmetic or to pass constant length to a helper, then the verifier sets reg->precise flag and backtracks the BPF program instruction sequence and chain of verifier states to ensure that the given register or stack slot including their dependencies are marked as precisely tracked scalar. This also includes any other registers and slots that contribute to a tracked state of given registers/stack slot. This backtracking relies on recorded jmp_history and is able to traverse entire chain of parent states. This process ends only when all the necessary registers/slots and their transitive dependencies are marked as precise. The backtrack_insn() is called from the current instruction up to the first instruction, and its purpose is to compute a bitmask of registers and stack slots that need precision tracking in the parent's verifier state. For example, if a current instruction is r6 = r7, then r6 needs precision after this instruction and r7 needs precision before this instruction, that is, in the parent state. Hence for the latter r7 is marked and r6 unmarked. For the class of jmp/jmp32 instructions, backtrack_insn() today only looks at call and exit instructions and for all other conditionals the masks remain as-is. However, in the given situation register r6 has a dependency on r9 (as described above in **), so also that one needs to be marked for precision tracking. In other words, if an imprecise register influences a precise one, then the imprecise register should also be marked precise. Meaning, in the parent state both dest and src register need to be tracked for precision and therefore the marking must be more conservative by setting reg->precise flag for both. The precision propagation needs to cover both for the conditional: if the src reg was marked but not the dst reg and vice versa. After the fix the program is correctly rejected: func#0 @0 0: R1=ctx(off=0,imm=0) R10=fp0 0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff80000000; 0x7fffffff),u32_min=-2147483648) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0 20: (95) exit from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? 21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0) 24: (0f) r0 += r6 last_idx 24 first_idx 19 regs=40 stack=0 before 23: (bf) r1 = r0 regs=40 stack=0 before 22: (27) r6 *= 8192 regs=40 stack=0 before 21: (77) r6 >>= 10 regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1 parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 regs=40 stack=0 before 10: (b7) r6 = 0 25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar() 27: (95) exit from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 11 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 frame 0: propagating r6 last_idx 19 first_idx 11 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9 regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1 parent didn't have regs=240 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=P0 R10=fp0 last_idx 8 first_idx 0 regs=240 stack=0 before 8: (b7) r9 = 0 regs=40 stack=0 before 7: (97) r6 %= 1 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 19: safe from 6 to 9: R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 9: (bd) if r6 <= r9 goto pc+1 last_idx 9 first_idx 0 regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 last_idx 9 first_idx 0 regs=200 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 11: R6=scalar(umax=18446744071562067968) R9=-2147483648 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 11 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null(id=3,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0_w=0 20: (95) exit from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=scalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm???? 21: (77) r6 >>= 10 ; R6_w=scalar(umax=18014398507384832,var_off=(0x0; 0x3fffffffffffff)) 22: (27) r6 *= 8192 ; R6_w=scalar(smax=9223372036854767616,umax=18446744073709543424,var_off=(0x0; 0xffffffffffffe000),s32_max=2147475456,u32_max=-8192) 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0) 24: (0f) r0 += r6 last_idx 24 first_idx 21 regs=40 stack=0 before 23: (bf) r1 = r0 regs=40 stack=0 before 22: (27) r6 *= 8192 regs=40 stack=0 before 21: (77) r6 >>= 10 parent didn't have regs=40 stack=0 marks: R0_rw=map_value(off=0,ks=4,vs=48,imm=0) R6_r=Pscalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm???? last_idx 19 first_idx 11 regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1 regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1 regs=40 stack=0 before 17: (07) r2 += -4 regs=40 stack=0 before 16: (bf) r2 = r10 regs=40 stack=0 before 15: (bf) r1 = r4 regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00 regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0 regs=40 stack=0 before 11: (b7) r0 = 0 parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 last_idx 9 first_idx 0 regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1 regs=240 stack=0 before 6: (bd) if r6 <= r9 goto pc+2 regs=240 stack=0 before 5: (05) goto pc+0 regs=240 stack=0 before 4: (97) r6 %= 1025 regs=240 stack=0 before 3: (b7) r9 = -2147483648 regs=40 stack=0 before 2: (b7) r8 = 0 regs=40 stack=0 before 1: (b7) r7 = 0 regs=40 stack=0 before 0: (b7) r6 = 1024 math between map_value pointer and register with unbounded min value is not allowed verification time 886 usec stack depth 4 processed 49 insns (limit 1000000) max_states_per_insn 1 total_states 5 peak_states 5 mark_read 2 Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Reported-by: Juan Jose Lopez Jaimez Reported-by: Meador Inge Reported-by: Simon Scannell Reported-by: Nenad Stojanovski Signed-off-by: Daniel Borkmann Co-developed-by: Andrii Nakryiko Signed-off-by: Andrii Nakryiko Reviewed-by: John Fastabend Reviewed-by: Juan Jose Lopez Jaimez Reviewed-by: Meador Inge Reviewed-by: Simon Scannell commit a25bc8486f9c01c1af6b6c5657234b2eee2c39d6 Author: Dan Carpenter Date: Wed Apr 19 13:16:13 2023 +0300 KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg() The KVM_REG_SIZE() comes from the ioctl and it can be a power of two between 0-32768 but if it is more than sizeof(long) this will corrupt memory. Fixes: 99adb567632b ("KVM: arm/arm64: Add save/restore support for firmware workaround state") Signed-off-by: Dan Carpenter Reviewed-by: Steven Price Reviewed-by: Eric Auger Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/4efbab8c-640f-43b2-8ac6-6d68e08280fe@kili.mountain Signed-off-by: Oliver Upton commit 789b4a41c247ed654322a6150815025b5497cad0 Merge: 40aacb3183ff7 d51425190805d Author: Linus Torvalds Date: Wed Apr 19 07:29:33 2023 -0700 Merge tag 'nfsd-6.3-6' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Address two issues with the new GSS krb5 Kunit tests * tag 'nfsd-6.3-6' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Fix failures of checksum Kunit tests sunrpc: Fix RFC6803 encryption test commit 40aacb3183ff74e15940189ff9a998a93b5ca76f Merge: af67688dca579 b5533e990dd1d Author: Linus Torvalds Date: Wed Apr 19 07:25:12 2023 -0700 Merge tag 'loongarch-fixes-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Some bug fixes, some build fixes, a comment fix and a trivial cleanup" * tag 'loongarch-fixes-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: tools/loongarch: Use __SIZEOF_LONG__ to define __BITS_PER_LONG LoongArch: Replace hard-coded values in comments with VALEN LoongArch: Clean up plat_swiotlb_setup() related code LoongArch: Check unwind_error() in arch_stack_walk() LoongArch: Adjust user_regset_copyin parameter to the correct offset LoongArch: Adjust user_watch_state for explicit alignment LoongArch: module: set section addresses to 0x0 LoongArch: Mark 3 symbol exports as non-GPL LoongArch: Enable PG when wakeup from suspend LoongArch: Fix _CONST64_(x) as unsigned LoongArch: Fix build error if CONFIG_SUSPEND is not set LoongArch: Fix probing of the CRC32 feature LoongArch: Make WriteCombine configurable for ioremap() commit 359f5b0d4e26b7a7bcc574d6148b31a17cefe47d Author: Li Lanzhe Date: Wed Apr 19 07:50:29 2023 -0400 spi: spi-rockchip: Fix missing unwind goto in rockchip_sfc_probe() If devm_request_irq() fails, then we are directly return 'ret' without clk_disable_unprepare(sfc->clk) and clk_disable_unprepare(sfc->hclk). Fix this by changing direct return to a goto 'err_irq'. Fixes: 0b89fc0a367e ("spi: rockchip-sfc: add rockchip serial flash controller") Signed-off-by: Li Lanzhe Reviewed-by: Dongliang Mu Link: https://lore.kernel.org/r/20230419115030.6029-1-u202212060@hust.edu.cn Signed-off-by: Mark Brown commit 86a24e99c97234f87d9f70b528a691150e145197 Author: Nikita Zhandarovich Date: Mon Apr 17 06:32:42 2023 -0700 ASoC: fsl_asrc_dma: fix potential null-ptr-deref dma_request_slave_channel() may return NULL which will lead to NULL pointer dereference error in 'tmp_chan->private'. Correct this behaviour by, first, switching from deprecated function dma_request_slave_channel() to dma_request_chan(). Secondly, enable sanity check for the resuling value of dma_request_chan(). Also, fix description that follows the enacted changes and that concerns the use of dma_request_slave_channel(). Fixes: 706e2c881158 ("ASoC: fsl_asrc_dma: Reuse the dma channel if available in Back-End") Co-developed-by: Natalia Petrova Signed-off-by: Nikita Zhandarovich Acked-by: Shengjiu Wang Link: https://lore.kernel.org/r/20230417133242.53339-1-n.zhandarovich@fintech.ru Signed-off-by: Mark Brown commit 238787157d83969e5149c8e99787d5d90e85fbe5 Author: Chancel Liu Date: Tue Apr 18 17:42:59 2023 +0800 ASoC: fsl_sai: Fix pins setting for i.MX8QM platform SAI on i.MX8QM platform supports the data lines up to 4. So the pins setting should be corrected to 4. Fixes: eba0f0077519 ("ASoC: fsl_sai: Enable combine mode soft") Signed-off-by: Chancel Liu Acked-by: Shengjiu Wang Reviewed-by: Iuliana Prodan Link: https://lore.kernel.org/r/20230418094259.4150771-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit fcd4843a19d50f9e59116b2643e1a7d171b6fca1 Author: Arnd Bergmann Date: Mon Apr 17 22:50:55 2023 +0200 hamradio: drop ISA_DMA_API dependency It looks like the dependency got added accidentally in commit a553260618d8 ("[PATCH] ISA DMA Kconfig fixes - part 3"). Unlike the previously removed dmascc driver, the scc driver never used DMA. Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 1f64757ee2bb22a93ec89b4c71707297e8cca0ba Author: Ido Schimmel Date: Mon Apr 17 18:52:51 2023 +0200 mlxsw: pci: Fix possible crash during initialization During initialization the driver issues a reset command via its command interface in order to remove previous configuration from the device. After issuing the reset, the driver waits for 200ms before polling on the "system_status" register using memory-mapped IO until the device reaches a ready state (0x5E). The wait is necessary because the reset command only triggers the reset, but the reset itself happens asynchronously. If the driver starts polling too soon, the read of the "system_status" register will never return and the system will crash [1]. The issue was discovered when the device was flashed with a development firmware version where the reset routine took longer to complete. The issue was fixed in the firmware, but it exposed the fact that the current wait time is borderline. Fix by increasing the wait time from 200ms to 400ms. With this patch and the buggy firmware version, the issue did not reproduce in 10 reboots whereas without the patch the issue is reproduced quite consistently. [1] mce: CPUs not responding to MCE broadcast (may include false positives): 0,4 mce: CPUs not responding to MCE broadcast (may include false positives): 0,4 Kernel panic - not syncing: Timeout: Not all CPUs entered broadcast exception handler Shutting down cpus with NMI Kernel Offset: 0x12000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Fixes: ac004e84164e ("mlxsw: pci: Wait longer before accessing the device after reset") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit bc66b591903e197982215f9febcfa09c4becfd89 Author: Jaroslav Kysela Date: Wed Apr 19 10:11:21 2023 +0200 ALSA: hda/realtek: Remove specific patch for Dell Precision 3260 Unfortunately, the tester gave a weak feedback (working/non-working) for this case. After the double confirmation, this change is not really required. The standard code with alc269_fallback_pin_fixup_tbl should work on this hardware. Fixes: 5911d78fabbb ("ALSA: hda/realtek: Improve support for Dell Precision 3260") Fixes: 5f4efc9dfcfd ("ALSA: hda/realtek: Fix support for Dell Precision 3260") Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230419081121.304846-1-perex@perex.cz Signed-off-by: Takashi Iwai commit ed7f9c01e2de73eb65388357c341d4323dd02eac Merge: 4e006c7a6dac0 63740448a32eb Author: David S. Miller Date: Wed Apr 19 09:08:37 2023 +0100 Merge branch 'mptcp-fixes' Matthieu Baerts says: ==================== mptcp: fixes around listening sockets and the MPTCP worker Christoph Paasch reported a couple of issues found by syzkaller and linked to operations done by the MPTCP worker on (un)accepted sockets. Fixing these issues was not obvious and rather complex but Paolo Abeni nicely managed to propose these excellent patches that seem to satisfy syzkaller. Patch 1 partially reverts a recent fix but while still providing a solution for the previous issue, it also prevents the MPTCP worker from running concurrently with inet_csk_listen_stop(). A warning is then avoided. The partially reverted patch has been introduced in v6.3-rc3, backported up to v6.1 and fixing an issue visible from v5.18. Patch 2 prevents the MPTCP worker to race with mptcp_accept() causing a UaF when a fallback to TCP is done while in parallel, the socket is being accepted by the userspace. This is also a fix of a previous fix introduced in v6.3-rc3, backported up to v6.1 but here fixing an issue that is in theory there from v5.7. There is no need to backport it up to here as it looks like it is only visible later, around v5.18, see the previous cover-letter linked to this original fix. ==================== Signed-off-by: Matthieu Baerts commit 63740448a32eb662e05894425b47bcc5814136f4 Author: Paolo Abeni Date: Mon Apr 17 16:00:41 2023 +0200 mptcp: fix accept vs worker race The mptcp worker and mptcp_accept() can race, as reported by Christoph: refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 14351 at lib/refcount.c:25 refcount_warn_saturate+0x105/0x1b0 lib/refcount.c:25 Modules linked in: CPU: 1 PID: 14351 Comm: syz-executor.2 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:refcount_warn_saturate+0x105/0x1b0 lib/refcount.c:25 Code: 02 31 ff 89 de e8 1b f0 a7 ff 84 db 0f 85 6e ff ff ff e8 3e f5 a7 ff 48 c7 c7 d8 c7 34 83 c6 05 6d 2d 0f 02 01 e8 cb 3d 90 ff <0f> 0b e9 4f ff ff ff e8 1f f5 a7 ff 0f b6 1d 54 2d 0f 02 31 ff 89 RSP: 0018:ffffc90000a47bf8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802eae98c0 RSI: ffffffff81097d4f RDI: 0000000000000001 RBP: ffff88802e712180 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffff88802eaea148 R12: ffff88802e712100 R13: ffff88802e712a88 R14: ffff888005cb93a8 R15: ffff88802e712a88 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f277fd89120 CR3: 0000000035486002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_add include/linux/refcount.h:199 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] sock_hold include/net/sock.h:775 [inline] __mptcp_close+0x4c6/0x4d0 net/mptcp/protocol.c:3051 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x56/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x51/0xf0 net/socket.c:653 sock_close+0x18/0x20 net/socket.c:1395 __fput+0x113/0x430 fs/file_table.c:321 task_work_run+0x96/0x100 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x4fc/0x10c0 kernel/exit.c:869 do_group_exit+0x51/0xf0 kernel/exit.c:1019 get_signal+0x12b0/0x1390 kernel/signal.c:2859 arch_do_signal_or_restart+0x25/0x260 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x131/0x1a0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x19/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fec4b4926a9 Code: Unable to access opcode bytes at 0x7fec4b49267f. RSP: 002b:00007fec49f9dd78 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00000000006bc058 RCX: 00007fec4b4926a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006bc058 RBP: 00000000006bc050 R08: 00000000007df998 R09: 00000000007df998 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 000000000000000b R15: 000000000001fe40 The root cause is that the worker can force fallback to TCP the first mptcp subflow, actually deleting the unaccepted msk socket. We can explicitly prevent the race delaying the unaccepted msk deletion at listener shutdown time. In case the closed subflow is later accepted, just drop the mptcp context and let the user-space deal with the paired mptcp socket. Fixes: b6985b9b8295 ("mptcp: use the workqueue to destroy unaccepted sockets") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch Link: https://github.com/multipath-tcp/mptcp_net-next/issues/375 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Tested-by: Christoph Paasch Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 2a6a870e44dd88f1a6a2893c65ef756a9edfb4c7 Author: Paolo Abeni Date: Mon Apr 17 16:00:40 2023 +0200 mptcp: stops worker on unaccepted sockets at listener close This is a partial revert of the blamed commit, with a relevant change: mptcp_subflow_queue_clean() now just change the msk socket status and stop the worker, so that the UaF issue addressed by the blamed commit is not re-introduced. The above prevents the mptcp worker from running concurrently with inet_csk_listen_stop(), as such race would trigger a warning, as reported by Christoph: RSP: 002b:00007f784fe09cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e WARNING: CPU: 0 PID: 25807 at net/ipv4/inet_connection_sock.c:1387 inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f7850afd6a9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 Modules linked in: RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 CPU: 0 PID: 25807 Comm: syz-executor.7 Not tainted 6.2.0-g778e54711659 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:inet_csk_listen_stop+0x664/0x870 net/ipv4/inet_connection_sock.c:1387 RAX: 0000000000000000 RBX: ffff888100dfbd40 RCX: 0000000000000000 RDX: ffff8881363aab80 RSI: ffffffff81c494f4 RDI: 0000000000000005 RBP: ffff888126dad080 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888100dfe040 R13: 0000000000000001 R14: 0000000000000000 R15: ffff888100dfbdd8 FS: 00007f7850a2c800(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32d26000 CR3: 000000012fdd8006 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __tcp_close+0x5b2/0x620 net/ipv4/tcp.c:2875 __mptcp_close_ssk+0x145/0x3d0 net/mptcp/protocol.c:2427 mptcp_destroy_common+0x8a/0x1c0 net/mptcp/protocol.c:3277 mptcp_destroy+0x41/0x60 net/mptcp/protocol.c:3304 __mptcp_destroy_sock+0x56/0x140 net/mptcp/protocol.c:2965 __mptcp_close+0x38f/0x4a0 net/mptcp/protocol.c:3057 mptcp_close+0x24/0xe0 net/mptcp/protocol.c:3072 inet_release+0x53/0xa0 net/ipv4/af_inet.c:429 __sock_release+0x4e/0xf0 net/socket.c:651 sock_close+0x15/0x20 net/socket.c:1393 __fput+0xff/0x420 fs/file_table.c:321 task_work_run+0x8b/0xe0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:296 do_syscall_64+0x46/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f7850af70dc RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7850af70dc RDX: 00007f7850a2c800 RSI: 0000000000000002 RDI: 0000000000000003 RBP: 00000000006bd980 R08: 0000000000000000 R09: 00000000000018a0 R10: 00000000316338a4 R11: 0000000000000293 R12: 0000000000211e31 R13: 00000000006bc05c R14: 00007f785062c000 R15: 0000000000211af0 Fixes: 0a3f4f1f9c27 ("mptcp: fix UaF in listener shutdown") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch Link: https://github.com/multipath-tcp/mptcp_net-next/issues/371 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 4e006c7a6dac0ead4c1bf606000aa90a372fc253 Author: Alexander Aring Date: Mon Apr 17 09:00:52 2023 -0400 net: rpl: fix rpl header size calculation This patch fixes a missing 8 byte for the header size calculation. The ipv6_rpl_srh_size() is used to check a skb_pull() on skb->data which points to skb_transport_header(). Currently we only check on the calculated addresses fields using CmprI and CmprE fields, see: https://www.rfc-editor.org/rfc/rfc6554#section-3 there is however a missing 8 byte inside the calculation which stands for the fields before the addresses field. Those 8 bytes are represented by sizeof(struct ipv6_rpl_sr_hdr) expression. Fixes: 8610c7c6e3bd ("net: ipv6: add support for rpl sr exthdr") Signed-off-by: Alexander Aring Reported-by: maxpl0it Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 6f4833383e8514ea796d094e05c24889b8997fde Author: Seiji Nishikawa Date: Mon Apr 17 21:21:27 2023 +0900 net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() When vmxnet3_rq_create() fails to allocate rq->data_ring.base due to page allocation failure, subsequent call to vmxnet3_rq_rx_complete() can result in NULL pointer dereference. To fix this bug, check not only that rxDataRingUsed is true but also that adapter->rxdataring_enabled is true before calling memcpy() in vmxnet3_rq_rx_complete(). [1728352.477993] ethtool: page allocation failure: order:9, mode:0x6000c0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0 ... [1728352.478009] Call Trace: [1728352.478028] dump_stack+0x41/0x60 [1728352.478035] warn_alloc.cold.120+0x7b/0x11b [1728352.478038] ? _cond_resched+0x15/0x30 [1728352.478042] ? __alloc_pages_direct_compact+0x15f/0x170 [1728352.478043] __alloc_pages_slowpath+0xcd3/0xd10 [1728352.478047] __alloc_pages_nodemask+0x2e2/0x320 [1728352.478049] __dma_direct_alloc_pages.constprop.25+0x8a/0x120 [1728352.478053] dma_direct_alloc+0x5a/0x2a0 [1728352.478056] vmxnet3_rq_create.part.57+0x17c/0x1f0 [vmxnet3] ... [1728352.478188] vmxnet3 0000:0b:00.0 ens192: rx data ring will be disabled ... [1728352.515347] BUG: unable to handle kernel NULL pointer dereference at 0000000000000034 ... [1728352.515440] RIP: 0010:memcpy_orig+0x54/0x130 ... [1728352.515655] Call Trace: [1728352.515665] [1728352.515672] vmxnet3_rq_rx_complete+0x419/0xef0 [vmxnet3] [1728352.515690] vmxnet3_poll_rx_only+0x31/0xa0 [vmxnet3] ... Signed-off-by: Seiji Nishikawa Signed-off-by: David S. Miller commit c484fcc058bada604d7e4e5228d4affb646ddbc2 Author: Ido Schimmel Date: Mon Apr 17 09:12:16 2023 +0300 bonding: Fix memory leak when changing bond type to Ethernet When a net device is put administratively up, its 'IFF_UP' flag is set (if not set already) and a 'NETDEV_UP' notification is emitted, which causes the 8021q driver to add VLAN ID 0 on the device. The reverse happens when a net device is put administratively down. When changing the type of a bond to Ethernet, its 'IFF_UP' flag is incorrectly cleared, resulting in the kernel skipping the above process and VLAN ID 0 being leaked [1]. Fix by restoring the flag when changing the type to Ethernet, in a similar fashion to the restoration of the 'IFF_SLAVE' flag. The issue can be reproduced using the script in [2], with example out before and after the fix in [3]. [1] unreferenced object 0xffff888103479900 (size 256): comm "ip", pid 329, jiffies 4294775225 (age 28.561s) hex dump (first 32 bytes): 00 a0 0c 15 81 88 ff ff 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc_trace+0x2a/0xe0 [] vlan_vid_add+0x30c/0x790 [] vlan_device_event+0x1491/0x21a0 [] notifier_call_chain+0xbe/0x1f0 [] call_netdevice_notifiers_info+0xba/0x150 [] __dev_notify_flags+0x132/0x2e0 [] dev_change_flags+0x11f/0x180 [] do_setlink+0xb96/0x4060 [] __rtnl_newlink+0xc0a/0x18a0 [] rtnl_newlink+0x6c/0xa0 [] rtnetlink_rcv_msg+0x43e/0xe00 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x53f/0x810 [] netlink_sendmsg+0x96b/0xe90 [] ____sys_sendmsg+0x30f/0xa70 [] ___sys_sendmsg+0x13a/0x1e0 unreferenced object 0xffff88810f6a83e0 (size 32): comm "ip", pid 329, jiffies 4294775225 (age 28.561s) hex dump (first 32 bytes): a0 99 47 03 81 88 ff ff a0 99 47 03 81 88 ff ff ..G.......G..... 81 00 00 00 01 00 00 00 cc cc cc cc cc cc cc cc ................ backtrace: [] kmalloc_trace+0x2a/0xe0 [] vlan_vid_add+0x409/0x790 [] vlan_device_event+0x1491/0x21a0 [] notifier_call_chain+0xbe/0x1f0 [] call_netdevice_notifiers_info+0xba/0x150 [] __dev_notify_flags+0x132/0x2e0 [] dev_change_flags+0x11f/0x180 [] do_setlink+0xb96/0x4060 [] __rtnl_newlink+0xc0a/0x18a0 [] rtnl_newlink+0x6c/0xa0 [] rtnetlink_rcv_msg+0x43e/0xe00 [] netlink_rcv_skb+0x170/0x440 [] netlink_unicast+0x53f/0x810 [] netlink_sendmsg+0x96b/0xe90 [] ____sys_sendmsg+0x30f/0xa70 [] ___sys_sendmsg+0x13a/0x1e0 [2] ip link add name t-nlmon type nlmon ip link add name t-dummy type dummy ip link add name t-bond type bond mode active-backup ip link set dev t-bond up ip link set dev t-nlmon master t-bond ip link set dev t-nlmon nomaster ip link show dev t-bond ip link set dev t-dummy master t-bond ip link show dev t-bond ip link del dev t-bond ip link del dev t-dummy ip link del dev t-nlmon [3] Before: 12: t-bond: mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000 link/netlink 12: t-bond: mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether 46:57:39:a4:46:a2 brd ff:ff:ff:ff:ff:ff After: 12: t-bond: mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000 link/netlink 12: t-bond: mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether 66:48:7b:74:b6:8a brd ff:ff:ff:ff:ff:ff Fixes: e36b9d16c6a6 ("bonding: clean muticast addresses when device changes type") Fixes: 75c78500ddad ("bonding: remap muticast addresses without using dev_close() and dev_open()") Fixes: 9ec7eb60dcbc ("bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change") Reported-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/netdev/78a8a03b-6070-3e6b-5042-f848dab16fb8@alu.unizg.hr/ Tested-by: Mirsad Goran Todorovac Signed-off-by: Ido Schimmel Acked-by: Jay Vosburgh Signed-off-by: David S. Miller commit b5533e990dd1de5872a34cba2f4f7f508c9b2ec3 Author: Tiezhu Yang Date: Wed Apr 19 12:07:34 2023 +0800 tools/loongarch: Use __SIZEOF_LONG__ to define __BITS_PER_LONG Although __SIZEOF_POINTER__ is equal to _SIZEOF_LONG__ on LoongArch, it is better to use __SIZEOF_LONG__ to define __BITS_PER_LONG to keep consistent between arch/loongarch/include/uapi/asm/bitsperlong.h and tools/arch/loongarch/include/uapi/asm/bitsperlong.h. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 213ef669d1e536e57cdff8ddc2d3b9347b98e35f Author: Enze Li Date: Wed Apr 19 12:07:27 2023 +0800 LoongArch: Replace hard-coded values in comments with VALEN According to LoongArch documentation [1], CSR.PGDL and CSR.PGDH are concerned with the VA's MSB which is VALEN-1 instead of always being 47. Fix comments to avoid misleading others. [1] https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#page-global-directory-base-address-for-lower-half-address-space Reviewed-by: WANG Xuerui Signed-off-by: Enze Li Signed-off-by: Huacai Chen commit afca6e06494c75e25a71ccb4926459944e23098b Author: Tiezhu Yang Date: Wed Apr 19 12:07:27 2023 +0800 LoongArch: Clean up plat_swiotlb_setup() related code After commit c78c43fe7d42 ("LoongArch: Use acpi_arch_dma_setup() and remove ARCH_HAS_PHYS_TO_DMA"), plat_swiotlb_setup() has been deleted, so clean up the related code. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 370a3b8f58743eceb97c5256538d6048c26d2d03 Author: Tiezhu Yang Date: Wed Apr 19 12:07:27 2023 +0800 LoongArch: Check unwind_error() in arch_stack_walk() We can see the following messages with CONFIG_PROVE_LOCKING=y on LoongArch: BUG: MAX_STACK_TRACE_ENTRIES too low! turning off the locking correctness validator. This is because stack_trace_save() returns a big value after call arch_stack_walk(), here is the call trace: save_trace() stack_trace_save() arch_stack_walk() stack_trace_consume_entry() arch_stack_walk() should return immediately if unwind_next_frame() failed, no need to do the useless loops to increase the value of c->len in stack_trace_consume_entry(), then we can fix the above problem. Cc: stable@vger.kernel.org Reported-by: Guenter Roeck Link: https://lore.kernel.org/all/8a44ad71-68d2-4926-892f-72bfc7a67e2a@roeck-us.net/ Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit e32b3b8222204df8a2642a770f79ec2d7086faed Author: Qing Zhang Date: Wed Apr 19 12:07:27 2023 +0800 LoongArch: Adjust user_regset_copyin parameter to the correct offset Ensure that user_watch_state can be set correctly by the user. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit ff9f3d7aefddbaa9a9b0f18f83e4319b5cd0e63e Author: Qing Zhang Date: Wed Apr 19 12:07:27 2023 +0800 LoongArch: Adjust user_watch_state for explicit alignment This is done in order to easily calculate the number of breakpoints in hw_break_get()/hw_break_set(). Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 92e8c732d8518588ac34b4cb3feaf37d2cb87555 Merge: c0e73276f0fcb d4eb7e39929a3 Author: Jakub Kicinski Date: Tue Apr 18 20:46:31 2023 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Unbreak br_netfilter physdev match support, from Florian Westphal. 2) Use GFP_KERNEL_ACCOUNT for stateful/policy objects, from Chen Aotian. 3) Use IS_ENABLED() in nf_reset_trace(), from Florian Westphal. 4) Fix validation of catch-all set element. 5) Tighten requirements for catch-all set elements. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements netfilter: nf_tables: validate catch-all set elements netfilter: nf_tables: fix ifdef to also consider nf_tables=m netfilter: nf_tables: Modify nla_memdup's flag to GFP_KERNEL_ACCOUNT netfilter: br_netfilter: fix recent physdev match breakage ==================== Link: https://lore.kernel.org/r/20230418145048.67270-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 023fc150a39ffe656da3e459ad801eb1c7fdfad9 Author: David Howells Date: Tue Apr 18 23:49:12 2023 +0100 cifs: Reapply lost fix from commit 30b2b2196d6e Reapply the fix from: 30b2b2196d6e ("cifs: do not include page data when checking signature") that got lost in the iteratorisation of the cifs driver. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Acked-by: Paulo Alcantara (SUSE) Reported-by: Paulo Alcantara Signed-off-by: David Howells cc: Paulo Alcantara cc: Shyam Prasad N cc: Bharath S M cc: Enzo Matsumiya cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit ac13692844f2fb23c503066c0cb231243218a7c8 Author: David Howells Date: Tue Apr 18 23:40:07 2023 +0100 cifs: Fix unbuffered read If read() is done in an unbuffered manner, such that, say, cifs_strict_readv() goes through cifs_user_readv() and thence __cifs_readv(), it doesn't recognise the EOF and keeps indicating to userspace that it returning full buffers of data. This is due to ctx->iter being advanced in cifs_send_async_read() as the buffer is split up amongst a number of rdata objects. The iterator count is then used in collect_uncached_read_data() in the non-DIO case to set the total length read - and thus the return value of sys_read(). But since the iterator normally gets used up completely during splitting, ctx->total_len gets overridden to the full amount. However, prior to that in collect_uncached_read_data(), we've gone through the list of rdatas and added up the amount of data we actually received (which we then throw away). Fix this by removing the bit that overrides the amount read in the non-DIO case and just going with the total added up in the aforementioned loop. This was observed by mounting a cifs share with multiple channels, e.g.: mount //192.168.6.1/test /test/ -o user=shares,pass=...,max_channels=6 and then reading a 1MiB file on the share: strace cat /xfstest.test/1M >/dev/null Through strace, the same data can be seen being read again and again. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Signed-off-by: David Howells Acked-by: Paulo Alcantara (SUSE) cc: Jérôme Glisse cc: Long Li cc: Enzo Matsumiya cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit ef832747a82dfbc22a3702219cc716f449b24e4a Author: Ryusuke Konishi Date: Tue Apr 18 02:35:13 2023 +0900 nilfs2: initialize unused bytes in segment summary blocks Syzbot still reports uninit-value in nilfs_add_checksums_on_logs() for KMSAN enabled kernels after applying commit 7397031622e0 ("nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field"). This is because the unused bytes at the end of each block in segment summaries are not initialized. So this fixes the issue by padding the unused bytes with null bytes. Link: https://lkml.kernel.org/r/20230417173513.12598-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Tested-by: Ryusuke Konishi Reported-by: syzbot+048585f3f4227bb2b49b@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=048585f3f4227bb2b49b Cc: Alexander Potapenko Cc: Signed-off-by: Andrew Morton commit 4d73ba5fa710fe7d432e0b271e6fecd252aef66e Author: Mel Gorman Date: Fri Apr 14 15:14:29 2023 +0100 mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages A bug was reported by Yuanxi Liu where allocating 1G pages at runtime is taking an excessive amount of time for large amounts of memory. Further testing allocating huge pages that the cost is linear i.e. if allocating 1G pages in batches of 10 then the time to allocate nr_hugepages from 10->20->30->etc increases linearly even though 10 pages are allocated at each step. Profiles indicated that much of the time is spent checking the validity within already existing huge pages and then attempting a migration that fails after isolating the range, draining pages and a whole lot of other useless work. Commit eb14d4eefdc4 ("mm,page_alloc: drop unnecessary checks from pfn_range_valid_contig") removed two checks, one which ignored huge pages for contiguous allocations as huge pages can sometimes migrate. While there may be value on migrating a 2M page to satisfy a 1G allocation, it's potentially expensive if the 1G allocation fails and it's pointless to try moving a 1G page for a new 1G allocation or scan the tail pages for valid PFNs. Reintroduce the PageHuge check and assume any contiguous region with hugetlbfs pages is unsuitable for a new 1G allocation. The hpagealloc test allocates huge pages in batches and reports the average latency per page over time. This test happens just after boot when fragmentation is not an issue. Units are in milliseconds. hpagealloc 6.3.0-rc6 6.3.0-rc6 6.3.0-rc6 vanilla hugeallocrevert-v1r1 hugeallocsimple-v1r2 Min Latency 26.42 ( 0.00%) 5.07 ( 80.82%) 18.94 ( 28.30%) 1st-qrtle Latency 356.61 ( 0.00%) 5.34 ( 98.50%) 19.85 ( 94.43%) 2nd-qrtle Latency 697.26 ( 0.00%) 5.47 ( 99.22%) 20.44 ( 97.07%) 3rd-qrtle Latency 972.94 ( 0.00%) 5.50 ( 99.43%) 20.81 ( 97.86%) Max-1 Latency 26.42 ( 0.00%) 5.07 ( 80.82%) 18.94 ( 28.30%) Max-5 Latency 82.14 ( 0.00%) 5.11 ( 93.78%) 19.31 ( 76.49%) Max-10 Latency 150.54 ( 0.00%) 5.20 ( 96.55%) 19.43 ( 87.09%) Max-90 Latency 1164.45 ( 0.00%) 5.53 ( 99.52%) 20.97 ( 98.20%) Max-95 Latency 1223.06 ( 0.00%) 5.55 ( 99.55%) 21.06 ( 98.28%) Max-99 Latency 1278.67 ( 0.00%) 5.57 ( 99.56%) 22.56 ( 98.24%) Max Latency 1310.90 ( 0.00%) 8.06 ( 99.39%) 26.62 ( 97.97%) Amean Latency 678.36 ( 0.00%) 5.44 * 99.20%* 20.44 * 96.99%* 6.3.0-rc6 6.3.0-rc6 6.3.0-rc6 vanilla revert-v1 hugeallocfix-v2 Duration User 0.28 0.27 0.30 Duration System 808.66 17.77 35.99 Duration Elapsed 830.87 18.08 36.33 The vanilla kernel is poor, taking up to 1.3 second to allocate a huge page and almost 10 minutes in total to run the test. Reverting the problematic commit reduces it to 8ms at worst and the patch takes 26ms. This patch fixes the main issue with skipping huge pages but leaves the page_count() out because a page with an elevated count potentially can migrate. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=217022 Link: https://lkml.kernel.org/r/20230414141429.pwgieuwluxwez3rj@techsingularity.net Fixes: eb14d4eefdc4 ("mm,page_alloc: drop unnecessary checks from pfn_range_valid_contig") Signed-off-by: Mel Gorman Reported-by: Yuanxi Liu Acked-by: Vlastimil Babka Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton commit 58c5d0d6d522112577c7eeb71d382ea642ed7be4 Author: Liam R. Howlett Date: Fri Apr 14 14:59:19 2023 -0400 mm/mmap: regression fix for unmapped_area{_topdown} The maple tree limits the gap returned to a window that specifically fits what was asked. This may not be optimal in the case of switching search directions or a gap that does not satisfy the requested space for other reasons. Fix the search by retrying the operation and limiting the search window in the rare occasion that a conflict occurs. Link: https://lkml.kernel.org/r/20230414185919.4175572-1-Liam.Howlett@oracle.com Fixes: 3499a13168da ("mm/mmap: use maple tree for unmapped_area{_topdown}") Signed-off-by: Liam R. Howlett Reported-by: Rick Edgecombe Cc: Signed-off-by: Andrew Morton commit 06e8fd999334bcd76b4d72d7b9206d4aea89764e Author: Liam R. Howlett Date: Fri Apr 14 10:57:27 2023 -0400 maple_tree: fix mas_empty_area() search The internal function of mas_awalk() was incorrectly skipping the last entry in a node, which could potentially be NULL. This is only a problem for the left-most node in the tree - otherwise that NULL would not exist. Fix mas_awalk() by using the metadata to obtain the end of the node for the loop and the logical pivot as apposed to the raw pivot value. Link: https://lkml.kernel.org/r/20230414145728.4067069-2-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: Rick Edgecombe Cc: Signed-off-by: Andrew Morton commit fad8e4291da5e3243e086622df63cb952db444d8 Author: Liam R. Howlett Date: Fri Apr 14 10:57:26 2023 -0400 maple_tree: make maple state reusable after mas_empty_area_rev() Stop using maple state min/max for the range by passing through pointers for those values. This will allow the maple state to be reused without resetting. Also add some logic to fail out early on searching with invalid arguments. Link: https://lkml.kernel.org/r/20230414145728.4067069-1-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: Rick Edgecombe Cc: Signed-off-by: Andrew Morton commit fdea03e12aa2a44a7bb34144208be97fc25dfd90 Author: Alexander Potapenko Date: Thu Apr 13 15:12:21 2023 +0200 mm: kmsan: handle alloc failures in kmsan_ioremap_page_range() Similarly to kmsan_vmap_pages_range_noflush(), kmsan_ioremap_page_range() must also properly handle allocation/mapping failures. In the case of such, it must clean up the already created metadata mappings and return an error code, so that the error can be propagated to ioremap_page_range(). Without doing so, KMSAN may silently fail to bring the metadata for the page range into a consistent state, which will result in user-visible crashes when trying to access them. Link: https://lkml.kernel.org/r/20230413131223.4135168-2-glider@google.com Fixes: b073d7f8aee4 ("mm: kmsan: maintain KMSAN metadata for page operations") Signed-off-by: Alexander Potapenko Reported-by: Dipanjan Das Link: https://lore.kernel.org/linux-mm/CANX2M5ZRrRA64k0hOif02TjmY9kbbO2aCBPyq79es34RXZ=cAw@mail.gmail.com/ Reviewed-by: Marco Elver Cc: Christoph Hellwig Cc: Dmitry Vyukov Cc: Uladzislau Rezki (Sony) Cc: Signed-off-by: Andrew Morton commit 47ebd0310e89c087f56e58c103c44b72a2f6b216 Author: Alexander Potapenko Date: Thu Apr 13 15:12:20 2023 +0200 mm: kmsan: handle alloc failures in kmsan_vmap_pages_range_noflush() As reported by Dipanjan Das, when KMSAN is used together with kernel fault injection (or, generally, even without the latter), calls to kcalloc() or __vmap_pages_range_noflush() may fail, leaving the metadata mappings for the virtual mapping in an inconsistent state. When these metadata mappings are accessed later, the kernel crashes. To address the problem, we return a non-zero error code from kmsan_vmap_pages_range_noflush() in the case of any allocation/mapping failure inside it, and make vmap_pages_range_noflush() return an error if KMSAN fails to allocate the metadata. This patch also removes KMSAN_WARN_ON() from vmap_pages_range_noflush(), as these allocation failures are not fatal anymore. Link: https://lkml.kernel.org/r/20230413131223.4135168-1-glider@google.com Fixes: b073d7f8aee4 ("mm: kmsan: maintain KMSAN metadata for page operations") Signed-off-by: Alexander Potapenko Reported-by: Dipanjan Das Link: https://lore.kernel.org/linux-mm/CANX2M5ZRrRA64k0hOif02TjmY9kbbO2aCBPyq79es34RXZ=cAw@mail.gmail.com/ Reviewed-by: Marco Elver Cc: Christoph Hellwig Cc: Dmitry Vyukov Cc: Uladzislau Rezki (Sony) Cc: Signed-off-by: Andrew Morton commit a101482421a318369eef2d0e03f2fcb40a47abad Author: SeongJae Park Date: Sat Apr 15 20:31:10 2023 +0000 tools/Makefile: do missed s/vm/mm/ Commit 799fb82aa132 ("tools/vm: rename tools/vm to tools/mm") missed renaming 'vm' in 'tools/Makefile' to 'mm'. As a result, 'make clean' under 'tools/' directory fails as below: $ make -C tools clean DESCEND vm make[1]: Entering directory '/linux/tools/vm' make[1]: *** No rule to make target 'clean'. Stop. make[1]: Leaving directory '/linux/tools/vm' make: *** [Makefile:173: vm_clean] Error 2 make: Leaving directory '/linux/tools' Do the missed rename. Link: https://lkml.kernel.org/r/20230415203110.13858-1-sj@kernel.org Fixes: 799fb82aa132 ("tools/vm: rename tools/vm to tools/mm") Signed-off-by: SeongJae Park Reported-by: Ricardo Pardini Link: https://lore.kernel.org/linux-mm/20230415202454.13558-1-sj@kernel.org/ Tested-by: Ricardo Pardini Signed-off-by: Andrew Morton commit b20b0368c614c609badfe16fbd113dfb4780acd9 Author: Mathieu Desnoyers Date: Thu Mar 30 09:38:22 2023 -0400 mm: fix memory leak on mm_init error handling commit f1a7941243c1 ("mm: convert mm's rss stats into percpu_counter") introduces a memory leak by missing a call to destroy_context() when a percpu_counter fails to allocate. Before introducing the per-cpu counter allocations, init_new_context() was the last call that could fail in mm_init(), and thus there was no need to ever invoke destroy_context() in the error paths. Adding the following percpu counter allocations adds error paths after init_new_context(), which means its associated destroy_context() needs to be called when percpu counters fail to allocate. Link: https://lkml.kernel.org/r/20230330133822.66271-1-mathieu.desnoyers@efficios.com Fixes: f1a7941243c1 ("mm: convert mm's rss stats into percpu_counter") Signed-off-by: Mathieu Desnoyers Acked-by: Shakeel Butt Cc: Marek Szyprowski Cc: Signed-off-by: Andrew Morton commit 1007843a91909a4995ee78a538f62d8665705b66 Author: Tetsuo Handa Date: Tue Apr 4 23:31:58 2023 +0900 mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock syzbot is reporting circular locking dependency which involves zonelist_update_seq seqlock [1], for this lock is checked by memory allocation requests which do not need to be retried. One deadlock scenario is kmalloc(GFP_ATOMIC) from an interrupt handler. CPU0 ---- __build_all_zonelists() { write_seqlock(&zonelist_update_seq); // makes zonelist_update_seq.seqcount odd // e.g. timer interrupt handler runs at this moment some_timer_func() { kmalloc(GFP_ATOMIC) { __alloc_pages_slowpath() { read_seqbegin(&zonelist_update_seq) { // spins forever because zonelist_update_seq.seqcount is odd } } } } // e.g. timer interrupt handler finishes write_sequnlock(&zonelist_update_seq); // makes zonelist_update_seq.seqcount even } This deadlock scenario can be easily eliminated by not calling read_seqbegin(&zonelist_update_seq) from !__GFP_DIRECT_RECLAIM allocation requests, for retry is applicable to only __GFP_DIRECT_RECLAIM allocation requests. But Michal Hocko does not know whether we should go with this approach. Another deadlock scenario which syzbot is reporting is a race between kmalloc(GFP_ATOMIC) from tty_insert_flip_string_and_push_buffer() with port->lock held and printk() from __build_all_zonelists() with zonelist_update_seq held. CPU0 CPU1 ---- ---- pty_write() { tty_insert_flip_string_and_push_buffer() { __build_all_zonelists() { write_seqlock(&zonelist_update_seq); build_zonelists() { printk() { vprintk() { vprintk_default() { vprintk_emit() { console_unlock() { console_flush_all() { console_emit_next_record() { con->write() = serial8250_console_write() { spin_lock_irqsave(&port->lock, flags); tty_insert_flip_string() { tty_insert_flip_string_fixed_flag() { __tty_buffer_request_room() { tty_buffer_alloc() { kmalloc(GFP_ATOMIC | __GFP_NOWARN) { __alloc_pages_slowpath() { zonelist_iter_begin() { read_seqbegin(&zonelist_update_seq); // spins forever because zonelist_update_seq.seqcount is odd spin_lock_irqsave(&port->lock, flags); // spins forever because port->lock is held } } } } } } } } spin_unlock_irqrestore(&port->lock, flags); // message is printed to console spin_unlock_irqrestore(&port->lock, flags); } } } } } } } } } write_sequnlock(&zonelist_update_seq); } } } This deadlock scenario can be eliminated by preventing interrupt context from calling kmalloc(GFP_ATOMIC) and preventing printk() from calling console_flush_all() while zonelist_update_seq.seqcount is odd. Since Petr Mladek thinks that __build_all_zonelists() can become a candidate for deferring printk() [2], let's address this problem by disabling local interrupts in order to avoid kmalloc(GFP_ATOMIC) and disabling synchronous printk() in order to avoid console_flush_all() . As a side effect of minimizing duration of zonelist_update_seq.seqcount being odd by disabling synchronous printk(), latency at read_seqbegin(&zonelist_update_seq) for both !__GFP_DIRECT_RECLAIM and __GFP_DIRECT_RECLAIM allocation requests will be reduced. Although, from lockdep perspective, not calling read_seqbegin(&zonelist_update_seq) (i.e. do not record unnecessary locking dependency) from interrupt context is still preferable, even if we don't allow calling kmalloc(GFP_ATOMIC) inside write_seqlock(&zonelist_update_seq)/write_sequnlock(&zonelist_update_seq) section... Link: https://lkml.kernel.org/r/8796b95c-3da3-5885-fddd-6ef55f30e4d3@I-love.SAKURA.ne.jp Fixes: 3d36424b3b58 ("mm/page_alloc: fix race condition between build_all_zonelists and page allocation") Link: https://lkml.kernel.org/r/ZCrs+1cDqPWTDFNM@alley [2] Reported-by: syzbot Link: https://syzkaller.appspot.com/bug?extid=223c7461c58c58a4cb10 [1] Signed-off-by: Tetsuo Handa Acked-by: Michal Hocko Acked-by: Mel Gorman Cc: Petr Mladek Cc: David Hildenbrand Cc: Ilpo Järvinen Cc: John Ogness Cc: Patrick Daly Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Signed-off-by: Andrew Morton commit 659c0ce1cb9efc7f58d380ca4bb2a51ae9e30553 Author: Ondrej Mosnacek Date: Fri Feb 17 17:21:54 2023 +0100 kernel/sys.c: fix and improve control flow in __sys_setres[ug]id() Linux Security Modules (LSMs) that implement the "capable" hook will usually emit an access denial message to the audit log whenever they "block" the current task from using the given capability based on their security policy. The occurrence of a denial is used as an indication that the given task has attempted an operation that requires the given access permission, so the callers of functions that perform LSM permission checks must take care to avoid calling them too early (before it is decided if the permission is actually needed to perform the requested operation). The __sys_setres[ug]id() functions violate this convention by first calling ns_capable_setid() and only then checking if the operation requires the capability or not. It means that any caller that has the capability granted by DAC (task's capability set) but not by MAC (LSMs) will generate a "denied" audit record, even if is doing an operation for which the capability is not required. Fix this by reordering the checks such that ns_capable_setid() is checked last and -EPERM is returned immediately if it returns false. While there, also do two small optimizations: * move the capability check before prepare_creds() and * bail out early in case of a no-op. Link: https://lkml.kernel.org/r/20230217162154.837549-1-omosnace@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek Cc: Eric W. Biederman Cc: Signed-off-by: Andrew Morton commit 0b5dfe12755f87ec014bb4cc1930485026167430 Author: Alex Hung Date: Mon Apr 3 17:45:41 2023 +0800 drm/amd/display: fix a divided-by-zero error [Why & How] timing.dsc_cfg.num_slices_v can be zero and it is necessary to check before using it. This fixes the error "divide error: 0000 [#1] PREEMPT SMP NOPTI". Reviewed-by: Aurabindo Pillai Acked-by: Qingqing Zhuo Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 1e994cc0956b8dabd1b1fef315bbd722733b8aa8 Author: Daniel Miess Date: Tue Apr 4 14:04:11 2023 -0400 drm/amd/display: limit timing for single dimm memory [Why] 1. It could hit bandwidth limitdation under single dimm memory when connecting 8K external monitor. 2. IsSupportedVidPn got validation failed with 2K240Hz eDP + 8K24Hz external monitor. 3. It's better to filter out such combination in EnumVidPnCofuncModality 4. For short term, filter out in dc bandwidth validation. [How] Force 2K@240Hz+8K@24Hz timing validation false in dc. Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 6d9240c46f7419aa3210353b5f52cc63da5a6440 Author: Dmytro Laktyushkin Date: Mon Apr 3 10:13:12 2023 -0400 drm/amd/display: set dcn315 lb bpp to 48 [Why & How] Fix a typo for dcn315 line buffer bpp. Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Dmytro Laktyushkin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c8b5a95b570949536a2b75cd8fc4f1de0bc60629 Author: Alan Liu Date: Fri Apr 14 18:39:52 2023 +0800 drm/amdgpu: Fix desktop freezed after gpu-reset [Why] After gpu-reset, sometimes the driver fails to enable vblank irq, causing flip_done timed out and the desktop freezed. During gpu-reset, we disable and enable vblank irq in dm_suspend() and dm_resume(). Later on in amdgpu_irq_gpu_reset_resume_helper(), we check irqs' refcount and decide to enable or disable the irqs again. However, we have 2 sets of API for controling vblank irq, one is dm_vblank_get/put() and another is amdgpu_irq_get/put(). Each API has its own refcount and flag to store the state of vblank irq, and they are not synchronized. In drm we use the first API to control vblank irq but in amdgpu_irq_gpu_reset_resume_helper() we use the second set of API. The failure happens when vblank irq was enabled by dm_vblank_get() before gpu-reset, we have vblank->enabled true. However, during gpu-reset, in amdgpu_irq_gpu_reset_resume_helper() vblank irq's state checked from amdgpu_irq_update() is DISABLED. So finally it disables vblank irq again. After gpu-reset, if there is a cursor plane commit, the driver will try to enable vblank irq by calling drm_vblank_enable(), but the vblank->enabled is still true, so it fails to turn on vblank irq and causes flip_done can't be completed in vblank irq handler and desktop become freezed. [How] Combining the 2 vblank control APIs by letting drm's API finally calls amdgpu_irq's API, so the irq's refcount and state of both APIs can be synchronized. Also add a check to prevent refcount from being less then 0 in amdgpu_irq_put(). v2: - Add warning in amdgpu_irq_enable() if the irq is already disabled. - Call dc_interrupt_set() in dm_set_vblank() to avoid refcount change if it is in gpu-reset. v3: - Improve commit message and code comments. Signed-off-by: Alan Liu Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8267fc71abb2dc47338570e56dd3473a58313fce Author: Lorenzo Bianconi Date: Mon Apr 17 23:53:22 2023 +0200 veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag For veth pairs, NETDEV_XDP_ACT_NDO_XMIT is supported by the current device if the peer one is running a XDP program or if it has GRO enabled. Fix the xdp_features flags reporting considering peer device and not current one for NETDEV_XDP_ACT_NDO_XMIT. Fixes: fccca038f300 ("veth: take into account device reconfiguration for xdp_features flag") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/4f1ca6f6f6b42ae125bfdb5c7782217c83968b2e.1681767806.git.lorenzo@kernel.org Signed-off-by: Alexei Starovoitov commit af67688dca57999fd848f051eeea1d375ba546b2 Merge: bbab25317cdd7 4b6d621c9d859 Author: Linus Torvalds Date: Tue Apr 18 10:11:49 2023 -0700 Merge tag 'mmc-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC host: - sdhci_am654: Fix support for UHS-I SDR12 and SDR25 speed modes MEMSTICK: - Fix memory leak if card device never gets registered" * tag 'mmc-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: memstick: fix memory leak if card device is never registered mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25 commit 35dcb3ac663a16510afc27ba2725d70c15e012a5 Author: Marc Zyngier Date: Tue Apr 18 13:57:37 2023 +0100 KVM: arm64: Make vcpu flag updates non-preemptible Per-vcpu flags are updated using a non-atomic RMW operation. Which means it is possible to get preempted between the read and write operations. Another interesting thing to note is that preemption also updates flags, as we have some flag manipulation in both the load and put operations. It is thus possible to lose information communicated by either load or put, as the preempted flag update will overwrite the flags when the thread is resumed. This is specially critical if either load or put has stored information which depends on the physical CPU the vcpu runs on. This results in really elusive bugs, and kudos must be given to Mostafa for the long hours of debugging, and finally spotting the problem. Fix it by disabling preemption during the RMW operation, which ensures that the state stays consistent. Also upgrade vcpu_get_flag path to use READ_ONCE() to make sure the field is always atomically accessed. Fixes: e87abb73e594 ("KVM: arm64: Add helpers to manipulate vcpu flags among a set") Reported-by: Mostafa Saleh Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230418125737.2327972-1-maz@kernel.org Signed-off-by: Oliver Upton commit bbab25317cdd73b5241145c3c2f188e6cb1e5659 Merge: 6a8f57ae2eb07 d75eecc3d170d Author: Linus Torvalds Date: Tue Apr 18 08:21:45 2023 -0700 Merge tag 'arm-fixes-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "There are a number of updates for devicetree files for Qualcomm, Rockchips, and NXP i.MX platforms, addressing mistakes in the DT contents: - Wrong GPIO polarity on some boards - Lower SD card interface speed for better stability - Incorrect power supply, clock, pmic, cache properties - Disable broken hbr3 on sc7280-herobrine - Devicetree warning fixes The only other changes are: - A regression fix for the Amlogic performance monitoring unit driver, along with two related DT changes. - imx_v6_v7_defconfig enables PCI support again. - Trivial fixes for tee, optee and psci firmware drivers, addressing compiler warning and error output" * tag 'arm-fixes-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (32 commits) firmware/psci: demote suspend-mode warning to info level arm64: dts: qcom: sc7280: remove hbr3 support on herobrine boards ARM: imx_v6_v7_defconfig: Fix unintentional disablement of PCI arm64: dts: rockchip: correct panel supplies on some rk3326 boards arm64: dts: rockchip: use just "port" in panel on RockPro64 arm64: dts: rockchip: use just "port" in panel on Pinebook Pro ARM: dts: imx6ull-colibri: Remove unnecessary #address-cells/#size-cells ARM: dts: imx7d-remarkable2: Remove unnecessary #address-cells/#size-cells arm64: dts: imx8mp-verdin: correct off-on-delay arm64: dts: imx8mm-verdin: correct off-on-delay arm64: dts: imx8mm-evk: correct pmic clock source arm64: dts: qcom: sc8280xp-pmics: fix pon compatible and registers arm64: dts: rockchip: Remove non-existing pwm-delay-us property arm64: dts: rockchip: Add clk_rtc_32k to Anbernic xx3 Devices tee: Pass a pointer to virt_to_page() perf/amlogic: adjust register offsets arm64: dts: meson-g12-common: resolve conflict between canvas & pmu arm64: dts: meson-g12-common: specify full DMC range arm64: dts: imx8mp: fix address length for LCDIF2 riscv: dts: canaan: drop invalid spi-max-frequency ... commit 93eb1215ed794a18ba8753e0654f069d58838966 Author: Huacai Chen Date: Tue Apr 18 19:38:58 2023 +0800 LoongArch: module: set section addresses to 0x0 These got*, plt* and .text.ftrace_trampoline sections specified for LoongArch have non-zero addressses. Non-zero section addresses in a relocatable ELF would confuse GDB when it tries to compute the section offsets and it ends up printing wrong symbol addresses. Therefore, set them to zero, which mirrors the change in commit 5d8591bc0fbaeb6ded ("arm64 module: set plt* section addresses to 0x0"). Cc: stable@vger.kernel.org Reviewed-by: Guo Ren Signed-off-by: Chong Qiao Signed-off-by: Huacai Chen commit dce5ea1d0f45fa612f5760b88614a3f32bc75e3f Author: Huacai Chen Date: Tue Apr 18 19:38:58 2023 +0800 LoongArch: Mark 3 symbol exports as non-GPL vm_map_base, empty_zero_page and invalid_pmd_table could be accessed widely by some out-of-tree non-GPL but important file systems or drivers (e.g. OpenZFS). Let's use EXPORT_SYMBOL() instead of EXPORT_SYMBOL_GPL() to export them, so as to avoid build errors. 1, Details about vm_map_base: This is a LoongArch-specific symbol and may be referenced through macros PCI_IOBASE, VMALLOC_START and VMALLOC_END. 2, Details about empty_zero_page: As it stands today, only 3 architectures export empty_zero_page as a GPL symbol: IA64, LoongArch and MIPS. LoongArch gets the GPL export by inheriting from MIPS, and the MIPS export was first introduced in commit 497d2adcbf50b ("[MIPS] Export empty_zero_page for sake of the ext4 module."). The IA64 export was similar: commit a7d57ecf4216e ("[IA64] Export three symbols for module use") did so for kvm. In both IA64 and MIPS, the export of empty_zero_page was done for satisfying some in-kernel component built as module (kvm and ext4 respectively), and given its reasonably low-level nature, GPL is a reasonable choice. But looking at the bigger picture it is evident most other architectures do not regard it as GPL, so in effect the symbol probably should not be treated as such, in favor of consistency. 3, Details about invalid_pmd_table: Keep consistency with invalid_pte_table and make it be possible by some modules. Cc: stable@vger.kernel.org Reviewed-by: WANG Xuerui Signed-off-by: Huacai Chen commit 1c1378a4090845e12c4dbbb337de7acce309b570 Author: Huacai Chen Date: Tue Apr 18 19:38:58 2023 +0800 LoongArch: Enable PG when wakeup from suspend Some firmwares don't enable PG when wakeup from suspend, so do it in kernel. This can improve code compatibility for boot kernel. Signed-off-by: Baoqi Zhang Signed-off-by: Huacai Chen commit 6637775ca3c3d0b4f7b83c5ce9a592df2c9bff52 Author: Qing Zhang Date: Tue Apr 18 19:38:58 2023 +0800 LoongArch: Fix _CONST64_(x) as unsigned Addresses should all be of unsigned type to avoid unnecessary conversions. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 1cf62488f5e465b1cd814d19be238a4b7ad5be38 Author: Huacai Chen Date: Tue Apr 18 19:38:58 2023 +0800 LoongArch: Fix build error if CONFIG_SUSPEND is not set We can see the following build error on LoongArch if CONFIG_SUSPEND is not set: ld: drivers/acpi/sleep.o: in function 'acpi_pm_prepare': sleep.c:(.text+0x2b8): undefined reference to 'loongarch_wakeup_start' Here is the call trace: acpi_pm_prepare() __acpi_pm_prepare() acpi_sleep_prepare() acpi_get_wakeup_address() loongarch_wakeup_start() Root cause: loongarch_wakeup_start() is defined in arch/loongarch/power/ suspend_asm.S which is only built under CONFIG_SUSPEND. In order to fix the build error, just let acpi_get_wakeup_address() return 0 if CONFIG_ SUSPEND is not set. Fixes: 366bb35a8e48 ("LoongArch: Add suspend (ACPI S3) support") Reviewed-by: WANG Xuerui Reported-by: Randy Dunlap Link: https://lore.kernel.org/all/11215033-fa3c-ecb1-2fc0-e9aeba47be9b@infradead.org/ Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit df830336045db1246d3245d3737fee9939c5f731 Author: Huacai Chen Date: Tue Apr 18 19:38:58 2023 +0800 LoongArch: Fix probing of the CRC32 feature Not all LoongArch processors support CRC32 instructions. This feature is indicated by CPUCFG1.CRC32 (Bit25) but it is wrongly defined in the previous versions of the ISA manual (and so does in loongarch.h). The CRC32 feature is set unconditionally now, so fix it. BTW, expose the CRC32 feature in /proc/cpuinfo. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit 16c52e503043aed1e2a2ce38d9249de5936c1f6b Author: Huacai Chen Date: Tue Apr 18 19:38:58 2023 +0800 LoongArch: Make WriteCombine configurable for ioremap() LoongArch maintains cache coherency in hardware, but when paired with LS7A chipsets the WUC attribute (Weak-ordered UnCached, which is similar to WriteCombine) is out of the scope of cache coherency machanism for PCIe devices (this is a PCIe protocol violation, which may be fixed in newer chipsets). This means WUC can only used for write-only memory regions now, so this option is disabled by default, making WUC silently fallback to SUC for ioremap(). You can enable this option if the kernel is ensured to run on hardware without this bug. Kernel parameter writecombine=on/off can be used to override the Kconfig option. Cc: stable@vger.kernel.org Suggested-by: WANG Xuerui Reviewed-by: WANG Xuerui Signed-off-by: Huacai Chen commit c0e73276f0fcbbd3d4736ba975d7dc7a48791b0c Author: Nikita Zhandarovich Date: Mon Apr 17 05:07:18 2023 -0700 mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() Function mlxfw_mfa2_tlv_multi_get() returns NULL if 'tlv' in question does not pass checks in mlxfw_mfa2_tlv_payload_get(). This behaviour may lead to NULL pointer dereference in 'multi->total_len'. Fix this issue by testing mlxfw_mfa2_tlv_multi_get()'s return value against NULL. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process") Co-developed-by: Natalia Petrova Signed-off-by: Nikita Zhandarovich Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/20230417120718.52325-1-n.zhandarovich@fintech.ru Signed-off-by: Paolo Abeni commit 28e63d01a9f46d47b73045817f95c114a7769c71 Merge: e50b9b9e8610d 4f4e54b1041e6 Author: Paolo Abeni Date: Tue Apr 18 12:27:17 2023 +0200 Merge branch 'bnxt_en-bug-fixes' Michael Chan says: ==================== bnxt_en: Bug fixes This small series contains 2 fixes. The first one fixes the PTP initialization logic on older chips to avoid logging a warning. The second one fixes a potenial NULL pointer dereference in the driver's aux bus unload path. ==================== Link: https://lore.kernel.org/r/20230417065819.122055-1-michael.chan@broadcom.com Signed-off-by: Paolo Abeni commit 4f4e54b1041e60694117893cd986831153a3e719 Author: Kalesh AP Date: Sun Apr 16 23:58:19 2023 -0700 bnxt_en: Fix a possible NULL pointer dereference in unload path In the driver unload path, the driver currently checks the valid BNXT_FLAG_ROCE_CAP flag in bnxt_rdma_aux_device_uninit() before proceeding. This is flawed because the flag may not be set initially during driver load. It may be set later after the NVRAM setting is changed followed by a firmware reset. Relying on the BNXT_FLAG_ROCE_CAP flag may crash in bnxt_rdma_aux_device_uninit() if the aux device was never initialized: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 8ae6aa067 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 39 PID: 42558 Comm: rmmod Kdump: loaded Tainted: G OE --------- - - 4.18.0-348.el8.x86_64 #1 Hardware name: Dell Inc. PowerEdge R750/0WT8Y6, BIOS 1.5.4 12/17/2021 RIP: 0010:device_del+0x1b/0x410 Code: 89 a5 50 03 00 00 4c 89 a5 58 03 00 00 eb 89 0f 1f 44 00 00 41 56 41 55 41 54 4c 8d a7 80 00 00 00 55 53 48 89 fb 48 83 ec 18 <48> 8b 2f 4c 89 e7 65 48 8b 04 25 28 00 00 00 48 89 44 24 10 31 c0 RSP: 0018:ff7f82bf469a7dc8 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000206 RDI: 0000000000000000 RBP: ff31b7cd114b0ac0 R08: 0000000000000000 R09: ffffffff935c3400 R10: ff31b7cd45bc3440 R11: 0000000000000001 R12: 0000000000000080 R13: ffffffffc1069f40 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fc9903ce740(0000) GS:ff31b7d4ffac0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000992fee004 CR4: 0000000000773ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: bnxt_rdma_aux_device_uninit+0x1f/0x30 [bnxt_en] bnxt_remove_one+0x2f/0x1f0 [bnxt_en] pci_device_remove+0x3b/0xc0 device_release_driver_internal+0x103/0x1f0 driver_detach+0x54/0x88 bus_remove_driver+0x77/0xc9 pci_unregister_driver+0x2d/0xb0 bnxt_exit+0x16/0x2c [bnxt_en] __x64_sys_delete_module+0x139/0x280 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7fc98f3af71b Fix this by modifying the check inside bnxt_rdma_aux_device_uninit() to check for bp->aux_priv instead. We also need to make some changes in bnxt_rdma_aux_device_init() to make sure that bp->aux_priv is set only when the aux device is fully initialized. Fixes: d80d88b0dfff ("bnxt_en: Add auxiliary driver support") Reviewed-by: Ajit Khaparde Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit e8b51a1a15d5a3cce231e0669f6a161dc5bb9b75 Author: Michael Chan Date: Sun Apr 16 23:58:18 2023 -0700 bnxt_en: Do not initialize PTP on older P3/P4 chips The driver does not support PTP on these older chips and it is assuming that firmware on these older chips will not return the PORT_MAC_PTP_QCFG_RESP_FLAGS_HWRM_ACCESS flag in __bnxt_hwrm_ptp_qcfg(), causing the function to abort quietly. But newer firmware now sets this flag and so __bnxt_hwrm_ptp_qcfg() will proceed further. Eventually it will fail in bnxt_ptp_init() -> bnxt_map_ptp_regs() because there is no code to support the older chips. The driver will then complain: "PTP initialization failed.\n" Fix it so that we abort quietly earlier without going through the unnecessary steps and alarming the user with the warning log. Fixes: ae5c42f0b92c ("bnxt_en: Get PTP hardware capability from firmware") Signed-off-by: Michael Chan Signed-off-by: Paolo Abeni commit c22ef5684b64a3a1ac08db06a6f327f2695fd377 Author: Willy Tarreau Date: Tue Apr 18 08:42:28 2023 +0200 x86/alternatives: Do not use integer constant suffixes in inline asm The usage of the BIT() macro in inline asm code was introduced in 6.3 by the commit in the Fixes tag. However, this macro uses "1UL" for integer constant suffixes in its shift operation, while gas before 2.28 does not support the "L" suffix after a number, and gas before 2.27 does not support the "U" suffix, resulting in build errors such as the following with such versions: ./arch/x86/include/asm/uaccess_64.h:124: Error: found 'L', expected: ')' ./arch/x86/include/asm/uaccess_64.h:124: Error: junk at end of line, first unrecognized character is `L' However, the currently minimal binutils version the kernel supports is 2.25. There's a single use of this macro here, revert to (1 << 0) that works with such older binutils. As an additional info, the binutils PRs which add support for those suffixes are: https://sourceware.org/bugzilla/show_bug.cgi?id=19910 https://sourceware.org/bugzilla/show_bug.cgi?id=20732 [ bp: Massage and extend commit message. ] Fixes: 5d1dd961e743 ("x86/alternatives: Add alt_instr.flags") Signed-off-by: Willy Tarreau Signed-off-by: Borislav Petkov (AMD) Tested-by: Jingbo Xu Link: https://lore.kernel.org/lkml/a9aae568-3046-306c-bd71-92c1fc8eeddc@linux.alibaba.com/ commit d4eb7e39929a3b1ff30fb751b4859fc2410702a0 Author: Pablo Neira Ayuso Date: Mon Apr 17 17:50:28 2023 +0200 netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements If NFT_SET_ELEM_CATCHALL is set on, then userspace provides no set element key. Otherwise, bail out with -EINVAL. Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support") Signed-off-by: Pablo Neira Ayuso commit e50b9b9e8610d47b7c22529443e45a16b1ea3a15 Author: Duoming Zhou Date: Sat Apr 15 16:12:27 2023 +0800 cxgb4: fix use after free bugs caused by circular dependency problem The flower_stats_timer can schedule flower_stats_work and flower_stats_work can also arm the flower_stats_timer. The process is shown below: ----------- timer schedules work ------------ ch_flower_stats_cb() //timer handler schedule_work(&adap->flower_stats_work); ----------- work arms timer ------------ ch_flower_stats_handler() //workqueue callback function mod_timer(&adap->flower_stats_timer, ...); When the cxgb4 device is detaching, the timer and workqueue could still be rearmed. The process is shown below: (cleanup routine) | (timer and workqueue routine) remove_one() | free_some_resources() | ch_flower_stats_cb() //timer cxgb4_cleanup_tc_flower() | schedule_work() del_timer_sync() | | ch_flower_stats_handler() //workqueue | mod_timer() cancel_work_sync() | kfree(adapter) //FREE | ch_flower_stats_cb() //timer | adap->flower_stats_work //USE This patch changes del_timer_sync() to timer_shutdown_sync(), which could prevent rearming of the timer from the workqueue. Fixes: e0f911c81e93 ("cxgb4: fetch stats for offloaded tc flower flows") Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20230415081227.7463-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni commit d46fc894147cf98dd6e8210aa99ed46854191840 Author: Pablo Neira Ayuso Date: Mon Apr 17 12:14:29 2023 +0200 netfilter: nf_tables: validate catch-all set elements catch-all set element might jump/goto to chain that uses expressions that require validation. Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support") Signed-off-by: Pablo Neira Ayuso commit 1a2bd3bd72e978304cdc0a7385e8048e8242225d Author: Jacob Keller Date: Fri Apr 14 09:26:14 2023 -0700 ice: document RDMA devlink parameters Commit e523af4ee560 ("net/ice: Add support for enable_iwarp and enable_roce devlink param") added support for the enable_roce and enable_iwarp parameters in the ice driver. It didn't document these parameters in the ice devlink documentation file. Add this documentation, including a note about the mutual exclusion between the two modes. Signed-off-by: Jacob Keller Reviewed-by: Leon Romanovsky Acked-by: Tony Nguyen Link: https://lore.kernel.org/r/20230414162614.571861-1-jacob.e.keller@intel.com Signed-off-by: Jakub Kicinski commit b63a553e8f5aa6574eeb535a551817a93c426d8c Author: Sascha Hauer Date: Mon Apr 17 14:37:47 2023 +0200 drm/rockchip: vop2: Use regcache_sync() to fix suspend/resume afa965a45e01 ("drm/rockchip: vop2: fix suspend/resume") uses regmap_reinit_cache() to fix the suspend/resume issue with the VOP2 driver. During discussion it came up that we should rather use regcache_sync() instead. As the original patch is already applied fix this up in this follow-up patch. Fixes: afa965a45e01 ("drm/rockchip: vop2: fix suspend/resume") Cc: stable@vger.kernel.org Signed-off-by: Sascha Hauer Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20230417123747.2179695-1-s.hauer@pengutronix.de commit c86c00c6935505929cc9adb29ddb85e48c71f828 Author: Aleksandr Loktionov Date: Mon Apr 3 07:13:18 2023 +0200 i40e: fix i40e_setup_misc_vector() error handling Add error handling of i40e_setup_misc_vector() in i40e_rebuild(). In case interrupt vectors setup fails do not re-open vsi-s and do not bring up vf-s, we have no interrupts to serve a traffic anyway. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Aleksandr Loktionov Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 8485d093b076e59baff424552e8aecfc5bd2d261 Author: Aleksandr Loktionov Date: Fri Mar 24 18:16:38 2023 +0100 i40e: fix accessing vsi->active_filters without holding lock Fix accessing vsi->active_filters without holding the mac_filter_hash_lock. Move vsi->active_filters = 0 inside critical section and move clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state) after the critical section to ensure the new filters from other threads can be added only after filters cleaning in the critical section is finished. Fixes: 278e7d0b9d68 ("i40e: store MAC/VLAN filters in a hash with the MAC Address as key") Signed-off-by: Aleksandr Loktionov Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit d51425190805d47aecc1910b272e65476dd3b937 Author: Chuck Lever Date: Sun Apr 16 13:05:06 2023 -0400 SUNRPC: Fix failures of checksum Kunit tests Scott reports that when the new GSS krb5 Kunit tests are built as a separate module and loaded, the RFC 6803 and RFC 8009 checksum tests all fail, even though they pass when run under kunit.py. It appears that passing a buffer backed by static const memory to gss_krb5_checksum() is a problem. A printk in checksum_case() shows the correct plaintext, but by the time the buffer has been converted to a scatterlist and arrives at checksummer(), it contains all zeroes. Replacing this buffer with one that is dynamically allocated fixes the issue. Reported-by: Scott Mayhew Fixes: 02142b2ca8fc ("SUNRPC: Add checksum KUnit tests for the RFC 6803 encryption types") Tested-by: Scott Mayhew Signed-off-by: Chuck Lever commit 7363d6bedc000f6f9d09cfe498da2f3aca653778 Author: John Ogness Date: Sat Apr 15 04:08:50 2023 +0206 drm/nouveau: fix incorrect conversion to dma_resv_wait_timeout() Commit 41d351f29528 ("drm/nouveau: stop using ttm_bo_wait") converted from ttm_bo_wait_ctx() to dma_resv_wait_timeout(). However, dma_resv_wait_timeout() returns greater than zero on success as opposed to ttm_bo_wait_ctx(). As a result, relocs will fail and log errors even when it was a success. Change the return code handling to match that of nouveau_gem_ioctl_cpu_prep(), which was already using dma_resv_wait_timeout() correctly. Fixes: 41d351f29528 ("drm/nouveau: stop using ttm_bo_wait") Reported-by: Tanmay Bhushan <007047221b@gmail.com> Link: https://lore.kernel.org/lkml/20230119225351.71657-1-007047221b@gmail.com Signed-off-by: John Ogness Reviewed-by: Christian König Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/87edolaomt.fsf@jogness.linutronix.de commit c55c0e91c813589dc55bea6bf9a9fbfaa10ae41d Author: Florian Westphal Date: Mon Apr 17 10:21:36 2023 +0200 netfilter: nf_tables: fix ifdef to also consider nf_tables=m nftables can be built as a module, so fix the preprocessor conditional accordingly. Fixes: 478b360a47b7 ("netfilter: nf_tables: fix nf_trace always-on with XT_TRACE=n") Reported-by: Florian Fainelli Reported-by: Jakub Kicinski Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit afa965a45e01e541cdbe5c8018226eff117610f0 Author: Sascha Hauer Date: Thu Apr 13 16:43:47 2023 +0200 drm/rockchip: vop2: fix suspend/resume During a suspend/resume cycle the VO power domain will be disabled and the VOP2 registers will reset to their default values. After that the cached register values will be out of sync and the read/modify/write operations we do on the window registers will result in bogus values written. Fix this by re-initializing the register cache each time we enable the VOP2. With this the VOP2 will show a picture after a suspend/resume cycle whereas without this the screen stays dark. Fixes: 604be85547ce4 ("drm/rockchip: Add VOP2 driver") Cc: stable@vger.kernel.org Signed-off-by: Sascha Hauer Tested-by: Chris Morgan Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20230413144347.3506023-1-s.hauer@pengutronix.de commit 338469d677e5d426f5ada88761f16f6d2c7c1981 Author: Pedro Tammela Date: Sat Apr 15 12:33:09 2023 -0300 net/sched: clear actions pointer in miss cookie init fail Palash reports a UAF when using a modified version of syzkaller[1]. When 'tcf_exts_miss_cookie_base_alloc()' fails in 'tcf_exts_init_ex()' a call to 'tcf_exts_destroy()' is made to free up the tcf_exts resources. In flower, a call to '__fl_put()' when 'tcf_exts_init_ex()' fails is made; Then calling 'tcf_exts_destroy()', which triggers an UAF since the already freed tcf_exts action pointer is lingering in the struct. Before the offending patch, this was not an issue since there was no case where the tcf_exts action pointer could linger. Therefore, restore the old semantic by clearing the action pointer in case of a failure to initialize the miss_cookie. [1] https://github.com/cmu-pasta/linux-kernel-enriched-corpus v1->v2: Fix compilation on configs without tc actions (kernel test robot) Fixes: 80cd22c35c90 ("net/sched: cls_api: Support hardware miss to tc action") Reported-by: Palash Oswal Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: David S. Miller commit e1c71f8f918047ce822dc19b42ab1261ed259fd1 Author: Ville Syrjälä Date: Wed Mar 29 20:24:33 2023 +0300 drm/i915: Fix fast wake AUX sync len Fast wake should use 8 SYNC pulses for the preamble and 10-16 SYNC pulses for the precharge. Reduce our fast wake SYNC count to match the maximum value. We also use the maximum precharge length for normal AUX transactions. Cc: stable@vger.kernel.org Cc: Jouni Högander Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230329172434.18744-1-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander (cherry picked from commit 605f7c73133341d4b762cbd9a22174cc22d4c38b) Signed-off-by: Jani Nikula commit a80bb8e7233b2ad6ff119646b6e33fb3edcec37b Author: Ding Hui Date: Fri Apr 14 23:23:06 2023 +0800 sfc: Fix use-after-free due to selftest_work There is a use-after-free scenario that is: When the NIC is down, user set mac address or vlan tag to VF, the xxx_set_vf_mac() or xxx_set_vf_vlan() will invoke efx_net_stop() and efx_net_open(), since netif_running() is false, the port will not start and keep port_enabled false, but selftest_work is scheduled in efx_net_open(). If we remove the device before selftest_work run, the efx_stop_port() will not be called since the NIC is down, and then efx is freed, we will soon get a UAF in run_timer_softirq() like this: [ 1178.907941] ================================================================== [ 1178.907948] BUG: KASAN: use-after-free in run_timer_softirq+0xdea/0xe90 [ 1178.907950] Write of size 8 at addr ff11001f449cdc80 by task swapper/47/0 [ 1178.907950] [ 1178.907953] CPU: 47 PID: 0 Comm: swapper/47 Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [ 1178.907954] Hardware name: SANGFOR X620G40/WI2HG-208T1061A, BIOS SPYH051032-U01 04/01/2022 [ 1178.907955] Call Trace: [ 1178.907956] [ 1178.907960] dump_stack+0x71/0xab [ 1178.907963] print_address_description+0x6b/0x290 [ 1178.907965] ? run_timer_softirq+0xdea/0xe90 [ 1178.907967] kasan_report+0x14a/0x2b0 [ 1178.907968] run_timer_softirq+0xdea/0xe90 [ 1178.907971] ? init_timer_key+0x170/0x170 [ 1178.907973] ? hrtimer_cancel+0x20/0x20 [ 1178.907976] ? sched_clock+0x5/0x10 [ 1178.907978] ? sched_clock_cpu+0x18/0x170 [ 1178.907981] __do_softirq+0x1c8/0x5fa [ 1178.907985] irq_exit+0x213/0x240 [ 1178.907987] smp_apic_timer_interrupt+0xd0/0x330 [ 1178.907989] apic_timer_interrupt+0xf/0x20 [ 1178.907990] [ 1178.907991] RIP: 0010:mwait_idle+0xae/0x370 If the NIC is not actually brought up, there is no need to schedule selftest_work, so let's move invoking efx_selftest_async_start() into efx_start_all(), and it will be canceled by broughting down. Fixes: dd40781e3a4e ("sfc: Run event/IRQ self-test asynchronously when interface is brought up") Fixes: e340be923012 ("sfc: add ndo_set_vf_mac() function for EF10") Debugged-by: Huang Cun Cc: Donglin Peng Suggested-by: Martin Habets Signed-off-by: Ding Hui Signed-off-by: David S. Miller commit 853618d5886bf94812f31228091cd37d308230f7 Author: Xuan Zhuo Date: Fri Apr 14 14:08:35 2023 +0800 virtio_net: bugfix overflow inside xdp_linearize_page() Here we copy the data from the original buf to the new page. But we not check that it may be overflow. As long as the size received(including vnethdr) is greater than 3840 (PAGE_SIZE -VIRTIO_XDP_HEADROOM). Then the memcpy will overflow. And this is completely possible, as long as the MTU is large, such as 4096. In our test environment, this will cause crash. Since crash is caused by the written memory, it is meaningless, so I do not include it. Fixes: 72979a6c3590 ("virtio_net: xdp, add slowpath case for non contiguous buffers") Signed-off-by: Xuan Zhuo Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit d5a863a153e90996ab2aef6b9e08d509f4d5662b Author: Paulo Alcantara Date: Sun Apr 16 15:38:28 2023 -0300 cifs: avoid dup prefix path in dfs_get_automount_devname() @server->origin_fullpath already contains the tree name + optional prefix, so avoid calling __build_path_from_dentry_optional_prefix() as it might end up duplicating prefix path from @cifs_sb->prepath into final full path. Instead, generate DFS full path by simply merging @server->origin_fullpath with dentry's path. This fixes the following case mount.cifs //root/dfs/dir /mnt/ -o ... ls /mnt/link where cifs_dfs_do_automount() will call smb3_parse_devname() with @devname set to "//root/dfs/dir/link" instead of "//root/dfs/dir/dir/link". Fixes: 7ad54b98fc1f ("cifs: use origin fullpath for automounts") Cc: # 6.2+ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 6a8f57ae2eb07ab39a6f0ccad60c760743051026 Author: Linus Torvalds Date: Sun Apr 16 15:23:53 2023 -0700 Linux 6.3-rc7 commit 2ff559f31a5d50c31a3f9d849f8af90dc36c7105 Author: Peter Xu Date: Wed Apr 12 12:38:52 2023 -0400 Revert "userfaultfd: don't fail on unrecognized features" This is a proposal to revert commit 914eedcb9ba0ff53c33808. I found this when writing a simple UFFDIO_API test to be the first unit test in this set. Two things breaks with the commit: - UFFDIO_API check was lost and missing. According to man page, the kernel should reject ioctl(UFFDIO_API) if uffdio_api.api != 0xaa. This check is needed if the api version will be extended in the future, or user app won't be able to identify which is a new kernel. - Feature flags checks were removed, which means UFFDIO_API with a feature that does not exist will also succeed. According to the man page, we should (and it makes sense) to reject ioctl(UFFDIO_API) if unknown features passed in. Link: https://lore.kernel.org/r/20220722201513.1624158-1-axelrasmussen@google.com Link: https://lkml.kernel.org/r/20230412163922.327282-2-peterx@redhat.com Fixes: 914eedcb9ba0 ("userfaultfd: don't fail on unrecognized features") Signed-off-by: Peter Xu Acked-by: David Hildenbrand Cc: Axel Rasmussen Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Mike Kravetz Cc: Mike Rapoport (IBM) Cc: Zach O'Keefe Cc: Signed-off-by: Andrew Morton commit 1ba1199ec5747f475538c0d25a32804e5ba1dfde Author: Baokun Li Date: Mon Apr 10 21:08:26 2023 +0800 writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs KASAN report null-ptr-deref: ================================================================== BUG: KASAN: null-ptr-deref in bdi_split_work_to_wbs+0x5c5/0x7b0 Write of size 8 at addr 0000000000000000 by task sync/943 CPU: 5 PID: 943 Comm: sync Tainted: 6.3.0-rc5-next-20230406-dirty #461 Call Trace: dump_stack_lvl+0x7f/0xc0 print_report+0x2ba/0x340 kasan_report+0xc4/0x120 kasan_check_range+0x1b7/0x2e0 __kasan_check_write+0x24/0x40 bdi_split_work_to_wbs+0x5c5/0x7b0 sync_inodes_sb+0x195/0x630 sync_inodes_one_sb+0x3a/0x50 iterate_supers+0x106/0x1b0 ksys_sync+0x98/0x160 [...] ================================================================== The race that causes the above issue is as follows: cpu1 cpu2 -------------------------|------------------------- inode_switch_wbs INIT_WORK(&isw->work, inode_switch_wbs_work_fn) queue_rcu_work(isw_wq, &isw->work) // queue_work async inode_switch_wbs_work_fn wb_put_many(old_wb, nr_switched) percpu_ref_put_many ref->data->release(ref) cgwb_release queue_work(cgwb_release_wq, &wb->release_work) // queue_work async &wb->release_work cgwb_release_workfn ksys_sync iterate_supers sync_inodes_one_sb sync_inodes_sb bdi_split_work_to_wbs kmalloc(sizeof(*work), GFP_ATOMIC) // alloc memory failed percpu_ref_exit ref->data = NULL kfree(data) wb_get(wb) percpu_ref_get(&wb->refcnt) percpu_ref_get_many(ref, 1) atomic_long_add(nr, &ref->data->count) atomic64_add(i, v) // trigger null-ptr-deref bdi_split_work_to_wbs() traverses &bdi->wb_list to split work into all wbs. If the allocation of new work fails, the on-stack fallback will be used and the reference count of the current wb is increased afterwards. If cgroup writeback membership switches occur before getting the reference count and the current wb is released as old_wd, then calling wb_get() or wb_put() will trigger the null pointer dereference above. This issue was introduced in v4.3-rc7 (see fix tag1). Both sync_inodes_sb() and __writeback_inodes_sb_nr() calls to bdi_split_work_to_wbs() can trigger this issue. For scenarios called via sync_inodes_sb(), originally commit 7fc5854f8c6e ("writeback: synchronize sync(2) against cgroup writeback membership switches") reduced the possibility of the issue by adding wb_switch_rwsem, but in v5.14-rc1 (see fix tag2) removed the "inode_io_list_del_locked(inode, old_wb)" from inode_switch_wbs_work_fn() so that wb->state contains WB_has_dirty_io, thus old_wb is not skipped when traversing wbs in bdi_split_work_to_wbs(), and the issue becomes easily reproducible again. To solve this problem, percpu_ref_exit() is called under RCU protection to avoid race between cgwb_release_workfn() and bdi_split_work_to_wbs(). Moreover, replace wb_get() with wb_tryget() in bdi_split_work_to_wbs(), and skip the current wb if wb_tryget() fails because the wb has already been shutdown. Link: https://lkml.kernel.org/r/20230410130826.1492525-1-libaokun1@huawei.com Fixes: b817525a4a80 ("writeback: bdi_writeback iteration must not skip dying ones") Signed-off-by: Baokun Li Reviewed-by: Jan Kara Acked-by: Tejun Heo Cc: Alexander Viro Cc: Andreas Dilger Cc: Christian Brauner Cc: Dennis Zhou Cc: Hou Tao Cc: yangerkun Cc: Zhang Yi Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton commit 1f5f12ece722aacea1769fb644f27790ede339dc Author: Peng Zhang Date: Tue Apr 11 12:10:04 2023 +0800 maple_tree: fix a potential memory leak, OOB access, or other unpredictable bug In mas_alloc_nodes(), "node->node_count = 0" means to initialize the node_count field of the new node, but the node may not be a new node. It may be a node that existed before and node_count has a value, setting it to 0 will cause a memory leak. At this time, mas->alloc->total will be greater than the actual number of nodes in the linked list, which may cause many other errors. For example, out-of-bounds access in mas_pop_node(), and mas_pop_node() may return addresses that should not be used. Fix it by initializing node_count only for new nodes. Also, by the way, an if-else statement was removed to simplify the code. Link: https://lkml.kernel.org/r/20230411041005.26205-1-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Reviewed-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit 9235756885e865070c4be2facda75262dbd85967 Author: Steve Chou Date: Tue Apr 11 11:49:28 2023 +0800 tools/mm/page_owner_sort.c: fix TGID output when cull=tg is used When using cull option with 'tg' flag, the fprintf is using pid instead of tgid. It should use tgid instead. Link: https://lkml.kernel.org/r/20230411034929.2071501-1-steve_chou@pesi.com.tw Fixes: 9c8a0a8e599f4a ("tools/vm/page_owner_sort.c: support for user-defined culling rules") Signed-off-by: Steve Chou Cc: Jiajian Ye Cc: Signed-off-by: Andrew Morton commit d2c115baae6f793b5b01cff67799da17ffb1eda5 Author: Jonathan Toppins Date: Mon Apr 10 17:39:35 2023 -0400 mailmap: update jtoppins' entry to reference correct email Link: https://lkml.kernel.org/r/d79bc6eaf65e68bd1c2a1e1510ab6291ce5926a6.1681162487.git.jtoppins@redhat.com Signed-off-by: Jonathan Toppins Cc: Colin Ian King Cc: Jakub Kicinski Cc: Kirill Tkhai Cc: Konrad Dybcio Cc: Qais Yousef Cc: Stephen Hemminger Signed-off-by: Andrew Morton commit f4e9e0e69468583c2c6d9d5c7bfc975e292bf188 Author: Liam R. Howlett Date: Mon Apr 10 11:22:05 2023 -0400 mm/mempolicy: fix use-after-free of VMA iterator set_mempolicy_home_node() iterates over a list of VMAs and calls mbind_range() on each VMA, which also iterates over the singular list of the VMA passed in and potentially splits the VMA. Since the VMA iterator is not passed through, set_mempolicy_home_node() may now point to a stale node in the VMA tree. This can result in a UAF as reported by syzbot. Avoid the stale maple tree node by passing the VMA iterator through to the underlying call to split_vma(). mbind_range() is also overly complicated, since there are two calling functions and one already handles iterating over the VMAs. Simplify mbind_range() to only handle merging and splitting of the VMAs. Align the new loop in do_mbind() and existing loop in set_mempolicy_home_node() to use the reduced mbind_range() function. This allows for a single location of the range calculation and avoids constantly looking up the previous VMA (since this is a loop over the VMAs). Link: https://lore.kernel.org/linux-mm/000000000000c93feb05f87e24ad@google.com/ Fixes: 66850be55e8e ("mm/mempolicy: use vma iterator & maple state instead of vma linked list") Signed-off-by: Liam R. Howlett Reported-by: syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/20230410152205.2294819-1-Liam.Howlett@oracle.com Tested-by: syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com Cc: Signed-off-by: Andrew Morton commit 4737edbbdd4958ae29ca6a310a6a2fa4e0684b01 Author: Naoya Horiguchi Date: Thu Apr 6 17:20:04 2023 +0900 mm/huge_memory.c: warn with pr_warn_ratelimited instead of VM_WARN_ON_ONCE_FOLIO split_huge_page_to_list() WARNs when called for huge zero pages, which sounds to me too harsh because it does not imply a kernel bug, but just notifies the event to admins. On the other hand, this is considered as critical by syzkaller and makes its testing less efficient, which seems to me harmful. So replace the VM_WARN_ON_ONCE_FOLIO with pr_warn_ratelimited. Link: https://lkml.kernel.org/r/20230406082004.2185420-1-naoya.horiguchi@linux.dev Fixes: 478d134e9506 ("mm/huge_memory: do not overkill when splitting huge_zero_page") Signed-off-by: Naoya Horiguchi Reported-by: syzbot+07a218429c8d19b1fb25@syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/000000000000a6f34a05e6efcd01@google.com/ Reviewed-by: Yang Shi Cc: Miaohe Lin Cc: Tetsuo Handa Cc: Xu Yu Cc: Signed-off-by: Andrew Morton commit 82f951340f25bba262766f82caec54e7fd6a73c7 Author: Liam R. Howlett Date: Thu Apr 6 15:30:50 2023 -0400 mm/mprotect: fix do_mprotect_pkey() return on error When the loop over the VMA is terminated early due to an error, the return code could be overwritten with ENOMEM. Fix the return code by only setting the error on early loop termination when the error is not set. User-visible effects include: attempts to run mprotect() against a special mapping or with a poorly-aligned hugetlb address should return -EINVAL, but they presently return -ENOMEM. In other cases an -EACCESS should be returned. Link: https://lkml.kernel.org/r/20230406193050.1363476-1-Liam.Howlett@oracle.com Fixes: 2286a6914c77 ("mm: change mprotect_fixup to vma iterator") Signed-off-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit dd47ac428c3f5f3bcabe845f36be870fe6c20784 Author: Peter Xu Date: Wed Apr 5 11:51:20 2023 -0400 mm/khugepaged: check again on anon uffd-wp during isolation Khugepaged collapse an anonymous thp in two rounds of scans. The 2nd round done in __collapse_huge_page_isolate() after hpage_collapse_scan_pmd(), during which all the locks will be released temporarily. It means the pgtable can change during this phase before 2nd round starts. It's logically possible some ptes got wr-protected during this phase, and we can errornously collapse a thp without noticing some ptes are wr-protected by userfault. e1e267c7928f wanted to avoid it but it only did that for the 1st phase, not the 2nd phase. Since __collapse_huge_page_isolate() happens after a round of small page swapins, we don't need to worry on any !present ptes - if it existed khugepaged will already bail out. So we only need to check present ptes with uffd-wp bit set there. This is something I found only but never had a reproducer, I thought it was one caused a bug in Muhammad's recent pagemap new ioctl work, but it turns out it's not the cause of that but an userspace bug. However this seems to still be a real bug even with a very small race window, still worth to have it fixed and copy stable. Link: https://lkml.kernel.org/r/20230405155120.3608140-1-peterx@redhat.com Fixes: e1e267c7928f ("khugepaged: skip collapse if uffd-wp detected") Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Reviewed-by: Yang Shi Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Mike Rapoport Cc: Nadav Amit Cc: Signed-off-by: Andrew Morton commit 24bf08c4376be417f16ceb609188b16f461b0443 Author: David Hildenbrand Date: Wed Apr 5 18:02:35 2023 +0200 mm/userfaultfd: fix uffd-wp handling for THP migration entries Looks like what we fixed for hugetlb in commit 44f86392bdd1 ("mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection()") similarly applies to THP. Setting/clearing uffd-wp on THP migration entries is not implemented properly. Further, while removing migration PMDs considers the uffd-wp bit, inserting migration PMDs does not consider the uffd-wp bit. We have to set/clear independently of the migration entry type in change_huge_pmd() and properly copy the uffd-wp bit in set_pmd_migration_entry(). Verified using a simple reproducer that triggers migration of a THP, that the set_pmd_migration_entry() no longer loses the uffd-wp bit. Link: https://lkml.kernel.org/r/20230405160236.587705-2-david@redhat.com Fixes: f45ec5ff16a7 ("userfaultfd: wp: support swap and page migration") Signed-off-by: David Hildenbrand Reviewed-by: Peter Xu Cc: Cc: Muhammad Usama Anjum Signed-off-by: Andrew Morton commit 998ad18b00ebc0ef5a85be97fc020e710afc88ce Author: Qi Zheng Date: Thu Apr 6 00:18:53 2023 +0800 mm: swap: fix performance regression on sparsetruncate-tiny The ->percpu_pvec_drained was originally introduced by commit d9ed0d08b6c6 ("mm: only drain per-cpu pagevecs once per pagevec usage") to drain per-cpu pagevecs only once per pagevec usage. But after converting the swap code to be more folio-based, the commit c2bc16817aa0 ("mm/swap: add folio_batch_move_lru()") breaks this logic, which would cause ->percpu_pvec_drained to be reset to false, that means per-cpu pagevecs will be drained multiple times per pagevec usage. In theory, there should be no functional changes when converting code to be more folio-based. We should call folio_batch_reinit() in folio_batch_move_lru() instead of folio_batch_init(). And to verify that we still need ->percpu_pvec_drained, I ran mmtests/sparsetruncate-tiny and got the following data: baseline with baseline/ patch/ Min Time 326.00 ( 0.00%) 328.00 ( -0.61%) 1st-qrtle Time 334.00 ( 0.00%) 336.00 ( -0.60%) 2nd-qrtle Time 338.00 ( 0.00%) 341.00 ( -0.89%) 3rd-qrtle Time 343.00 ( 0.00%) 347.00 ( -1.17%) Max-1 Time 326.00 ( 0.00%) 328.00 ( -0.61%) Max-5 Time 327.00 ( 0.00%) 330.00 ( -0.92%) Max-10 Time 328.00 ( 0.00%) 331.00 ( -0.91%) Max-90 Time 350.00 ( 0.00%) 357.00 ( -2.00%) Max-95 Time 395.00 ( 0.00%) 390.00 ( 1.27%) Max-99 Time 508.00 ( 0.00%) 434.00 ( 14.57%) Max Time 547.00 ( 0.00%) 476.00 ( 12.98%) Amean Time 344.61 ( 0.00%) 345.56 * -0.28%* Stddev Time 30.34 ( 0.00%) 19.51 ( 35.69%) CoeffVar Time 8.81 ( 0.00%) 5.65 ( 35.87%) BAmean-99 Time 342.38 ( 0.00%) 344.27 ( -0.55%) BAmean-95 Time 338.58 ( 0.00%) 341.87 ( -0.97%) BAmean-90 Time 336.89 ( 0.00%) 340.26 ( -1.00%) BAmean-75 Time 335.18 ( 0.00%) 338.40 ( -0.96%) BAmean-50 Time 332.54 ( 0.00%) 335.42 ( -0.87%) BAmean-25 Time 329.30 ( 0.00%) 332.00 ( -0.82%) From the above it can be seen that we get similar data to when ->percpu_pvec_drained was introduced, so we still need it. Let's call folio_batch_reinit() in folio_batch_move_lru() to restore the original logic. Link: https://lkml.kernel.org/r/20230405161854.6931-1-zhengqi.arch@bytedance.com Fixes: c2bc16817aa0 ("mm/swap: add folio_batch_move_lru()") Signed-off-by: Qi Zheng Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Mel Gorman Cc: Lorenzo Stoakes Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6c538e1adbfc696ac4747fb10d63e704344f763d Merge: e623175f6418f 91dcf1e8068e9 Author: Linus Torvalds Date: Sun Apr 16 10:33:43 2023 -0700 Merge tag 'sched_urgent_for_v6.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Do not pull tasks to the local scheduling group if its average load is higher than the average system load * tag 'sched_urgent_for_v6.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix imbalance overflow commit e623175f6418f5873b28ca91a88312843b2e0dab Merge: 4a1c388ce0521 775d3c514c5b2 Author: Linus Torvalds Date: Sun Apr 16 10:28:29 2023 -0700 Merge tag 'x86_urgent_for_v6.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: - Drop __init annotation from two rtc functions which get called after boot is done, in order to prevent a crash * tag 'x86_urgent_for_v6.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/rtc: Remove __init for runtime functions commit 4a1c388ce0521163f1556f7edbacb50ec2df15cf Merge: f0dd81db3eac4 b277fc793daf2 Author: Linus Torvalds Date: Sun Apr 16 09:55:18 2023 -0700 Merge tag 'powerpc-6.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - A fix for NUMA distance handling in the pseries SCM (pmem) driver. Thanks to Aneesh Kumar K.V. * tag 'powerpc-6.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/papr_scm: Update the NUMA distance table for the target node commit f0dd81db3eac4b9455be5ce40d36320989024593 Merge: 6586c4d48018e 3c65a2704cdd2 Author: Linus Torvalds Date: Sun Apr 16 09:46:32 2023 -0700 Merge tag 'kbuild-fixes-v6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Drop debug info from purgatory objects again - Document that kernel.org provides prebuilt LLVM toolchains - Give up handling untracked files for source package builds - Avoid creating corrupted cpio when KBUILD_BUILD_TIMESTAMP is given with a pre-epoch data. - Change panic_show_mem() to a macro to handle variable-length argument - Compress tarballs on-the-fly again * tag 'kbuild-fixes-v6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: do not create intermediate *.tar for tar packages kbuild: do not create intermediate *.tar for source tarballs kbuild: merge cmd_archive_linux and cmd_archive_perf init/initramfs: Fix argument forwarding to panic() in panic_show_mem() initramfs: Check negative timestamp to prevent broken cpio archive kbuild: give up untracked files for source package builds Documentation/llvm: Add a note about prebuilt kernel.org toolchains purgatory: fix disabling debug info commit 6586c4d48018eb62d3df8af8ebe5436510ed04b1 Merge: 3e7bb4f246171 e7067a446264a Author: Linus Torvalds Date: Sun Apr 16 09:39:55 2023 -0700 Merge tag '6.3-rc6-ksmbd-server-fix' of git://git.samba.org/ksmbd Pull ksmbd server fix from Steve French: "smb311 server preauth integrity negotiate context parsing fix (check for out of bounds access)" * tag '6.3-rc6-ksmbd-server-fix' of git://git.samba.org/ksmbd: ksmbd: avoid out of bounds access in decode_preauth_ctxt() commit e3c026be4d3ca046799fde55ccbae9d0f059fb93 Author: Thomas Gleixner Date: Mon Apr 10 21:14:45 2023 +0200 PCI/MSI: Remove over-zealous hardware size check in pci_msix_validate_entries() pci_msix_validate_entries() validates the entries array which is handed in by the caller for a MSI-X interrupt allocation. Aside of consistency failures it also detects a failure when the size of the MSI-X hardware table in the device is smaller than the size of the entries array. That's wrong for the case of range allocations where the caller provides the minimum and the maximum number of vectors to allocate, when the hardware size is greater or equal than the mininum, but smaller than the maximum. Remove the hardware size check completely from that function and just ensure that the entires array up to the maximum size is consistent. The limitation and range checking versus the hardware size happens independently of that afterwards anyway because the entries array is optional. Fixes: 4644d22eb673 ("PCI/MSI: Validate MSI-X contiguous restriction early") Reported-by: David Laight Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87v8i3sg62.ffs@tglx commit 3c65a2704cdd2a0cd0766352e587bae4a6268155 Author: Masahiro Yamada Date: Fri Apr 7 19:16:29 2023 +0900 kbuild: do not create intermediate *.tar for tar packages Commit 05e96e96a315 ("kbuild: use git-archive for source package creation") split the compression as a separate step to factor out the common build rules. With the previous commit, we got back to the situation where source tarballs are compressed on-the-fly. There is no reason to keep the separate compression rules. Generate the comressed tar packages directly. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit f8d94c4e403c89ec6b09ba69f65e4547ba99dd07 Author: Masahiro Yamada Date: Fri Apr 7 19:16:28 2023 +0900 kbuild: do not create intermediate *.tar for source tarballs Since commit 05e96e96a315 ("kbuild: use git-archive for source package creation"), a source tarball is created in two steps; create *.tar file then compress it. I split the compression as a separate rule because I just thought 'git archive' supported only gzip. For other compression algorithms, I could pipe the two commands: $ git archive HEAD | xz > linux.tar.xz I read git-archive(1) carefully, and I realized GIT had provided a more elegant way: $ git -c tar.tar.xz.command=xz archive -o linux.tar.xz HEAD This commit uses 'tar.tar.*.command' configuration to specify the compression backend so we can compress a source tarball on-the-fly. GIT commit 767cf4579f0e ("archive: implement configurable tar filters") is more than a decade old, so it should be available on almost all build environments. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit f6d8283549bc200e2babdd627239ece3547d634c Author: Masahiro Yamada Date: Fri Apr 7 19:16:27 2023 +0900 kbuild: merge cmd_archive_linux and cmd_archive_perf The two commands, cmd_archive_linux and cmd_archive_perf, are similar. Merge them to make it easier to add more changes to the git-archive command. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit 735faf92fb06d083ddcf6cfcf6665666dea5dcc1 Author: Benjamin Gray Date: Tue Mar 21 10:05:34 2023 +1100 init/initramfs: Fix argument forwarding to panic() in panic_show_mem() Forwarding variadic argument lists can't be done by passing a va_list to a function with signature foo(...) (as panic() has). It ends up interpreting the va_list itself as a single argument instead of iterating it. printf() happily accepts it of course, leading to corrupt output. Convert panic_show_mem() to a macro to allow forwarding the arguments. The function is trivial enough that it's easier than trying to introduce a vpanic() variant. Signed-off-by: Benjamin Gray Reviewed-by: Andrew Donnellan Signed-off-by: Masahiro Yamada commit 5efb685bb3af112038af78a2cdf28f0ffdad45f5 Author: Benjamin Gray Date: Mon Mar 20 15:08:38 2023 +1100 initramfs: Check negative timestamp to prevent broken cpio archive Similar to commit 4c9d410f32b3 ("initramfs: Check timestamp to prevent broken cpio archive"), except asserts that the timestamp is non-negative. This can happen when the KBUILD_BUILD_TIMESTAMP is a value before UNIX epoch, which may be set when making reproducible builds that don't want to look like they use a valid date. While support for dates before 1970 might not be supported, this is more about preventing undetected CPIO corruption. The printf's use a minimum length format specifier, and will happily make the field longer than 8 characters if they need to. Signed-off-by: Benjamin Gray Reviewed-by: Andrew Donnellan Tested-by: Andrew Donnellan Signed-off-by: Masahiro Yamada commit 3e7bb4f2461710b70887704af7f175383251088e Merge: bc88aa51a6181 5105a7ffce191 Author: Linus Torvalds Date: Sat Apr 15 18:37:51 2023 -0700 Merge tag '6.3-rc6-smb311-client-negcontext-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fix from Steve French: "Small client fix for better checking for smb311 negotiate context overflows, also marked for stable" * tag '6.3-rc6-smb311-client-negcontext-fix' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix negotiate context parsing commit bc88aa51a61819956bb23dc26fa72b5bc9a81af3 Merge: a7a55e27ad72f 1e020e1b96afd Author: Linus Torvalds Date: Sat Apr 15 16:55:09 2023 -0700 Merge tag 'ubifs-for-linus-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI fixes from Richard Weinberger: - Fix failure to attach when vid_hdr offset equals the (sub)page size - Fix for a deadlock in UBI's worker thread * tag 'ubifs-for-linus-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size ubi: Fix deadlock caused by recursively holding work_sem commit 5105a7ffce19160e7062aee67fb6b3b8a1b56d78 Author: David Disseldorp Date: Fri Apr 7 00:34:11 2023 +0200 cifs: fix negotiate context parsing smb311_decode_neg_context() doesn't properly check against SMB packet boundaries prior to accessing individual negotiate context entries. This is due to the length check omitting the eight byte smb2_neg_context header, as well as incorrect decrementing of len_of_ctxts. Fixes: 5100d8a3fe03 ("SMB311: Improve checking of negotiate security contexts") Reported-by: Volker Lendecke Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: David Disseldorp Signed-off-by: Steve French commit a7a55e27ad72fb0dc9281d6211cffeebef8dde65 Merge: 9772f14f557de f8160d3b35fc9 Author: Linus Torvalds Date: Sat Apr 15 11:06:49 2023 -0700 Merge tag 'i2c-for-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Just two driver fixes" * tag 'i2c-for-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: ocores: generate stop condition after timeout in polling mode i2c: mchp-pci1xxxx: Update Timing registers commit 9772f14f557de9d4056212c84a0a4f64b7b09f31 Merge: cdcc6696d22db c8e22b7a1694b Author: Linus Torvalds Date: Sat Apr 15 10:49:47 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "One small fix to SCSI Enclosure Services to fix a regression caused by another recent fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ses: Handle enclosure with just a primary component gracefully commit cdcc6696d22dbb8fa2982d523d17f6ad2777d0f2 Merge: 1c6492d646462 f7ca1ae32bd89 Author: Linus Torvalds Date: Sat Apr 15 10:39:18 2023 -0700 Merge tag 'block-6.3-2023-04-14' of git://git.kernel.dk/linux Pull block fix from Jens Axboe: "A single NVMe quirk entry addition" * tag 'block-6.3-2023-04-14' of git://git.kernel.dk/linux: nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD commit 1c6492d64646246834414964cfba9f826e7330b4 Merge: 7a934f4bd7d6f 860e1c7f8b0b4 Author: Linus Torvalds Date: Sat Apr 15 10:29:53 2023 -0700 Merge tag 'io_uring-6.3-2023-04-14' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a small tweak to when task_work needs redirection, marked for stable as well" * tag 'io_uring-6.3-2023-04-14' of git://git.kernel.dk/linux: io_uring: complete request via task work in case of DEFER_TASKRUN commit 7a934f4bd7d6f9da84c8812da3ba42ee10f5778e Merge: 95abc817ab3a5 1b50f956c8fe9 Author: Linus Torvalds Date: Fri Apr 14 10:44:48 2023 -0700 Merge tag 'riscv-for-linus-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix for a missing fence when generating the NOMMU sigreturn trampoline - A set of fixes for early DTB handling of reserved memory nodes * tag 'riscv-for-linus-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: No need to relocate the dtb as it lies in the fixmap region riscv: Do not set initial_boot_params to the linear address of the dtb riscv: Move early dtb mapping into the fixmap region riscv: add icache flush for nommu sigreturn trampoline commit 95abc817ab3a5af57cc0b522f72225307fa6333f Merge: 4b992ead33cdd a3babdb7a8f73 Author: Linus Torvalds Date: Fri Apr 14 10:37:07 2023 -0700 Merge tag 'acpi-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These add two ACPI-related quirks: - Add a quirk to force StorageD3Enable on AMD Picasso systems (Mario Limonciello) - Add an ACPI IRQ override quirk for ASUS ExpertBook B1502CBA (Paul Menzel)" * tag 'acpi-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable commit 4b992ead33cdd47723f606350efcf8a8cae4fe36 Merge: d0b85e7e60b83 4654e9f9f4399 Author: Linus Torvalds Date: Fri Apr 14 10:25:30 2023 -0700 Merge tag 'pm-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Make the amd-pstate cpufreq driver take all of the possible combinations of the 'old' and 'new' status values correctly while changing the operation mode via sysfs (Wyes Karny)" * tag 'pm-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: amd-pstate: Fix amd_pstate mode switch commit d0b85e7e60b83348b022441de9047c60ff555bfa Merge: e251c42318341 117e4e5bd9d47 Author: Linus Torvalds Date: Fri Apr 14 10:19:18 2023 -0700 Merge tag 'thermal-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Modify the Intel thermal throttling code to avoid updating unsupported status clearing mask bits which causes the kernel to complain about unchecked MSR access (Srinivas Pandruvada)" * tag 'thermal-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: Avoid updating unsupported THERM_STATUS_CLEAR mask bits commit e251c4231834184a3a2a39b1800e983bb116ac6b Merge: aee3c14e8659b 6ab6f98fcdc9d Author: Linus Torvalds Date: Fri Apr 14 10:13:54 2023 -0700 Merge tag 'sound-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. At this time, quite a few fixes for the old PCI drivers are found. Although they are not regression fixes, I took these as they are materials for stable kernels. In addition, a couple of regression fixes and another couple of HD-audio quirks are included" * tag 'sound-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/hdmi: disable KAE for Intel DG2 ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 ALSA: hda: patch_realtek: add quirk for Asus N7601ZM ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() ALSA: emu10k1: don't create old pass-through playback device on Audigy ALSA: emu10k1: fix capture interrupt handler unlinking ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard ALSA: i2c/cs8427: fix iec958 mixer control deactivation commit aee3c14e8659b2d14f417422b7eeb8a1e97ced30 Merge: 44149752e9987 aca3b0fa3d04b Author: Linus Torvalds Date: Fri Apr 14 10:06:50 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "We had a fairly slow cycle on the rc side this time, here are the accumulated fixes, mostly in drivers: - irdma should not generate extra completions during flushing - Fix several memory leaks - Do not get confused in irdma's iwarp mode if IPv6 is present - Correct a link speed calculation in mlx5 - Increase the EQ/WQ limits on erdma as they are too small for big applications - Use the right math for erdma's inline mtt feature - Make erdma probing more robust to boot time ordering differences - Fix a KMSAN crash in CMA due to uninitialized qkey" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/core: Fix GID entry ref leak when create_ah fails RDMA/cma: Allow UD qp_type to join multicast only RDMA/erdma: Defer probing if netdevice can not be found RDMA/erdma: Inline mtt entries into WQE if supported RDMA/erdma: Update default EQ depth to 4096 and max_send_wr to 8192 RDMA/erdma: Fix some typos IB/mlx5: Add support for 400G_8X lane speed RDMA/irdma: Add ipv4 check to irdma_find_listener() RDMA/irdma: Increase iWARP CM default rexmit count RDMA/irdma: Fix memory leak of PBLE objects RDMA/irdma: Do not generate SW completions for NOPs commit c730fce7c70cfce831f4bdc9e49880ba1f61a092 Author: Ilya Leoshkevich Date: Fri Apr 14 17:47:55 2023 +0200 s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL Thomas Richter reported a crash in linux-next with a backtrace similar to the following one: [<0000000000000000>] 0x0 ([<000000000031a182>] bpf_trace_run4+0xc2/0x218) [<00000000001d59f4>] __bpf_trace_sched_switch+0x1c/0x28 [<0000000000c44a3a>] __schedule+0x43a/0x890 [<0000000000c44ef8>] schedule+0x68/0x110 [<0000000000c4e5ca>] do_nanosleep+0xa2/0x168 [<000000000026e7fe>] hrtimer_nanosleep+0xf6/0x1c0 [<000000000026eb6e>] __s390x_sys_nanosleep+0xb6/0xf0 [<0000000000c3b81c>] __do_syscall+0x1e4/0x208 [<0000000000c50510>] system_call+0x70/0x98 Last Breaking-Event-Address: [<000003ff7fda1814>] bpf_prog_65e887c70a835bbf_on_switch+0x1a4/0x1f0 The problem is that bpf_arch_text_poke() with new_addr == NULL is susceptible to the following race condition: T1 T2 ----------------- ------------------- plt.target = NULL entry: brcl 0xf,plt entry.mask = 0 lgrl %r1,plt.target br %r1 Fix by setting PLT target to the instruction following `brcl 0xf,plt` instead of 0. This way T2 will simply resume the execution of the eBPF program, which is the desired effect of passing new_addr == NULL. Fixes: f1d5df84cd8c ("s390/bpf: Implement bpf_arch_text_poke()") Reported-by: Thomas Richter Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Reviewed-by: Heiko Carstens Link: https://lore.kernel.org/bpf/20230414154755.184502-1-iii@linux.ibm.com commit a3babdb7a8f73c3d8965b245fe1b758b87538912 Merge: 05cda427126f3 10b6b4a8ac612 Author: Rafael J. Wysocki Date: Fri Apr 14 15:15:32 2023 +0200 Merge branch 'acpi-x86' Merge a quirk to force StorageD3Enable on AMD Picasso systems (Mario Limonciello). * acpi-x86: ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable commit 860e1c7f8b0b43fbf91b4d689adfaa13adb89452 Author: Ming Lei Date: Fri Apr 14 15:53:13 2023 +0800 io_uring: complete request via task work in case of DEFER_TASKRUN So far io_req_complete_post() only covers DEFER_TASKRUN by completing request via task work when the request is completed from IOWQ. However, uring command could be completed from any context, and if io uring is setup with DEFER_TASKRUN, the command is required to be completed from current context, otherwise wait on IORING_ENTER_GETEVENTS can't be wakeup, and may hang forever. The issue can be observed on removing ublk device, but turns out it is one generic issue for uring command & DEFER_TASKRUN, so solve it in io_uring core code. Fixes: e6aeb2721d3b ("io_uring: complete all requests in task context") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-block/b3fc9991-4c53-9218-a8cc-5b4dd3952108@kernel.dk/ Reported-by: Jens Axboe Cc: Kanchan Joshi Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit f7ca1ae32bd89ab035568c63b4443eb55420b423 Merge: 3723091ea1884 74391b3e69855 Author: Jens Axboe Date: Fri Apr 14 06:29:00 2023 -0600 Merge branch 'nvme-6.3' of git://git.infradead.org/nvme into block-6.3 Pull NVMe fix from Christoph. * 'nvme-6.3' of git://git.infradead.org/nvme: nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD commit d75eecc3d170d8963ae554a774b8af1f4e1246da Merge: 43950556b7670 75eab749e7aec Author: Arnd Bergmann Date: Fri Apr 14 13:52:48 2023 +0200 Merge tag 'qcom-arm64-fixes-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes A few more Qualcomm ARM64 DeviceTree fixes for 6.3 The GPIO polarity of the WSA881x shutdown GPIO was inconsistent and had to be corrected in the driver, this fixes the polarity in the DeviceTree for QRB5165 RB5, SM8250 MTP, Samsung Galaxy Book 2 and Lenovo Yoga C630. The recent rearrangement of nodes among the IPQ8074 accidentally enabled the PCIe PHYs, rather than the PCIe controllers. This is being corrected, to restore PCIe functionality. PMK8280 PON node has the wrong compatible, which recently caused the driver to stop probing. This is corrected and the required "pbs" region is added. With support for HBR3 introduced, it's noted that SC7280 Herobrine devices are having trouble running at this rate. This drops the claim that it's supported, until further analysis can be done. * tag 'qcom-arm64-fixes-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sc7280: remove hbr3 support on herobrine boards arm64: dts: qcom: sc8280xp-pmics: fix pon compatible and registers arm64: dts: qcom: ipq8074-hk10: enable QMP device, not the PHY node arm64: dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node arm64: dts: qcom: qrb5165-rb5: Use proper WSA881x shutdown GPIO polarity arm64: dts: qcom: sm8250-mtp: Use proper WSA881x shutdown GPIO polarity arm64: dts: qcom: sdm850-samsung-w737: Use proper WSA881x shutdown GPIO polarity arm64: dts: qcom: sdm850-lenovo-yoga-c630: Use proper WSA881x shutdown GPIO polarity Link: https://lore.kernel.org/r/20230410153850.4752-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 43950556b767054a5ccff48e1967ed8540c074f2 Merge: 43235168793cb 60a655debd36e Author: Arnd Bergmann Date: Fri Apr 14 13:51:22 2023 +0200 Merge tag 'v6.3-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Lower sd card speeds for two boards to make them run more reliable, missing 32k clock definition for Anbric xx3 devices, missing cache-levels for rk3588, fixed rk3326-board display supplies and more dt-schema fixes. * tag 'v6.3-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: correct panel supplies on some rk3326 boards arm64: dts: rockchip: use just "port" in panel on RockPro64 arm64: dts: rockchip: use just "port" in panel on Pinebook Pro arm64: dts: rockchip: Remove non-existing pwm-delay-us property arm64: dts: rockchip: Add clk_rtc_32k to Anbernic xx3 Devices arm64: dts: rockchip: add rk3588 cache level information arm64: dts: rockchip: Lower SD card speed on rk3399 Pinebook Pro arm64: dts: rockchip: Lower sd speed on rk3566-soquartz ARM: dts: rockchip: fix a typo error for rk3288 spdif node arm64: dts: rockchip: Fix rk3399 GICv3 ITS node name Link: https://lore.kernel.org/r/10559306.CDJkKcVGEf@phil Signed-off-by: Arnd Bergmann commit 43235168793cb1d766ccd015c219068e0547c511 Author: Johan Hovold Date: Fri Apr 14 10:46:19 2023 +0200 firmware/psci: demote suspend-mode warning to info level On some Qualcomm platforms, like SC8280XP, the attempt to set PC mode during boot fails with PSCI_RET_DENIED and since commit 998fcd001feb ("firmware/psci: Print a warning if PSCI doesn't accept PC mode") this is now logged at warning level: psci: failed to set PC mode: -3 As there is nothing users can do about the firmware behaving this way, demote the warning to info level and clearly mark it as a firmware bug: psci: [Firmware Bug]: failed to set PC mode: -3 Reviewed-by: Ulf Hansson Acked-by: Mark Rutland Acked-by: Sudeep Holla Signed-off-by: Johan Hovold Acked-by: Dmitry Baryshkov Signed-off-by: Arnd Bergmann commit 3037933448f60f9acb705997eae62013ecb81e0d Author: Gwangun Jung Date: Thu Apr 13 19:35:54 2023 +0900 net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg If the TCA_QFQ_LMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1. As a result, it is possible to have an lmax value that exceeds QFQ_MIN_LMAX. Due to the invalid lmax value, an index is generated that exceeds the QFQ_MAX_INDEX(=24) value, causing out-of-bounds read/write errors. The following reports a oob access: [ 84.582666] BUG: KASAN: slab-out-of-bounds in qfq_activate_agg.constprop.0 (net/sched/sch_qfq.c:1027 net/sched/sch_qfq.c:1060 net/sched/sch_qfq.c:1313) [ 84.583267] Read of size 4 at addr ffff88810f676948 by task ping/301 [ 84.583686] [ 84.583797] CPU: 3 PID: 301 Comm: ping Not tainted 6.3.0-rc5 #1 [ 84.584164] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 84.584644] Call Trace: [ 84.584787] [ 84.584906] dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1)) [ 84.585108] print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) [ 84.585570] kasan_report (mm/kasan/report.c:538) [ 84.585988] qfq_activate_agg.constprop.0 (net/sched/sch_qfq.c:1027 net/sched/sch_qfq.c:1060 net/sched/sch_qfq.c:1313) [ 84.586599] qfq_enqueue (net/sched/sch_qfq.c:1255) [ 84.587607] dev_qdisc_enqueue (net/core/dev.c:3776) [ 84.587749] __dev_queue_xmit (./include/net/sch_generic.h:186 net/core/dev.c:3865 net/core/dev.c:4212) [ 84.588763] ip_finish_output2 (./include/net/neighbour.h:546 net/ipv4/ip_output.c:228) [ 84.589460] ip_output (net/ipv4/ip_output.c:430) [ 84.590132] ip_push_pending_frames (./include/net/dst.h:444 net/ipv4/ip_output.c:126 net/ipv4/ip_output.c:1586 net/ipv4/ip_output.c:1606) [ 84.590285] raw_sendmsg (net/ipv4/raw.c:649) [ 84.591960] sock_sendmsg (net/socket.c:724 net/socket.c:747) [ 84.592084] __sys_sendto (net/socket.c:2142) [ 84.593306] __x64_sys_sendto (net/socket.c:2150) [ 84.593779] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 84.593902] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [ 84.594070] RIP: 0033:0x7fe568032066 [ 84.594192] Code: 0e 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c09[ 84.594796] RSP: 002b:00007ffce388b4e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c Code starting with the faulting instruction =========================================== [ 84.595047] RAX: ffffffffffffffda RBX: 00007ffce388cc70 RCX: 00007fe568032066 [ 84.595281] RDX: 0000000000000040 RSI: 00005605fdad6d10 RDI: 0000000000000003 [ 84.595515] RBP: 00005605fdad6d10 R08: 00007ffce388eeec R09: 0000000000000010 [ 84.595749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 84.595984] R13: 00007ffce388cc30 R14: 00007ffce388b4f0 R15: 0000001d00000001 [ 84.596218] [ 84.596295] [ 84.596351] Allocated by task 291: [ 84.596467] kasan_save_stack (mm/kasan/common.c:46) [ 84.596597] kasan_set_track (mm/kasan/common.c:52) [ 84.596725] __kasan_kmalloc (mm/kasan/common.c:384) [ 84.596852] __kmalloc_node (./include/linux/kasan.h:196 mm/slab_common.c:967 mm/slab_common.c:974) [ 84.596979] qdisc_alloc (./include/linux/slab.h:610 ./include/linux/slab.h:731 net/sched/sch_generic.c:938) [ 84.597100] qdisc_create (net/sched/sch_api.c:1244) [ 84.597222] tc_modify_qdisc (net/sched/sch_api.c:1680) [ 84.597357] rtnetlink_rcv_msg (net/core/rtnetlink.c:6174) [ 84.597495] netlink_rcv_skb (net/netlink/af_netlink.c:2574) [ 84.597627] netlink_unicast (net/netlink/af_netlink.c:1340 net/netlink/af_netlink.c:1365) [ 84.597759] netlink_sendmsg (net/netlink/af_netlink.c:1942) [ 84.597891] sock_sendmsg (net/socket.c:724 net/socket.c:747) [ 84.598016] ____sys_sendmsg (net/socket.c:2501) [ 84.598147] ___sys_sendmsg (net/socket.c:2557) [ 84.598275] __sys_sendmsg (./include/linux/file.h:31 net/socket.c:2586) [ 84.598399] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 84.598520] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [ 84.598688] [ 84.598744] The buggy address belongs to the object at ffff88810f674000 [ 84.598744] which belongs to the cache kmalloc-8k of size 8192 [ 84.599135] The buggy address is located 2664 bytes to the right of [ 84.599135] allocated 7904-byte region [ffff88810f674000, ffff88810f675ee0) [ 84.599544] [ 84.599598] The buggy address belongs to the physical page: [ 84.599777] page:00000000e638567f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f670 [ 84.600074] head:00000000e638567f order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 84.600330] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 84.600517] raw: 0200000000010200 ffff888100043180 dead000000000122 0000000000000000 [ 84.600764] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 84.601009] page dumped because: kasan: bad access detected [ 84.601187] [ 84.601241] Memory state around the buggy address: [ 84.601396] ffff88810f676800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.601620] ffff88810f676880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.601845] >ffff88810f676900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602069] ^ [ 84.602243] ffff88810f676980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602468] ffff88810f676a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602693] ================================================================== [ 84.602924] Disabling lock debugging due to kernel taint Fixes: 3015f3d2a3cd ("pkt_sched: enable QFQ to support TSO/GSO") Reported-by: Gwangun Jung Signed-off-by: Gwangun Jung Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 5dc63e56a9cf8df0b59c234a505a1653f1bdf885 Author: hrdl Date: Thu Apr 13 23:41:13 2023 -0700 Input: cyttsp5 - fix sensing configuration data structure Prior to this patch, the sensing configuration data was not parsed correctly, breaking detection of max_tch. The vendor driver includes this field. This change informs the driver about the correct maximum number of simultaneous touch inputs. Tested on a Pine64 PineNote with a modified touch screen controller firmware. Signed-off-by: hrdl Reviewed-by: Alistair Francis Link: https://lore.kernel.org/r/20230411211651.3791304-1-git@hrdl.eu Signed-off-by: Dmitry Torokhov commit 6ab6f98fcdc9d4fbe245aa67de03542deea65322 Author: Kai Vehmanen Date: Thu Apr 13 22:11:53 2023 +0300 ALSA: hda/hdmi: disable KAE for Intel DG2 Use of keep-alive (KAE) has resulted in loss of audio on some A750/770 cards as the transition from keep-alive to stream playback is not working as expected. As there is limited benefit of the new KAE mode on discrete cards, revert back to older silent-stream implementation on these systems. Cc: stable@vger.kernel.org Fixes: 15175a4f2bbb ("ALSA: hda/hdmi: add keep-alive support for ADL-P and DG2") Link: https://gitlab.freedesktop.org/drm/intel/-/issues/8307 Signed-off-by: Kai Vehmanen Link: https://lore.kernel.org/r/20230413191153.3692049-1-kai.vehmanen@linux.intel.com Signed-off-by: Takashi Iwai commit 74391b3e69855e7dd65a9cef36baf5fc1345affd Author: Duy Truong Date: Thu Apr 13 17:55:48 2023 -0700 nvme-pci: add NVME_QUIRK_BOGUS_NID for T-FORCE Z330 SSD Added a quirk to fix the TeamGroup T-Force Cardea Zero Z330 SSDs reporting duplicate NGUIDs. Signed-off-by: Duy Truong Cc: stable@vger.kernel.org Signed-off-by: Christoph Hellwig commit 1b50f956c8fe9082bdee4a9cfd798149c52f7043 Author: Alexandre Ghiti Date: Wed Mar 29 10:19:32 2023 +0200 riscv: No need to relocate the dtb as it lies in the fixmap region We used to access the dtb via its linear mapping address but now that the dtb early mapping was moved in the fixmap region, we can keep using this address since it is present in swapper_pg_dir, and remove the dtb relocation. Note that the relocation was wrong anyway since early_memremap() is restricted to 256K whereas the maximum fdt size is 2MB. Signed-off-by: Alexandre Ghiti Reviewed-by: Conor Dooley Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230329081932.79831-4-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit f1581626071c8e37c58c5e8f0b4126b17172a211 Author: Alexandre Ghiti Date: Wed Mar 29 10:19:31 2023 +0200 riscv: Do not set initial_boot_params to the linear address of the dtb early_init_dt_verify() is already called in parse_dtb() and since the dtb address does not change anymore (it is now in the fixmap region), no need to reset initial_boot_params by calling early_init_dt_verify() again. Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230329081932.79831-3-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit ef69d2559fe91f23d27a3d6fd640b5641787d22e Author: Alexandre Ghiti Date: Wed Mar 29 10:19:30 2023 +0200 riscv: Move early dtb mapping into the fixmap region riscv establishes 2 virtual mappings: - early_pg_dir maps the kernel which allows to discover the system memory - swapper_pg_dir installs the final mapping (linear mapping included) We used to map the dtb in early_pg_dir using DTB_EARLY_BASE_VA, and this mapping was not carried over in swapper_pg_dir. It happens that early_init_fdt_scan_reserved_mem() must be called before swapper_pg_dir is setup otherwise we could allocate reserved memory defined in the dtb. And this function initializes reserved_mem variable with addresses that lie in the early_pg_dir dtb mapping: when those addresses are reused with swapper_pg_dir, this mapping does not exist and then we trap. The previous "fix" was incorrect as early_init_fdt_scan_reserved_mem() must be called before swapper_pg_dir is set up otherwise we could allocate in reserved memory defined in the dtb. So move the dtb mapping in the fixmap region which is established in early_pg_dir and handed over to swapper_pg_dir. Fixes: 922b0375fc93 ("riscv: Fix memblock reservation for device tree blob") Fixes: 8f3a2b4a96dc ("RISC-V: Move DT mapping outof fixmap") Fixes: 50e63dd8ed92 ("riscv: fix reserved memory setup") Reported-by: Conor Dooley Link: https://lore.kernel.org/all/f8e67f82-103d-156c-deb0-d6d6e2756f5e@microchip.com/ Signed-off-by: Alexandre Ghiti Reviewed-by: Conor Dooley Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230329081932.79831-2-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 44149752e9987a9eac5ad78e6d3a20934b5e018d Merge: e44f45fee8d55 7e27cb6ad4d85 Author: Linus Torvalds Date: Thu Apr 13 16:28:33 2023 -0700 Merge tag 'cgroup-for-6.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "This is a relatively big pull request this late in the cycle but the major contributor is the cpuset bug which is rather significant: - Fix several cpuset bugs including one where it wasn't applying the target cgroup when tasks are created with CLONE_INTO_CGROUP With a few smaller fixes: - Fix inversed locking order in cgroup1 freezer implementation - Fix garbage cpu.stat::core_sched.forceidle_usec reporting in the root cgroup" * tag 'cgroup-for-6.3-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: Make cpuset_attach_task() skip subpartitions CPUs for top_cpuset cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex cgroup/cpuset: Fix partition root's cpuset.cpus update bug cgroup: fix display of forceidle time at root commit e44f45fee8d5520c6a72e308054fc627e8e38619 Merge: 829cca4d17830 632e04739c8f4 Author: Linus Torvalds Date: Thu Apr 13 16:16:33 2023 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A few more clk driver fixes: - Set the max_register member of the spreadtrum regmap so that reads don't go off the end of the I/O space - Avoid a clk parent error in the i.MX imx6ul driver when the selector is unknown - Fix an oops due to REGCACHE_NONE usage by the Renesas 9-series driver" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: rs9: Fix suspend/resume clk: imx6ul: fix "failed to get parent" error clk: sprd: set max_register according to mapping range commit 829cca4d1783088e43bace57a555044cc937c554 Merge: 4413ad01e27eb d0f89c4c1d4e7 Author: Linus Torvalds Date: Thu Apr 13 15:33:04 2023 -0700 Merge tag 'net-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, and bluetooth. Not all that quiet given spring celebrations, but "current" fixes are thinning out, which is encouraging. One outstanding regression in the mlx5 driver when using old FW, not blocking but we're pushing for a fix. Current release - new code bugs: - eth: enetc: workaround for unresponsive pMAC after receiving express traffic Previous releases - regressions: - rtnetlink: restore RTM_NEW/DELLINK notification behavior, keep the pid/seq fields 0 for backward compatibility Previous releases - always broken: - sctp: fix a potential overflow in sctp_ifwdtsn_skip - mptcp: - use mptcp_schedule_work instead of open-coding it and make the worker check stricter, to avoid scheduling work on closed sockets - fix NULL pointer dereference on fastopen early fallback - skbuff: fix memory corruption due to a race between skb coalescing and releasing clones confusing page_pool reference counting - bonding: fix neighbor solicitation validation on backup slaves - bpf: tcp: use sock_gen_put instead of sock_put in bpf_iter_tcp - bpf: arm64: fixed a BTI error on returning to patched function - openvswitch: fix race on port output leading to inf loop - sfp: initialize sfp->i2c_block_size at sfp allocation to avoid returning a different errno than expected - phy: nxp-c45-tja11xx: unregister PTP, purge queues on remove - Bluetooth: fix printing errors if LE Connection times out - Bluetooth: assorted UaF, deadlock and data race fixes - eth: macb: fix memory corruption in extended buffer descriptor mode Misc: - adjust the XDP Rx flow hash API to also include the protocol layers over which the hash was computed" * tag 'net-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (50 commits) selftests/bpf: Adjust bpf_xdp_metadata_rx_hash for new arg mlx4: bpf_xdp_metadata_rx_hash add xdp rss hash type veth: bpf_xdp_metadata_rx_hash add xdp rss hash type mlx5: bpf_xdp_metadata_rx_hash add xdp rss hash type xdp: rss hash types representation selftests/bpf: xdp_hw_metadata remove bpf_printk and add counters skbuff: Fix a race between coalescing and releasing SKBs net: macb: fix a memory corruption in extended buffer descriptor mode selftests: add the missing CONFIG_IP_SCTP in net config udp6: fix potential access to stale information selftests: openvswitch: adjust datapath NL message declaration selftests: mptcp: userspace pm: uniform verify events mptcp: fix NULL pointer dereference on fastopen early fallback mptcp: stricter state check in mptcp_worker mptcp: use mptcp_schedule_work instead of open-coding it net: enetc: workaround for unresponsive pMAC after receiving express traffic sctp: fix a potential overflow in sctp_ifwdtsn_skip net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() rtnetlink: Restore RTM_NEW/DELLINK notification behavior net: ti/cpsw: Add explicit platform_device.h and of_platform.h includes ... commit 11b3b9f461c5c4f700f6c8da202fcc2fd6418e1f Author: Vitaly Prosyak Date: Thu Apr 6 16:00:54 2023 -0400 drm/sched: Check scheduler ready before calling timeout handling During an IGT GPU reset test we see the following oops, [ +0.000003] ------------[ cut here ]------------ [ +0.000000] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:1656 __queue_delayed_work+0x6d/0xa0 [ +0.000004] Modules linked in: iptable_filter bpfilter amdgpu(OE) nls_iso8859_1 snd_hda_codec_realtek snd_hda_codec_generic intel_rapl_msr ledtrig_audio snd_hda_codec_hdmi intel_rapl_common snd_hda_intel edac_mce_amd snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core iommu_v2 gpu_sched(OE) kvm_amd drm_buddy snd_hwdep kvm video drm_ttm_helper snd_pcm ttm snd_seq_midi drm_display_helper snd_seq_midi_event snd_rawmidi cec crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_seq aesni_intel rc_core crypto_simd cryptd binfmt_misc drm_kms_helper rapl snd_seq_device input_leds joydev snd_timer i2c_algo_bit syscopyarea snd ccp sysfillrect sysimgblt wmi_bmof k10temp soundcore mac_hid sch_fq_codel msr parport_pc ppdev drm lp parport ramoops reed_solomon pstore_blk pstore_zone efi_pstore ip_tables x_tables autofs4 hid_generic usbhid hid r8169 ahci xhci_pci gpio_amdpt realtek i2c_piix4 wmi crc32_pclmul xhci_pci_renesas libahci gpio_generic [ +0.000070] CPU: 9 PID: 0 Comm: swapper/9 Tainted: G W OE 6.1.11+ #2 [ +0.000003] Hardware name: Gigabyte Technology Co., Ltd. AB350-Gaming 3/AB350-Gaming 3-CF, BIOS F7 06/16/2017 [ +0.000001] RIP: 0010:__queue_delayed_work+0x6d/0xa0 [ +0.000003] Code: 7a 50 48 01 c1 48 89 4a 30 81 ff 00 20 00 00 75 38 4c 89 cf e8 64 3e 0a 00 5d e9 1e c5 11 01 e8 99 f7 ff ff 5d e9 13 c5 11 01 <0f> 0b eb c1 0f 0b 48 81 7a 38 70 5c 0e 81 74 9f 0f 0b 48 8b 42 28 [ +0.000002] RSP: 0018:ffffc90000398d60 EFLAGS: 00010007 [ +0.000002] RAX: ffff88810d589c60 RBX: 0000000000000000 RCX: 0000000000000000 [ +0.000002] RDX: ffff88810d589c58 RSI: 0000000000000000 RDI: 0000000000002000 [ +0.000001] RBP: ffffc90000398d60 R08: 0000000000000000 R09: ffff88810d589c78 [ +0.000002] R10: 72705f305f39765f R11: 7866673a6d72645b R12: ffff88810d589c58 [ +0.000001] R13: 0000000000002000 R14: 0000000000000000 R15: 0000000000000000 [ +0.000002] FS: 0000000000000000(0000) GS:ffff8887fee40000(0000) knlGS:0000000000000000 [ +0.000001] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000002] CR2: 00005562c4797fa0 CR3: 0000000110da0000 CR4: 00000000003506e0 [ +0.000002] Call Trace: [ +0.000001] [ +0.000001] mod_delayed_work_on+0x5e/0xa0 [ +0.000004] drm_sched_fault+0x23/0x30 [gpu_sched] [ +0.000007] gfx_v9_0_fault.isra.0+0xa6/0xd0 [amdgpu] [ +0.000258] gfx_v9_0_priv_reg_irq+0x29/0x40 [amdgpu] [ +0.000254] amdgpu_irq_dispatch+0x1ac/0x2b0 [amdgpu] [ +0.000243] amdgpu_ih_process+0x89/0x130 [amdgpu] [ +0.000245] amdgpu_irq_handler+0x24/0x60 [amdgpu] [ +0.000165] __handle_irq_event_percpu+0x4f/0x1a0 [ +0.000003] handle_irq_event_percpu+0x15/0x50 [ +0.000001] handle_irq_event+0x39/0x60 [ +0.000002] handle_edge_irq+0xa8/0x250 [ +0.000003] __common_interrupt+0x7b/0x150 [ +0.000002] common_interrupt+0xc1/0xe0 [ +0.000003] [ +0.000000] [ +0.000001] asm_common_interrupt+0x27/0x40 [ +0.000002] RIP: 0010:native_safe_halt+0xb/0x10 [ +0.000003] Code: 46 ff ff ff cc cc cc cc cc cc cc cc cc cc cc eb 07 0f 00 2d 69 f2 5e 00 f4 e9 f1 3b 3e 00 90 eb 07 0f 00 2d 59 f2 5e 00 fb f4 e0 3b 3e 00 0f 1f 44 00 00 55 48 89 e5 53 e8 b1 d4 fe ff 66 90 [ +0.000002] RSP: 0018:ffffc9000018fdc8 EFLAGS: 00000246 [ +0.000002] RAX: 0000000000004000 RBX: 000000000002e5a8 RCX: 000000000000001f [ +0.000001] RDX: 0000000000000001 RSI: ffff888101298800 RDI: ffff888101298864 [ +0.000001] RBP: ffffc9000018fdd0 R08: 000000527f64bd8b R09: 000000000001dc90 [ +0.000001] R10: 000000000001dc90 R11: 0000000000000003 R12: 0000000000000001 [ +0.000001] R13: ffff888101298864 R14: ffffffff832d9e20 R15: ffff888193aa8c00 [ +0.000003] ? acpi_idle_do_entry+0x5e/0x70 [ +0.000002] acpi_idle_enter+0xd1/0x160 [ +0.000003] cpuidle_enter_state+0x9a/0x6e0 [ +0.000003] cpuidle_enter+0x2e/0x50 [ +0.000003] call_cpuidle+0x23/0x50 [ +0.000002] do_idle+0x1de/0x260 [ +0.000002] cpu_startup_entry+0x20/0x30 [ +0.000002] start_secondary+0x120/0x150 [ +0.000003] secondary_startup_64_no_verify+0xe5/0xeb [ +0.000004] [ +0.000000] ---[ end trace 0000000000000000 ]--- [ +0.000003] BUG: kernel NULL pointer dereference, address: 0000000000000102 [ +0.006233] [drm:amdgpu_job_timedout [amdgpu]] *ERROR* ring gfx_low timeout, signaled seq=3, emitted seq=4 [ +0.000734] #PF: supervisor read access in kernel mode [ +0.009670] [drm:amdgpu_job_timedout [amdgpu]] *ERROR* Process information: process amd_deadlock pid 2002 thread amd_deadlock pid 2002 [ +0.005135] #PF: error_code(0x0000) - not-present page [ +0.000002] PGD 0 P4D 0 [ +0.000002] Oops: 0000 [#1] PREEMPT SMP NOPTI [ +0.000002] CPU: 9 PID: 0 Comm: swapper/9 Tainted: G W OE 6.1.11+ #2 [ +0.000002] Hardware name: Gigabyte Technology Co., Ltd. AB350-Gaming 3/AB350-Gaming 3-CF, BIOS F7 06/16/2017 [ +0.012101] amdgpu 0000:0c:00.0: amdgpu: GPU reset begin! [ +0.005136] RIP: 0010:__queue_work+0x1f/0x4e0 [ +0.000004] Code: 87 cd 11 01 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 49 89 d5 41 54 49 89 f4 53 48 83 ec 10 89 7d d4 86 02 01 00 00 01 0f 85 6c 03 00 00 e8 7f 36 08 00 8b 45 d4 48 For gfx_rings the schedulers may not be initialized by amdgpu_device_init_schedulers() due to ring->no_scheduler flag being set to true and thus the timeout_wq is NULL. As a result, since all ASICs call drm_sched_fault() unconditionally even for schedulers which have not been initialized, it is simpler to use the ready condition which indicates whether the given scheduler worker thread runs and whether the timeout_wq of the reset domain has been initialized. Signed-off-by: Vitaly Prosyak Cc: Christian König Reviewed-by: Luben Tuikov Signed-off-by: Luben Tuikov Link: https://lore.kernel.org/r/20230406200054.633379-1-luben.tuikov@amd.com commit 4413ad01e27eb989f4b19bb5b038328c220a383d Merge: 531f27ad5e3a8 1a50d9403fb90 Author: Linus Torvalds Date: Thu Apr 13 15:21:56 2023 -0700 Merge tag 'devicetree-fixes-for-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix interaction between fw_devlink and DT overlays causing devices to not be probed - Fix the compatible string for loongson,cpu-interrupt-controller * tag 'devicetree-fixes-for-6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: treewide: Fix probing of devices in DT overlays dt-bindings: interrupt-controller: loongarch: Fix mismatched compatible commit 531f27ad5e3a85128a9668c9063c58fc35d4e89b Merge: f1be7b6c165f0 534e465845ebf Author: Linus Torvalds Date: Thu Apr 13 15:17:59 2023 -0700 Merge tag 'pinctrl-v6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fix from Linus Walleij: "This is just a revert of the AMD fix, because the fix broke some laptops. We are working on a proper solution" * tag 'pinctrl-v6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: Revert "pinctrl: amd: Disable and mask interrupts on resume" commit f1be7b6c165f0d451c3ea2062f506bf5f130bd5e Merge: de4664485abbc cab2932213c5c Author: Linus Torvalds Date: Thu Apr 13 14:58:55 2023 -0700 Merge tag 'drm-fixes-2023-04-13' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: - two fbcon regressions - amdgpu: dp mst, smu13 - i915: dual link dsi for tgl+ - armada, nouveau, drm/sched, fbmem * tag 'drm-fixes-2023-04-13' of git://anongit.freedesktop.org/drm/drm: fbcon: set_con2fb_map needs to set con2fb_map! fbcon: Fix error paths in set_con2fb_map drm/amd/pm: correct the pcie link state check for SMU13 drm/amd/pm: correct SMU13.0.7 max shader clock reporting drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings drm/amd/display: Pass the right info to drm_dp_remove_payload drm/armada: Fix a potential double free in an error handling path fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace drm/nouveau/fb: add missing sysmen flush callbacks drm/i915/dsi: fix DSS CTL register offsets for TGL+ drm/scheduler: Fix UAF race in drm_sched_entity_push_job() commit d0f89c4c1d4e7614581d4fe7caebb3ce6bceafe6 Merge: 0646dc31ca886 b65ef48c95b95 Author: Jakub Kicinski Date: Thu Apr 13 13:04:44 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-04-13 We've added 6 non-merge commits during the last 1 day(s) which contain a total of 14 files changed, 205 insertions(+), 38 deletions(-). The main changes are: 1) One late straggler fix on the XDP hints side which fixes bpf_xdp_metadata_rx_hash kfunc API before the release goes out in order to provide information on the RSS hash type, from Jesper Dangaard Brouer. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Adjust bpf_xdp_metadata_rx_hash for new arg mlx4: bpf_xdp_metadata_rx_hash add xdp rss hash type veth: bpf_xdp_metadata_rx_hash add xdp rss hash type mlx5: bpf_xdp_metadata_rx_hash add xdp rss hash type xdp: rss hash types representation selftests/bpf: xdp_hw_metadata remove bpf_printk and add counters ==================== Link: https://lore.kernel.org/r/20230413192939.10202-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit e7067a446264a7514fa1cfaa4052cdb6803bc6a2 Author: David Disseldorp Date: Thu Apr 13 23:49:57 2023 +0900 ksmbd: avoid out of bounds access in decode_preauth_ctxt() Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient. Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt. Signed-off-by: David Disseldorp Acked-by: Namjae Jeon Cc: Signed-off-by: Steve French commit cab2932213c5cd72a9e04e5e82002e81b946592b Merge: fffb0b52d5258 5603effb8295a Author: Daniel Vetter Date: Thu Apr 13 20:47:58 2023 +0200 Merge tag 'drm-misc-fixes-2023-04-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * armada: Fix double free * fb: Clear FB_ACTIVATE_KD_TEXT in ioctl * nouveau: Add missing callbacks * scheduler: Fix use-after-free error Signed-off-by: Daniel Vetter From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230413184233.GA8148@linux-uq9g commit b65ef48c95b95960e91f9f3c45e6d079be00f0f3 Merge: 0646dc31ca886 0f26b74e7d071 Author: Alexei Starovoitov Date: Thu Apr 13 11:05:49 2023 -0700 Merge branch 'XDP-hints: change RX-hash kfunc bpf_xdp_metadata_rx_hash' Jesper Dangaard Brouer says: ==================== Current API for bpf_xdp_metadata_rx_hash() returns the raw RSS hash value, but doesn't provide information on the RSS hash type (part of 6.3-rc). This patchset proposal is to change the function call signature via adding a pointer value argument for providing the RSS hash type. Patchset also removes all bpf_printk's from xdp_hw_metadata program that we expect driver developers to use. Instead counters are introduced for relaying e.g. skip and fail info. ==================== Signed-off-by: Alexei Starovoitov commit 0f26b74e7d071b0dc18e2c43d79d496c2b144035 Author: Jesper Dangaard Brouer Date: Wed Apr 12 21:49:00 2023 +0200 selftests/bpf: Adjust bpf_xdp_metadata_rx_hash for new arg Update BPF selftests to use the new RSS type argument for kfunc bpf_xdp_metadata_rx_hash. Signed-off-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/168132894068.340624.8914711185697163690.stgit@firesoul Signed-off-by: Alexei Starovoitov commit 9123397aeeb4f93dda5828e37c35312f1b62231e Author: Jesper Dangaard Brouer Date: Wed Apr 12 21:48:55 2023 +0200 mlx4: bpf_xdp_metadata_rx_hash add xdp rss hash type Update API for bpf_xdp_metadata_rx_hash() with arg for xdp rss hash type via matching individual Completion Queue Entry (CQE) status bits. Fixes: ab46182d0dcb ("net/mlx4_en: Support RX XDP metadata") Signed-off-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/168132893562.340624.12779118462402031248.stgit@firesoul Signed-off-by: Alexei Starovoitov commit 96b1a098f3db06223a6b6268e756f980d5c07f10 Author: Jesper Dangaard Brouer Date: Wed Apr 12 21:48:50 2023 +0200 veth: bpf_xdp_metadata_rx_hash add xdp rss hash type Update API for bpf_xdp_metadata_rx_hash() with arg for xdp rss hash type. The veth driver currently only support XDP-hints based on SKB code path. The SKB have lost information about the RSS hash type, by compressing the information down to a single bitfield skb->l4_hash, that only knows if this was a L4 hash value. In preparation for veth, the xdp_rss_hash_type have an L4 indication bit that allow us to return a meaningful L4 indication when working with SKB based packets. Fixes: 306531f0249f ("veth: Support RX XDP metadata") Signed-off-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/168132893055.340624.16209448340644513469.stgit@firesoul Signed-off-by: Alexei Starovoitov commit 67f245c2ec0af17d7a90c78910e28bc8b206297c Author: Jesper Dangaard Brouer Date: Wed Apr 12 21:48:45 2023 +0200 mlx5: bpf_xdp_metadata_rx_hash add xdp rss hash type Update API for bpf_xdp_metadata_rx_hash() with arg for xdp rss hash type via mapping table. The mlx5 hardware can also identify and RSS hash IPSEC. This indicate hash includes SPI (Security Parameters Index) as part of IPSEC hash. Extend xdp core enum xdp_rss_hash_type with IPSEC hash type. Fixes: bc8d405b1ba9 ("net/mlx5e: Support RX XDP metadata") Signed-off-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/168132892548.340624.11185734579430124869.stgit@firesoul Signed-off-by: Alexei Starovoitov commit 0cd917a4a8ace70ff9082d797c899f6bf10de910 Author: Jesper Dangaard Brouer Date: Wed Apr 12 21:48:40 2023 +0200 xdp: rss hash types representation The RSS hash type specifies what portion of packet data NIC hardware used when calculating RSS hash value. The RSS types are focused on Internet traffic protocols at OSI layers L3 and L4. L2 (e.g. ARP) often get hash value zero and no RSS type. For L3 focused on IPv4 vs. IPv6, and L4 primarily TCP vs UDP, but some hardware supports SCTP. Hardware RSS types are differently encoded for each hardware NIC. Most hardware represent RSS hash type as a number. Determining L3 vs L4 often requires a mapping table as there often isn't a pattern or sorting according to ISO layer. The patch introduce a XDP RSS hash type (enum xdp_rss_hash_type) that contains both BITs for the L3/L4 types, and combinations to be used by drivers for their mapping tables. The enum xdp_rss_type_bits get exposed to BPF via BTF, and it is up to the BPF-programmer to match using these defines. This proposal change the kfunc API bpf_xdp_metadata_rx_hash() adding a pointer value argument for provide the RSS hash type. Change signature for all xmo_rx_hash calls in drivers to make it compile. The RSS type implementations for each driver comes as separate patches. Fixes: 3d76a4d3d4e5 ("bpf: XDP metadata RX kfuncs") Signed-off-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/168132892042.340624.582563003880565460.stgit@firesoul Signed-off-by: Alexei Starovoitov commit e8163b98d96c4d87c870689f560c53be7ccd55c8 Author: Jesper Dangaard Brouer Date: Wed Apr 12 21:48:35 2023 +0200 selftests/bpf: xdp_hw_metadata remove bpf_printk and add counters The tool xdp_hw_metadata can be used by driver developers implementing XDP-hints metadata kfuncs. Remove all bpf_printk calls, as the tool already transfers all the XDP-hints related information via metadata area to AF_XDP userspace process. Add counters for providing remaining information about failure and skipped packet events. Signed-off-by: Jesper Dangaard Brouer Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/168132891533.340624.7313781245316405141.stgit@firesoul Signed-off-by: Alexei Starovoitov commit fffb0b52d5258554c645c966c6cbef7de50b851d Author: Daniel Vetter Date: Wed Apr 12 17:31:46 2023 +0200 fbcon: set_con2fb_map needs to set con2fb_map! I got really badly confused in d443d9386472 ("fbcon: move more common code into fb_open()") because we set the con2fb_map before the failure points, which didn't look good. But in trying to fix that I moved the assignment into the wrong path - we need to do it for _all_ vc we take over, not just the first one (which additionally requires the call to con2fb_acquire_newinfo). I've figured this out because of a KASAN bug report, where the fbcon_registered_fb and fbcon_display arrays went out of sync in fbcon_mode_deleted() because the con2fb_map pointed at the old fb_info, but the modes and everything was updated for the new one. Signed-off-by: Daniel Vetter Reviewed-by: Javier Martinez Canillas Acked-by: Helge Deller Tested-by: Xingyuan Mo Fixes: d443d9386472 ("fbcon: move more common code into fb_open()") Reported-by: Xingyuan Mo Cc: Thomas Zimmermann Cc: Sam Ravnborg Cc: Xingyuan Mo Cc: Thomas Zimmermann Cc: Helge Deller Cc: # v5.19+ commit edf79dd2172233452ff142dcc98b19d955fc8974 Author: Daniel Vetter Date: Wed Apr 12 17:23:49 2023 +0200 fbcon: Fix error paths in set_con2fb_map This is a regressoin introduced in b07db3958485 ("fbcon: Ditch error handling for con2fb_release_oldinfo"). I failed to realize what the if (!err) checks. The mentioned commit was dropping the con2fb_release_oldinfo() return value but the if (!err) was also checking whether the con2fb_acquire_newinfo() function call above failed or not. Fix this with an early return statement. Note that there's still a difference compared to the orginal state of the code, the below lines are now also skipped on error: if (!search_fb_in_map(info_idx)) info_idx = newidx; These are only needed when we've actually thrown out an old fb_info from the console mappings, which only happens later on. Also move the fbcon_add_cursor_work() call into the same if block, it's all protected by console_lock so doesn't matter when we set up the blinking cursor delayed work anyway. This further simplifies the control flow and allows us to ditch the found local variable. v2: Clarify commit message (Javier) Signed-off-by: Daniel Vetter Reviewed-by: Javier Martinez Canillas Acked-by: Helge Deller Tested-by: Xingyuan Mo Fixes: b07db3958485 ("fbcon: Ditch error handling for con2fb_release_oldinfo") Cc: Thomas Zimmermann Cc: Sam Ravnborg Cc: Xingyuan Mo Cc: Thomas Zimmermann Cc: Helge Deller Cc: # v5.19+ commit 0646dc31ca886693274df5749cd0c8c1eaaeb5ca Author: Liang Chen Date: Thu Apr 13 17:03:53 2023 +0800 skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") allowed coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle --> false from->pp_recycle --> true skb_cloned(from) --> true However, it actually requires skb_cloned(@from) to hold true until coalescing finishes in this situation. If the other cloned SKB is released while the merging is in process, from_shinfo->nr_frags will be set to 0 toward the end of the function, causing the increment of frag page _refcount to be unexpectedly skipped resulting in inconsistent reference counts. Later when SKB(@to) is released, it frees the page directly even though the page pool page is still in use, leading to use-after-free or double-free errors. So it should be prohibited. The double-free error message below prompted us to investigate: BUG: Bad page state in process swapper/1 pfn:0e0d1 page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x2 pfn:0xe0d1 flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000 raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000 page dumped because: nonzero _refcount CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+ Call Trace: dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_pcp_prepare+0x260/0x2f0 free_unref_page+0x20/0x1c0 skb_release_data+0x10b/0x1a0 napi_consume_skb+0x56/0x150 net_rx_action+0xf0/0x350 ? __napi_schedule+0x79/0x90 __do_softirq+0xc8/0x2b1 __irq_exit_rcu+0xb9/0xf0 common_interrupt+0x82/0xa0 asm_common_interrupt+0x22/0x40 RIP: 0010:default_idle+0xb/0x20 Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool") Signed-off-by: Liang Chen Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230413090353.14448-1-liangchen.linux@gmail.com Signed-off-by: Jakub Kicinski commit e8b74453555872851bdd7ea43a7c0ec39659834f Author: Roman Gushchin Date: Wed Apr 12 16:21:44 2023 -0700 net: macb: fix a memory corruption in extended buffer descriptor mode For quite some time we were chasing a bug which looked like a sudden permanent failure of networking and mmc on some of our devices. The bug was very sensitive to any software changes and even more to any kernel debug options. Finally we got a setup where the problem was reproducible with CONFIG_DMA_API_DEBUG=y and it revealed the issue with the rx dma: [ 16.992082] ------------[ cut here ]------------ [ 16.996779] DMA-API: macb ff0b0000.ethernet: device driver tries to free DMA memory it has not allocated [device address=0x0000000875e3e244] [size=1536 bytes] [ 17.011049] WARNING: CPU: 0 PID: 85 at kernel/dma/debug.c:1011 check_unmap+0x6a0/0x900 [ 17.018977] Modules linked in: xxxxx [ 17.038823] CPU: 0 PID: 85 Comm: irq/55-8000f000 Not tainted 5.4.0 #28 [ 17.045345] Hardware name: xxxxx [ 17.049528] pstate: 60000005 (nZCv daif -PAN -UAO) [ 17.054322] pc : check_unmap+0x6a0/0x900 [ 17.058243] lr : check_unmap+0x6a0/0x900 [ 17.062163] sp : ffffffc010003c40 [ 17.065470] x29: ffffffc010003c40 x28: 000000004000c03c [ 17.070783] x27: ffffffc010da7048 x26: ffffff8878e38800 [ 17.076095] x25: ffffff8879d22810 x24: ffffffc010003cc8 [ 17.081407] x23: 0000000000000000 x22: ffffffc010a08750 [ 17.086719] x21: ffffff8878e3c7c0 x20: ffffffc010acb000 [ 17.092032] x19: 0000000875e3e244 x18: 0000000000000010 [ 17.097343] x17: 0000000000000000 x16: 0000000000000000 [ 17.102647] x15: ffffff8879e4a988 x14: 0720072007200720 [ 17.107959] x13: 0720072007200720 x12: 0720072007200720 [ 17.113261] x11: 0720072007200720 x10: 0720072007200720 [ 17.118565] x9 : 0720072007200720 x8 : 000000000000022d [ 17.123869] x7 : 0000000000000015 x6 : 0000000000000098 [ 17.129173] x5 : 0000000000000000 x4 : 0000000000000000 [ 17.134475] x3 : 00000000ffffffff x2 : ffffffc010a1d370 [ 17.139778] x1 : b420c9d75d27bb00 x0 : 0000000000000000 [ 17.145082] Call trace: [ 17.147524] check_unmap+0x6a0/0x900 [ 17.151091] debug_dma_unmap_page+0x88/0x90 [ 17.155266] gem_rx+0x114/0x2f0 [ 17.158396] macb_poll+0x58/0x100 [ 17.161705] net_rx_action+0x118/0x400 [ 17.165445] __do_softirq+0x138/0x36c [ 17.169100] irq_exit+0x98/0xc0 [ 17.172234] __handle_domain_irq+0x64/0xc0 [ 17.176320] gic_handle_irq+0x5c/0xc0 [ 17.179974] el1_irq+0xb8/0x140 [ 17.183109] xiic_process+0x5c/0xe30 [ 17.186677] irq_thread_fn+0x28/0x90 [ 17.190244] irq_thread+0x208/0x2a0 [ 17.193724] kthread+0x130/0x140 [ 17.196945] ret_from_fork+0x10/0x20 [ 17.200510] ---[ end trace 7240980785f81d6f ]--- [ 237.021490] ------------[ cut here ]------------ [ 237.026129] DMA-API: exceeded 7 overlapping mappings of cacheline 0x0000000021d79e7b [ 237.033886] WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:499 add_dma_entry+0x214/0x240 [ 237.041802] Modules linked in: xxxxx [ 237.061637] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 5.4.0 #28 [ 237.068941] Hardware name: xxxxx [ 237.073116] pstate: 80000085 (Nzcv daIf -PAN -UAO) [ 237.077900] pc : add_dma_entry+0x214/0x240 [ 237.081986] lr : add_dma_entry+0x214/0x240 [ 237.086072] sp : ffffffc010003c30 [ 237.089379] x29: ffffffc010003c30 x28: ffffff8878a0be00 [ 237.094683] x27: 0000000000000180 x26: ffffff8878e387c0 [ 237.099987] x25: 0000000000000002 x24: 0000000000000000 [ 237.105290] x23: 000000000000003b x22: ffffffc010a0fa00 [ 237.110594] x21: 0000000021d79e7b x20: ffffffc010abe600 [ 237.115897] x19: 00000000ffffffef x18: 0000000000000010 [ 237.121201] x17: 0000000000000000 x16: 0000000000000000 [ 237.126504] x15: ffffffc010a0fdc8 x14: 0720072007200720 [ 237.131807] x13: 0720072007200720 x12: 0720072007200720 [ 237.137111] x11: 0720072007200720 x10: 0720072007200720 [ 237.142415] x9 : 0720072007200720 x8 : 0000000000000259 [ 237.147718] x7 : 0000000000000001 x6 : 0000000000000000 [ 237.153022] x5 : ffffffc010003a20 x4 : 0000000000000001 [ 237.158325] x3 : 0000000000000006 x2 : 0000000000000007 [ 237.163628] x1 : 8ac721b3a7dc1c00 x0 : 0000000000000000 [ 237.168932] Call trace: [ 237.171373] add_dma_entry+0x214/0x240 [ 237.175115] debug_dma_map_page+0xf8/0x120 [ 237.179203] gem_rx_refill+0x190/0x280 [ 237.182942] gem_rx+0x224/0x2f0 [ 237.186075] macb_poll+0x58/0x100 [ 237.189384] net_rx_action+0x118/0x400 [ 237.193125] __do_softirq+0x138/0x36c [ 237.196780] irq_exit+0x98/0xc0 [ 237.199914] __handle_domain_irq+0x64/0xc0 [ 237.204000] gic_handle_irq+0x5c/0xc0 [ 237.207654] el1_irq+0xb8/0x140 [ 237.210789] arch_cpu_idle+0x40/0x200 [ 237.214444] default_idle_call+0x18/0x30 [ 237.218359] do_idle+0x200/0x280 [ 237.221578] cpu_startup_entry+0x20/0x30 [ 237.225493] rest_init+0xe4/0xf0 [ 237.228713] arch_call_rest_init+0xc/0x14 [ 237.232714] start_kernel+0x47c/0x4a8 [ 237.236367] ---[ end trace 7240980785f81d70 ]--- Lars was fast to find an explanation: according to the datasheet bit 2 of the rx buffer descriptor entry has a different meaning in the extended mode: Address [2] of beginning of buffer, or in extended buffer descriptor mode (DMA configuration register [28] = 1), indicates a valid timestamp in the buffer descriptor entry. The macb driver didn't mask this bit while getting an address and it eventually caused a memory corruption and a dma failure. The problem is resolved by explicitly clearing the problematic bit if hw timestamping is used. Fixes: 7b4296148066 ("net: macb: Add support for PTP timestamps in DMA descriptors") Signed-off-by: Roman Gushchin Co-developed-by: Lars-Peter Clausen Signed-off-by: Lars-Peter Clausen Acked-by: Nicolas Ferre Reviewed-by: Jacob Keller Link: https://lore.kernel.org/r/20230412232144.770336-1-roman.gushchin@linux.dev Signed-off-by: Jakub Kicinski commit 3a0385be133e7091cc9a9a998c7ec712bb9585db Author: Xin Long Date: Wed Apr 12 11:13:06 2023 -0400 selftests: add the missing CONFIG_IP_SCTP in net config The selftest sctp_vrf needs CONFIG_IP_SCTP set in config when building the kernel, so add it. Fixes: a61bd7b9fef3 ("selftests: add a selftest for sctp vrf") Reported-by: Naresh Kamboju Signed-off-by: Xin Long Reviewed-by: Sridhar Samudrala Link: https://lore.kernel.org/r/61dddebc4d2dd98fe7fb145e24d4b2430e42b572.1681312386.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 1c5950fc6fe996235f1d18539b9c6b64b597f50f Author: Eric Dumazet Date: Wed Apr 12 13:03:08 2023 +0000 udp6: fix potential access to stale information lena wang reported an issue caused by udpv6_sendmsg() mangling msg->msg_name and msg->msg_namelen, which are later read from ____sys_sendmsg() : /* * If this is sendmmsg() and sending to current destination address was * successful, remember it. */ if (used_address && err >= 0) { used_address->name_len = msg_sys->msg_namelen; if (msg_sys->msg_name) memcpy(&used_address->name, msg_sys->msg_name, used_address->name_len); } udpv6_sendmsg() wants to pretend the remote address family is AF_INET in order to call udp_sendmsg(). A fix would be to modify the address in-place, instead of using a local variable, but this could have other side effects. Instead, restore initial values before we return from udpv6_sendmsg(). Fixes: c71d8ebe7a44 ("net: Fix security_socket_sendmsg() bypass problem.") Reported-by: lena wang Signed-off-by: Eric Dumazet Reviewed-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20230412130308.1202254-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 306dc21361993f4fe50a15d4db6b1a4de5d0adb0 Author: Aaron Conole Date: Wed Apr 12 07:58:28 2023 -0400 selftests: openvswitch: adjust datapath NL message declaration The netlink message for creating a new datapath takes an array of ports for the PID creation. This shouldn't cause much issue but correct it for future cases where we need to do decode of datapath information that could include the per-cpu PID map. Fixes: 25f16c873fb1 ("selftests: add openvswitch selftest suite") Signed-off-by: Aaron Conole Link: https://lore.kernel.org/r/20230412115828.3991806-1-aconole@redhat.com Signed-off-by: Jakub Kicinski commit ecfcc6fbeb57c6b076cddba99f04c6e800b61dff Merge: 5b7be2d4fd6eb 711ae788cbbb8 Author: Jakub Kicinski Date: Thu Apr 13 09:59:00 2023 -0700 Merge branch 'mptcp-more-fixes-for-6-3' Matthieu Baerts says: ==================== mptcp: more fixes for 6.3 Patch 1 avoids scheduling the MPTCP worker on a closed socket on some edge cases. It fixes issues that can be visible from v5.11. Patch 2 makes sure the MPTCP worker doesn't try to manipulate disconnected sockets. This is also a fix for an issue that can be visible from v5.11. Patch 3 fixes a NULL pointer dereference when MPTCP FastOpen is used and an early fallback is done. A fix for v6.2. Patch 4 improves the stability of the userspace PM selftest for a subtest added in v6.2. ==================== Link: https://lore.kernel.org/r/20230411-upstream-net-20230411-mptcp-fixes-v1-0-ca540f3ef986@tessares.net Signed-off-by: Jakub Kicinski commit 711ae788cbbb82818531b55e32b09518ee09a11a Author: Matthieu Baerts Date: Tue Apr 11 22:42:12 2023 +0200 selftests: mptcp: userspace pm: uniform verify events Simply adding a "sleep" before checking something is usually not a good idea because the time that has been picked can not be enough or too much. The best is to wait for events with a timeout. In this selftest, 'sleep 0.5' is used more than 40 times. It is always used before calling a 'verify_*' function except for this verify_listener_events which has been added later. At the end, using all these 'sleep 0.5' seems to work: the slow CIs don't complain so far. Also because it doesn't take too much time, we can just add two more 'sleep 0.5' to uniform what is done before calling a 'verify_*' function. For the same reasons, we can also delay a bigger refactoring to replace all these 'sleep 0.5' by functions waiting for events instead of waiting for a fix time and hope for the best. Fixes: 6c73008aa301 ("selftests: mptcp: listener test for userspace PM") Cc: stable@vger.kernel.org Suggested-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit c0ff6f6da66a7791a32c0234388b1bdc00244917 Author: Paolo Abeni Date: Tue Apr 11 22:42:11 2023 +0200 mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock to the caller. The fastopen path does not cope with the above unconditionally dereferencing the subflow context. Fixes: 36b122baf6a8 ("mptcp: add subflow_v(4,6)_send_synack()") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit d6a0443733434408f2cbd4c53fea6910599bab9e Author: Paolo Abeni Date: Tue Apr 11 22:42:10 2023 +0200 mptcp: stricter state check in mptcp_worker As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: connect() // incoming reset + fastclose // the mptcp worker is scheduled mptcp_disconnect() // msk is now CLOSED listen() mptcp_worker() Leading to the following splat: divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018 RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcp_select_window net/ipv4/tcp_output.c:262 [inline] __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459 mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline] mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705 process_one_work+0x3bd/0x950 kernel/workqueue.c:2390 worker_thread+0x5b/0x610 kernel/workqueue.c:2537 kthread+0x138/0x170 kernel/kthread.c:376 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 This change addresses the issue explicitly checking for bad states before running the mptcp worker. Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch Link: https://github.com/multipath-tcp/mptcp_net-next/issues/374 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Tested-by: Christoph Paasch Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit a5cb752b125766524c921faab1a45cc96065b0a7 Author: Paolo Abeni Date: Tue Apr 11 22:42:09 2023 +0200 mptcp: use mptcp_schedule_work instead of open-coding it Beyond reducing code duplication this also avoids scheduling the mptcp_worker on a closed socket on some edge scenarios. The addressed issue is actually older than the blamed commit below, but this fix needs it as a pre-requisite. Fixes: ba8f48f7a4d7 ("mptcp: introduce mptcp_schedule_work") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit f8160d3b35fc94491bb0cb974dbda310ef96c0e2 Author: Gregor Herburger Date: Thu Apr 13 11:37:37 2023 +0200 i2c: ocores: generate stop condition after timeout in polling mode In polling mode, no stop condition is generated after a timeout. This causes SCL to remain low and thereby block the bus. If this happens during a transfer it can cause slaves to misinterpret the subsequent transfer and return wrong values. To solve this, pass the ETIMEDOUT error up from ocores_process_polling() instead of setting STATE_ERROR directly. The caller is adjusted to call ocores_process_timeout() on error both in polling and in IRQ mode, which will set STATE_ERROR and generate a stop condition. Fixes: 69c8c0c0efa8 ("i2c: ocores: add polling interface") Signed-off-by: Gregor Herburger Signed-off-by: Matthias Schiffer Acked-by: Peter Korsgaard Reviewed-by: Andrew Lunn Reviewed-by: Federico Vaga Signed-off-by: Wolfram Sang commit aca3b0fa3d04b40c96934d86cc224cccfa7ea8e0 Author: Saravanan Vajravel Date: Fri Mar 31 23:34:24 2023 -0700 RDMA/core: Fix GID entry ref leak when create_ah fails If AH create request fails, release sgid_attr to avoid GID entry referrence leak reported while releasing GID table Fixes: 1a1f460ff151 ("RDMA: Hold the sgid_attr inside the struct ib_ah/qp") Link: https://lore.kernel.org/r/20230401063424.342204-1-saravanan.vajravel@broadcom.com Reviewed-by: Selvin Xavier Signed-off-by: Saravanan Vajravel Signed-off-by: Jason Gunthorpe commit c8bc34660628769f71e8b230144a2a4d86ab0f91 Author: David Howells Date: Thu Apr 13 14:51:56 2023 +0100 sunrpc: Fix RFC6803 encryption test The usage_data[] array in rfc6803_encrypt_case() is uninitialised, so clear it as it may cause the tests to fail otherwise. Fixes: b958cff6b27b ("SUNRPC: Add encryption KUnit tests for the RFC 6803 encryption types") Link: https://lore.kernel.org/r/380323.1681314997@warthog.procyon.org.uk/ Signed-off-by: David Howells cc: Chuck Lever cc: Scott Mayhew cc: Herbert Xu cc: linux-nfs@vger.kernel.org cc: linux-crypto@vger.kernel.org Signed-off-by: Chuck Lever commit 775d3c514c5b2763a50ab7839026d7561795924d Author: Matija Glavinic Pecotic Date: Thu Apr 6 08:26:52 2023 +0200 x86/rtc: Remove __init for runtime functions set_rtc_noop(), get_rtc_noop() are after booting, therefore their __init annotation is wrong. A crash was observed on an x86 platform where CMOS RTC is unused and disabled via device tree. set_rtc_noop() was invoked from ntp: sync_hw_clock(), although CONFIG_RTC_SYSTOHC=n, however sync_cmos_clock() doesn't honour that. Workqueue: events_power_efficient sync_hw_clock RIP: 0010:set_rtc_noop Call Trace: update_persistent_clock64 sync_hw_clock Fix this by dropping the __init annotation from set/get_rtc_noop(). Fixes: c311ed6183f4 ("x86/init: Allow DT configured systems to disable RTC at boot time") Signed-off-by: Matija Glavinic Pecotic Signed-off-by: Thomas Gleixner Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/59f7ceb1-446b-1d3d-0bc8-1f0ee94b1e18@nokia.com commit a552b73f36cb3e59fd2015307fde8ff53874d1af Merge: 62b92afd6e253 6b8446859c971 Author: Daniel Vetter Date: Thu Apr 13 14:24:44 2023 +0200 Merge tag 'drm-intel-fixes-2023-04-13' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.3-rc7: - Fix dual link DSI for TGL+ Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/877cugckzu.fsf@intel.com commit 5b7be2d4fd6eb8bec14c2de96c664e07c7d0bd82 Author: Vladimir Oltean Date: Tue Apr 11 22:26:45 2023 +0300 net: enetc: workaround for unresponsive pMAC after receiving express traffic I have observed an issue where the RX direction of the LS1028A ENETC pMAC seems unresponsive. The minimal procedure to reproduce the issue is: 1. Connect ENETC port 0 with a loopback RJ45 cable to one of the Felix switch ports (0). 2. Bring the ports up (MAC Merge layer is not enabled on either end). 3. Send a large quantity of unidirectional (express) traffic from Felix to ENETC. I tried altering frame size and frame count, and it doesn't appear to be specific to either of them, but rather, to the quantity of octets received. Lowering the frame count, the minimum quantity of packets to reproduce relatively consistently seems to be around 37000 frames at 1514 octets (w/o FCS) each. 4. Using ethtool --set-mm, enable the pMAC in the Felix and in the ENETC ports, in both RX and TX directions, and with verification on both ends. 5. Wait for verification to complete on both sides. 6. Configure a traffic class as preemptible on both ends. 7. Send some packets again. The issue is at step 5, where the verification process of ENETC ends (meaning that Felix responds with an SMD-R and ENETC sees the response), but the verification process of Felix never ends (it remains VERIFYING). If step 3 is skipped or if ENETC receives less traffic than approximately that threshold, the test runs all the way through (verification succeeds on both ends, preemptible traffic passes fine). If, between step 4 and 5, the step below is also introduced: 4.1. Disable and re-enable PM0_COMMAND_CONFIG bit RX_EN then again, the sequence of steps runs all the way through, and verification succeeds, even if there was the previous RX traffic injected into ENETC. Traffic sent *by* the ENETC port prior to enabling the MAC Merge layer does not seem to influence the verification result, only received traffic does. The LS1028A manual does not mention any relationship between PM0_COMMAND_CONFIG and MMCSR, and the hardware people don't seem to know for now either. The bit that is toggled to work around the issue is also toggled by enetc_mac_enable(), called from phylink's mac_link_down() and mac_link_up() methods - which is how the workaround was found: verification would work after a link down/up. Fixes: c7b9e8086902 ("net: enetc: add support for MAC Merge layer") Signed-off-by: Vladimir Oltean Reviewed-by: Jacob Keller Link: https://lore.kernel.org/r/20230411192645.1896048-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 32832a2caf82663870126c5186cf8f86c8b2a649 Author: Xin Long Date: Mon Apr 10 15:43:30 2023 -0400 sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference it as struct sctp_ifwdtsn_skip may cause coverflow. This patch fixes it by checking the pos against "the end of the chunk - sizeof(struct sctp_ifwdtsn_skip)" in sctp_ifwdtsn_skip, similar to sctp_fwdtsn_skip. Fixes: 0fc2ea922c8a ("sctp: implement validate_ftsn for sctp_stream_interleave") Signed-off-by: Xin Long Link: https://lore.kernel.org/r/2a71bffcd80b4f2c61fac6d344bb2f11c8fd74f7.1681155810.git.lucien.xin@gmail.com Signed-off-by: Paolo Abeni commit 62b92afd6e253fab3b4cf1bbb614e270a848e98f Merge: 09a9639e56c01 b9a24d8bd51e2 Author: Daniel Vetter Date: Thu Apr 13 09:57:19 2023 +0200 Merge tag 'amd-drm-fixes-6.3-2023-04-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.3-2023-04-12: amdgpu: - SMU13 fixes - DP MST fix Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230412215637.7881-1-alexander.deucher@amd.com commit 6417070918de3bcdbe0646e7256dae58fd8083ba Author: Ziyang Xuan Date: Mon Apr 10 09:23:52 2023 +0800 net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230 qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230 qrtr_endpoint_post+0xf85/0x11b0 net/qrtr/af_qrtr.c:519 qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline] __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 __netdev_alloc_skb+0x120/0x7d0 net/core/skbuff.c:630 qrtr_endpoint_post+0xbd/0x11b0 net/qrtr/af_qrtr.c:446 qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because that skb->len requires at least sizeof(struct qrtr_ctrl_pkt) in qrtr_tx_resume(). And skb->len equals to size in qrtr_endpoint_post(). But size is less than sizeof(struct qrtr_ctrl_pkt) when qrtr_cb->type equals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() under the syzbot scenario. This triggers the uninit variable access bug. Add size check when qrtr_cb->type equals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() to fix the bug. Fixes: 5fdeb0d372ab ("net: qrtr: Implement outgoing flow control") Reported-by: syzbot+4436c9630a45820fda76@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=c14607f0963d27d5a3d5f4c8639b500909e43540 Suggested-by: Manivannan Sadhasivam Signed-off-by: Ziyang Xuan Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230410012352.3997823-1-william.xuanziyang@huawei.com Signed-off-by: Paolo Abeni commit 8eda19cd59cedbfe4ec11aea4bcecabe4c98e9e4 Author: Stefan Binding Date: Wed Apr 12 17:05:31 2023 +0100 ALSA: hda/realtek: Add quirks for Lenovo Z13/Z16 Gen2 These Lenovo laptops use Realtek HDA codec combined with 2xCS35L41 Amplifiers using I2C with External Boost. Signed-off-by: Stefan Binding Cc: Link: https://lore.kernel.org/r/20230412160531.182007-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 59d3efd27c11c59b32291e5ebc307bed2edb65ee Author: Martin Willi Date: Tue Apr 11 09:43:19 2023 +0200 rtnetlink: Restore RTM_NEW/DELLINK notification behavior The commits referenced below allows userspace to use the NLM_F_ECHO flag for RTM_NEW/DELLINK operations to receive unicast notifications for the affected link. Prior to these changes, applications may have relied on multicast notifications to learn the same information without specifying the NLM_F_ECHO flag. For such applications, the mentioned commits changed the behavior for requests not using NLM_F_ECHO. Multicast notifications are still received, but now use the portid of the requester and the sequence number of the request instead of zero values used previously. For the application, this message may be unexpected and likely handled as a response to the NLM_F_ACKed request, especially if it uses the same socket to handle requests and notifications. To fix existing applications relying on the old notification behavior, set the portid and sequence number in the notification only if the request included the NLM_F_ECHO flag. This restores the old behavior for applications not using it, but allows unicasted notifications for others. Fixes: f3a63cce1b4f ("rtnetlink: Honour NLM_F_ECHO flag in rtnl_delete_link") Fixes: d88e136cab37 ("rtnetlink: Honour NLM_F_ECHO flag in rtnl_newlink_create") Signed-off-by: Martin Willi Acked-by: Guillaume Nault Acked-by: Hangbin Liu Link: https://lore.kernel.org/r/20230411074319.24133-1-martin@strongswan.org Signed-off-by: Jakub Kicinski commit de4664485abbc0529b1eec44d0061bbfe58a28fb Merge: b05e0f5e74e48 38518593ec55e Author: Linus Torvalds Date: Wed Apr 12 17:26:00 2023 -0700 Merge tag 'for-linus-2023041201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - kernel panic fix for intel-ish-hid driver (Tanu Malhotra) - buffer overflow fix in hid-sensor-custom driver (Todd Brandt) - two device specific quirks (Alessandro Manca, Philippe Troin) * tag 'for-linus-2023041201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: intel-ish-hid: Fix kernel panic during warm reset HID: hid-sensor-custom: Fix buffer overrun in device name HID: topre: Add support for 87 keys Realforce R2 HID: add HP 13t-aw100 & 14t-ea100 digitizer battery quirks commit b05e0f5e74e48a3e39066794fc1d7df37507953d Merge: 0bcc402555040 d9503be5a100c Author: Linus Torvalds Date: Wed Apr 12 17:20:55 2023 -0700 Merge tag 'dmaengine-fix-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: "A couple of fixes in apple driver, core and kernedoc fix for dmaengine subsystem: - apple admac driver fixes for current_tx, src_addr_widths and global' interrupt flags handling - xdma kerneldoc fix - core fix for use of devm_add_action_or_reset" * tag 'dmaengine-fix-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: apple-admac: Fix 'current_tx' not getting freed dmaengine: apple-admac: Set src_addr_widths capability dmaengine: apple-admac: Handle 'global' interrupt flags dmaengine: xilinx: xdma: Fix some kernel-doc comments dmaengine: Actually use devm_add_action_or_reset() commit b9a24d8bd51e2db425602fa82d7f4c06aa3db852 Author: Evan Quan Date: Fri Apr 7 17:12:15 2023 +0800 drm/amd/pm: correct the pcie link state check for SMU13 Update the driver implementations to fit those data exposed by PMFW. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 85e0689eb6b10cd3b2fb455d1b3f4d4d0b13ff78 Author: Horatio Zhang Date: Thu Apr 6 13:32:14 2023 +0800 drm/amd/pm: correct SMU13.0.7 max shader clock reporting Correct the max shader clock reporting on SMU 13.0.7. Signed-off-by: Horatio Zhang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit f06b8887e3ef4f50098d3a949aef392c529c831a Author: Horatio Zhang Date: Thu Apr 6 11:17:38 2023 +0800 drm/amd/pm: correct SMU13.0.7 pstate profiling clock settings Correct the pstate standard/peak profiling mode clock settings for SMU13.0.7. Signed-off-by: Horatio Zhang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit b8ca445f550a9a079134f836466ddda3bfad6108 Author: Wayne Lin Date: Fri Feb 17 13:26:56 2023 +0800 drm/amd/display: Pass the right info to drm_dp_remove_payload [Why & How] drm_dp_remove_payload() interface was changed. Correct amdgpu dm code to pass the right parameter to the drm helper function. Reviewed-by: Jerry Zuo Acked-by: Qingqing Zhuo Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 7e27cb6ad4d85fc8bac2a2a896da62ef66b8598e Author: Waiman Long Date: Tue Apr 11 09:36:00 2023 -0400 cgroup/cpuset: Make cpuset_attach_task() skip subpartitions CPUs for top_cpuset It is found that attaching a task to the top_cpuset does not currently ignore CPUs allocated to subpartitions in cpuset_attach_task(). So the code is changed to fix that. Signed-off-by: Waiman Long Reviewed-by: Michal Koutný Signed-off-by: Tejun Heo commit eee87853794187f6adbe19533ed79c8b44b36a91 Author: Waiman Long Date: Tue Apr 11 09:35:59 2023 -0400 cgroup/cpuset: Add cpuset_can_fork() and cpuset_cancel_fork() methods In the case of CLONE_INTO_CGROUP, not all cpusets are ready to accept new tasks. It is too late to check that in cpuset_fork(). So we need to add the cpuset_can_fork() and cpuset_cancel_fork() methods to pre-check it before we can allow attachment to a different cpuset. We also need to set the attach_in_progress flag to alert other code that a new task is going to be added to the cpuset. Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups") Suggested-by: Michal Koutný Signed-off-by: Waiman Long Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Tejun Heo commit 42a11bf5c5436e91b040aeb04063be1710bb9f9c Author: Waiman Long Date: Tue Apr 11 09:35:58 2023 -0400 cgroup/cpuset: Make cpuset_fork() handle CLONE_INTO_CGROUP properly By default, the clone(2) syscall spawn a child process into the same cgroup as its parent. With the use of the CLONE_INTO_CGROUP flag introduced by commit ef2c41cf38a7 ("clone3: allow spawning processes into cgroups"), the child will be spawned into a different cgroup which is somewhat similar to writing the child's tid into "cgroup.threads". The current cpuset_fork() method does not properly handle the CLONE_INTO_CGROUP case where the cpuset of the child may be different from that of its parent. Update the cpuset_fork() method to treat the CLONE_INTO_CGROUP case similar to cpuset_attach(). Since the newly cloned task has not been running yet, its actual memory usage isn't known. So it is not necessary to make change to mm in cpuset_fork(). Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups") Reported-by: Giuseppe Scrivano Signed-off-by: Waiman Long Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Tejun Heo commit ba9182a89626d5f83c2ee4594f55cb9c1e60f0e2 Author: Waiman Long Date: Tue Apr 11 09:35:57 2023 -0400 cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() After a successful cpuset_can_attach() call which increments the attach_in_progress flag, either cpuset_cancel_attach() or cpuset_attach() will be called later. In cpuset_attach(), tasks in cpuset_attach_wq, if present, will be woken up at the end. That is not the case in cpuset_cancel_attach(). So missed wakeup is possible if the attach operation is somehow cancelled. Fix that by doing the wakeup in cpuset_cancel_attach() as well. Fixes: e44193d39e8d ("cpuset: let hotplug propagation work wait for task attaching") Signed-off-by: Waiman Long Reviewed-by: Michal Koutný Cc: stable@vger.kernel.org # v3.11+ Signed-off-by: Tejun Heo commit 57dcd64c7e036299ef526b400a8d12b8a2352f26 Author: Tetsuo Handa Date: Wed Apr 5 22:15:32 2023 +0900 cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex syzbot is reporting circular locking dependency between cpu_hotplug_lock and freezer_mutex, for commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") replaced atomic_inc() in freezer_apply_state() with static_branch_inc() which holds cpu_hotplug_lock. cpu_hotplug_lock => cgroup_threadgroup_rwsem => freezer_mutex cgroup_file_write() { cgroup_procs_write() { __cgroup_procs_write() { cgroup_procs_write_start() { cgroup_attach_lock() { cpus_read_lock() { percpu_down_read(&cpu_hotplug_lock); } percpu_down_write(&cgroup_threadgroup_rwsem); } } cgroup_attach_task() { cgroup_migrate() { cgroup_migrate_execute() { freezer_attach() { mutex_lock(&freezer_mutex); (...snipped...) } } } } (...snipped...) } } } freezer_mutex => cpu_hotplug_lock cgroup_file_write() { freezer_write() { freezer_change_state() { mutex_lock(&freezer_mutex); freezer_apply_state() { static_branch_inc(&freezer_active) { static_key_slow_inc() { cpus_read_lock(); static_key_slow_inc_cpuslocked(); cpus_read_unlock(); } } } mutex_unlock(&freezer_mutex); } } } Swap locking order by moving cpus_read_lock() in freezer_apply_state() to before mutex_lock(&freezer_mutex) in freezer_change_state(). Reported-by: syzbot Link: https://syzkaller.appspot.com/bug?extid=c39682e86c9d84152f93 Suggested-by: Hillf Danton Fixes: f5d39b020809 ("freezer,sched: Rewrite core freezer logic") Signed-off-by: Tetsuo Handa Acked-by: Peter Zijlstra (Intel) Reviewed-by: Mukesh Ojha Signed-off-by: Tejun Heo commit 0bcc4025550403ae28d2984bddacafbca0a2f112 Author: David Howells Date: Wed Apr 12 13:18:57 2023 +0100 netfs: Fix netfs_extract_iter_to_sg() for ITER_UBUF/IOVEC Fix netfs_extract_iter_to_sg() for ITER_UBUF and ITER_IOVEC to set the size of the page to the part of the page extracted, not the remaining amount of data in the extracted page array at that point. This doesn't yet affect anything as cifs, the only current user, only passes in non-user-backed iterators. Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist") Signed-off-by: David Howells Reviewed-by: Jeff Layton Cc: Steve French Cc: Shyam Prasad N Cc: Rohith Surabattula Signed-off-by: Linus Torvalds commit 91dcf1e8068e9a8823e419a7a34ff4341275fb70 Author: Vincent Guittot Date: Tue Apr 11 11:06:11 2023 +0200 sched/fair: Fix imbalance overflow When local group is fully busy but its average load is above system load, computing the imbalance will overflow and local group is not the best target for pulling this load. Fixes: 0b0695f2b34a ("sched/fair: Rework load_balance()") Reported-by: Tingjia Cao Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Tested-by: Tingjia Cao Link: https://lore.kernel.org/lkml/CABcWv9_DAhVBOq2=W=2ypKE9dKM5s2DvoV8-U0+GDwwuKZ89jQ@mail.gmail.com/T/ commit 5603effb8295ada8419408d038a34ca89d658229 Merge: b89ce1177d42d 09a9639e56c01 Author: Maarten Lankhorst Date: Wed Apr 12 12:01:32 2023 +0200 Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes We were stuck on rc2, should at least attempt to track drm-fixes slightly. Signed-off-by: Maarten Lankhorst commit 136f36c74b0345d5d0087d4094894a006470bbd5 Author: Rob Herring Date: Mon Apr 10 18:27:19 2023 -0500 net: ti/cpsw: Add explicit platform_device.h and of_platform.h includes TI CPSW uses of_platform_* functions which are declared in of_platform.h. of_platform.h gets implicitly included by of_device.h, but that is going to be removed soon. Nothing else depends on of_device.h so it can be dropped. of_platform.h also implicitly includes platform_device.h, so add an explicit include for it, too. Signed-off-by: Rob Herring Reviewed-by: Jesse Brandeburg Signed-off-by: David S. Miller commit a56ef25619e079bd7d744636cf18d054d1e91982 Author: Harshit Mogalapalli Date: Sat Apr 8 12:43:21 2023 -0700 net: wwan: iosm: Fix error handling path in ipc_pcie_probe() Smatch reports: drivers/net/wwan/iosm/iosm_ipc_pcie.c:298 ipc_pcie_probe() warn: missing unwind goto? When dma_set_mask fails it directly returns without disabling pci device and freeing ipc_pcie. Fix this my calling a correct goto label As dma_set_mask returns either 0 or -EIO, we can use a goto label, as it finally returns -EIO. Add a set_mask_fail goto label which stands consistent with other goto labels in this function.. Fixes: 035e3befc191 ("net: wwan: iosm: fix driver not working with INTEL_IOMMU disabled") Reviewed-by: Simon Horman Signed-off-by: Harshit Mogalapalli Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 9744d2bf19762703704ecba885b7ac282c02eacf Author: Kuniyuki Iwashima Date: Sat Apr 8 11:49:43 2023 -0700 smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC creates a kernel socket in __smc_create(), the kernel socket is supposed to be freed in smc_clcsock_release() by calling sock_release() when we close() the parent SMC socket. However, at the end of smc_clcsock_release(), the kernel socket's sk_state might not be TCP_CLOSE. This means that we have not called inet_csk_destroy_sock() in __tcp_close() and have not stopped the TCP timers. The kernel socket's TCP timers can be fired later, so we need to hold a refcnt for net as we do for MPTCP subflows in mptcp_subflow_create_socket(). [0]: leaked reference. sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108) inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244) __sock_create (net/socket.c:1546) smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284) __sock_create (net/socket.c:1546) __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661) __x64_sys_socket (net/socket.c:1672) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) ================================================================== BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091 CPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 Call Trace: dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) kasan_report (mm/kasan/report.c:538) tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643) call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022) run_timer_softirq (kernel/time/timer.c:2037) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650) irq_exit_rcu (kernel/softirq.c:664) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14)) Fixes: ac7138746e14 ("smc: establish new socket family") Reported-by: syzbot+7e1e1bdb852961150198@syzkaller.appspotmail.com Link: https://lore.kernel.org/netdev/000000000000a3f51805f8bcc43a@google.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 7573099e10ca69c3be33995c1fcd0d241226816d Author: Denis Plotnikov Date: Fri Apr 7 10:18:49 2023 +0300 qlcnic: check pci_reset_function result Static code analyzer complains to unchecked return value. The result of pci_reset_function() is unchecked. Despite, the issue is on the FLR supported code path and in that case reset can be done with pcie_flr(), the patch uses less invasive approach by adding the result check of pci_reset_function(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7e2cf4feba05 ("qlcnic: change driver hardware interface mechanism") Signed-off-by: Denis Plotnikov Reviewed-by: Simon Horman Reviewed-by: Bjorn Helgaas Signed-off-by: David S. Miller commit adacf21f1c9a65e299a103f78b3e6dd71c5ec99b Merge: 160c13175e392 9c85b7fa12ef2 Author: Jakub Kicinski Date: Tue Apr 11 21:37:53 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== iavf: fix racing in VLANs Ahmed Zaki says: This patchset mainly fixes a racing issue in the iavf where the number of VLANs in the vlan_filter_list might be more than the PF limit. To fix that, we get rid of the cvlans and svlans bitmaps and keep all the required info in the list. The second patch adds two new states that are needed so that we keep the VLAN info while the interface goes DOWN: -- DISABLE (notify PF, but keep the filter in the list) -- INACTIVE (dev is DOWN, filter is removed from PF) Finally, the current code keeps each state in a separate bit field, which is error prone. The first patch refactors that by replacing all bits with a single enum. The changes are minimal where each bit change is replaced with the new state value. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: remove active_cvlans and active_svlans bitmaps iavf: refactor VLAN filter states ==================== Link: https://lore.kernel.org/r/20230407210730.3046149-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 160c13175e392961fd18a9fdb89e5425b3ac7099 Merge: a4506722dc39c a2a9339e1c9de Author: Jakub Kicinski Date: Tue Apr 11 21:18:23 2023 -0700 Merge tag 'for-net-2023-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix not setting Dath Path for broadcast sink - Fix not cleaning up on LE Connection failure - SCO: Fix possible circular locking dependency - L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} - Fix race condition in hidp_session_thread - btbcm: Fix logic error in forming the board name - btbcm: Fix use after free in btsdio_remove * tag 'for-net-2023-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Bluetooth: Set ISO Data Path on broadcast sink Bluetooth: hci_conn: Fix possible UAF Bluetooth: SCO: Fix possible circular locking dependency sco_sock_getsockopt Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm bluetooth: btbcm: Fix logic error in forming the board name. Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition Bluetooth: Fix race condition in hidp_session_thread Bluetooth: Fix printing errors if LE Connection times out Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure ==================== Link: https://lore.kernel.org/r/20230410172718.4067798-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit c8e22b7a1694bb8d025ea636816472739d859145 Author: Jiri Kosina Date: Tue Apr 4 21:23:42 2023 +0200 scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui . Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely scsi 2:0:0:254: enclosure has no enumerated components scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such even on valid configurations with 1 primary and 0 secondary enclosures as below: # sg_ses /dev/sg0 3PARdata SES 3321 Supported diagnostic pages: Supported Diagnostic Pages [sdp] [0x0] Configuration (SES) [cf] [0x1] Short Enclosure Status (SES) [ses] [0x8] # sg_ses -p cf /dev/sg0 3PARdata SES 3321 Configuration diagnostic page: number of secondary subenclosures: 0 generation code: 0x0 enclosure descriptor list Subenclosure identifier: 0 [primary] relative ES process id: 0, number of ES processes: 1 number of type descriptor headers: 1 enclosure logical identifier (hex): 20000002ac02068d enclosure vendor: 3PARdata product: VV rev: 3321 type descriptor header and text list Element type: Unspecified, subenclosure id: 0 number of possible elements: 1 The changelog for the original fix follows ===== We can get a crash when disconnecting the iSCSI session, the call trace like this: [ffff00002a00fb70] kfree at ffff00000830e224 [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4 [ffff00002a00fbd0] device_del at ffff0000086b6a98 [ffff00002a00fc50] device_unregister at ffff0000086b6d58 [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c [ffff00002a00fca0] scsi_remove_device at ffff000008706134 [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4 [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0 [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4 [ffff00002a00fdb0] process_one_work at ffff00000810f35c [ffff00002a00fe00] worker_thread at ffff00000810f648 [ffff00002a00fe70] kthread at ffff000008116e98 In ses_intf_add, components count could be 0, and kcalloc 0 size scomp, but not saved in edev->component[i].scratch In this situation, edev->component[0].scratch is an invalid pointer, when kfree it in ses_intf_remove_enclosure, a crash like above would happen The call trace also could be other random cases when kfree cannot catch the invalid pointer We should not use edev->component[] array when the components count is 0 We also need check index when use edev->component[] array in ses_enclosure_data_process ===== Reported-by: Michal Kolar Originally-by: Ding Hui Cc: stable@vger.kernel.org Fixes: 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") Signed-off-by: Jiri Kosina Link: https://lore.kernel.org/r/nycvar.YFH.7.76.2304042122270.29760@cbobk.fhfr.pm Tested-by: Michal Kolar Signed-off-by: Martin K. Petersen commit 534e465845ebfb4a97eb5459d3931a0b35e3b9a5 Author: Kornel Dulęba Date: Tue Apr 11 13:49:32 2023 +0000 Revert "pinctrl: amd: Disable and mask interrupts on resume" This reverts commit b26cd9325be4c1fcd331b77f10acb627c560d4d7. This patch introduces a regression on Lenovo Z13, which can't wake from the lid with it applied; and some unspecified AMD based Dell platforms are unable to wake from hitting the power button Signed-off-by: Kornel Dulęba Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20230411134932.292287-1-korneld@chromium.org Signed-off-by: Linus Walleij commit 8d736482749f6d350892ef83a7a11d43cd49981e Author: Mathis Salmen Date: Thu Apr 6 12:11:31 2023 +0200 riscv: add icache flush for nommu sigreturn trampoline In a NOMMU kernel, sigreturn trampolines are generated on the user stack by setup_rt_frame. Currently, these trampolines are not instruction fenced, thus their visibility to ifetch is not guaranteed. This patch adds a flush_icache_range in setup_rt_frame to fix this problem. Signed-off-by: Mathis Salmen Fixes: 6bd33e1ece52 ("riscv: add nommu support") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230406101130.82304-1-mathis.salmen@matsal.de Signed-off-by: Palmer Dabbelt commit 1a50d9403fb90cbe4dea0ec9fd0351d2ecbd8924 Author: Geert Uytterhoeven Date: Thu Mar 30 15:26:13 2023 +0200 treewide: Fix probing of devices in DT overlays When loading a DT overlay that creates a device, the device is not probed, unless the DT overlay is unloaded and reloaded again. After the recent refactoring to improve fw_devlink, it no longer depends on the "compatible" property to identify which device tree nodes will become struct devices. fw_devlink now picks up dangling consumers (consumers pointing to descendent device tree nodes of a device that aren't converted to child devices) when a device is successfully bound to a driver. See __fw_devlink_pickup_dangling_consumers(). However, during DT overlay, a device's device tree node can have sub-nodes added/removed without unbinding/rebinding the driver. This difference in behavior between the normal device instantiation and probing flow vs. the DT overlay flow has a bunch of implications that are pointed out elsewhere[1]. One of them is that the fw_devlink logic to pick up dangling consumers is never exercised. This patch solves the fw_devlink issue by marking all DT nodes added by DT overlays with FWNODE_FLAG_NOT_DEVICE (fwnode that won't become device), and by clearing the flag when a struct device is actually created for the DT node. This way, fw_devlink knows not to have consumers waiting on these newly added DT nodes, and to propagate the dependency to an ancestor DT node that has the corresponding struct device. Based on a patch by Saravana Kannan, which covered only platform and spi devices. [1] https://lore.kernel.org/r/CAGETcx_bkuFaLCiPrAWCPQz+w79ccDp6=9e881qmK=vx3hBMyg@mail.gmail.com Fixes: 4a032827daa89350 ("of: property: Simplify of_link_to_phandle()") Link: https://lore.kernel.org/r/CAGETcx_+rhHvaC_HJXGrr5_WAd2+k5f=rWYnkCZ6z5bGX-wj4w@mail.gmail.com Signed-off-by: Geert Uytterhoeven Acked-by: Mark Brown Acked-by: Wolfram Sang # for I2C Acked-by: Shawn Guo Acked-by: Saravana Kannan Tested-by: Ivan Bornyakov Link: https://lore.kernel.org/r/e1fa546682ea4c8474ff997ab6244c5e11b6f8bc.1680182615.git.geert+renesas@glider.be Signed-off-by: Rob Herring commit e87245045b2b23e6dae3406c30b11cd8429eb061 Author: Liu Peibao Date: Sat Apr 1 17:13:04 2023 +0800 dt-bindings: interrupt-controller: loongarch: Fix mismatched compatible The "compatible" doesn't match what the kernel is using. Fix it as kernel using. Fixes: 6b2748ada244 ("dt-bindings: interrupt-controller: add yaml for LoongArch CPU interrupt controller") Reported-by: Rob Herring Link: https://lore.kernel.org/all/20221208020954.GA3368836-robh@kernel.org/ Acked-by: Krzysztof Kozlowski Signed-off-by: Liu Peibao Link: https://lore.kernel.org/r/20230401091304.12633-1-liupeibao@loongson.cn [robh: Rename file to match compatible, fix subject typo] Signed-off-by: Rob Herring commit 2ce987d7eeb168b749494694ae3666de87fc356e Author: William Breathitt Gray Date: Mon Apr 3 13:53:14 2023 -0400 gpio: 104-idi-48: Enable use_raw_spinlock for idi48_regmap_config The idi48 regmap can be used in an interrupt context by regmap-irq. To prevent a deadlock, enable use_raw_spinlock for idi48_regmap_config. Fixes: e28432a77365 ("gpio: 104-idi-48: Migrate to the regmap-irq API") Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 01407940f9cd3bd87f3b707f7175f6f41ac1238b Author: William Breathitt Gray Date: Mon Apr 3 13:53:13 2023 -0400 gpio: 104-dio-48e: Enable use_raw_spinlock for dio48e_regmap_config The dio48e regmap can be used in an interrupt context by regmap-irq. To prevent a deadlock, enable use_raw_spinlock for dio48e_regmap_config. Fixes: 2f7e845f512f ("gpio: 104-dio-48e: Migrate to the regmap-irq API") Signed-off-by: William Breathitt Gray Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit e62252bc55b6d4eddc6c2bdbf95a448180d6a08d Merge: 2c40519251d61 30ba2d09edb5e Author: Linus Torvalds Date: Tue Apr 11 11:59:49 2023 -0700 Merge tag 'pci-v6.3-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Provide pci_msix_can_alloc_dyn() stub when CONFIG_PCI_MSI unset to avoid build errors (Reinette Chatre) - Quirk AMD XHCI controller that loses MSI-X state in D3hot to avoid broken USB after hotplug or suspend/resume (Basavaraj Natikar) - Fix use-after-free in pci_bus_release_domain_nr() (Rob Herring) * tag 'pci-v6.3-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Fix use-after-free in pci_bus_release_domain_nr() x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot PCI/MSI: Provide missing stub for pci_msix_can_alloc_dyn() commit 05cda427126f30ce3fc8ffd82fd6f5196398d502 Author: Paul Menzel Date: Tue Apr 11 20:31:44 2023 +0200 ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Like the ASUS ExpertBook B2502CBA and various ASUS Vivobook laptops, the ASUS ExpertBook B1502CBA has an ACPI DSDT table that describes IRQ 1 as ActiveLow while the kernel overrides it to Edge_High. $ sudo dmesg | grep DMI DMI: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B1502CBA_B1502CBA/B1502CBA, BIOS B1502CBA.300 01/18/2023 $ grep -A 40 PS2K dsdt.dsl | grep IRQ -A 1 IRQ (Level, ActiveLow, Exclusive, ) {1} This prevents the keyboard from working. To fix this issue, add this laptop to the skip_override_table so that the kernel does not override IRQ 1. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217323 Signed-off-by: Paul Menzel Signed-off-by: Rafael J. Wysocki commit 4654e9f9f43993eb9ce383fa7c88d14b052b8cc3 Author: Wyes Karny Date: Thu Mar 30 14:13:14 2023 +0000 amd-pstate: Fix amd_pstate mode switch amd_pstate mode can be changed by writing the mode name to the `status` sysfs. But some combinations are not working. Fix this issue by taking care of the edge cases. Before the fix the mode change combination test fails: #./pst_test.sh Test passed: from: disable, to Test passed: from: disable, to disable Test failed: 1, From mode: disable, to mode: passive Test failed: 1, From mode: disable, to mode: active Test failed: 1, From mode: passive, to mode: active Test passed: from: passive, to disable Test failed: 1, From mode: passive, to mode: passive Test failed: 1, From mode: passive, to mode: active Test failed: 1, From mode: active, to mode: active Test passed: from: active, to disable Test failed: 1, From mode: active, to mode: passive Test failed: 1, From mode: active, to mode: active After the fix test passes: #./pst_test.sh Test passed: from: disable, to Test passed: from: disable, to disable Test passed: from: disable, to passive Test passed: from: disable, to active Test passed: from: passive, to active Test passed: from: passive, to disable Test passed: from: passive, to passive Test passed: from: passive, to active Test passed: from: active, to active Test passed: from: active, to disable Test passed: from: active, to passive Test passed: from: active, to active Fixes: abd61c08ef349 ("cpufreq: amd-pstate: add driver working mode switch support") Acked-by: Huang Rui Reviewed-by: Alexey Kardashevskiy Signed-off-by: Wyes Karny Signed-off-by: Rafael J. Wysocki commit 2c40519251d61590377b313379ae2d4d4ef28266 Merge: 793cfd598370c 68d99ab0e9221 Author: Linus Torvalds Date: Tue Apr 11 11:43:16 2023 -0700 Merge tag 'for-6.3-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix fast checksum detection, this affects filesystems with non-crc32c checksum, calculation would not be offloaded to worker threads - restore thread_pool mount option behaviour for endio workers, the new value for maximum active threads would not be set to the actual work queues * tag 'for-6.3-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix fast csum implementation detection btrfs: restore the thread_pool= behavior in remount for the end I/O workqueues commit b89ce1177d42d5c124e83f3858818cd4e6a2c46f Author: Christophe JAILLET Date: Sun Dec 26 17:34:16 2021 +0100 drm/armada: Fix a potential double free in an error handling path 'priv' is a managed resource, so there is no need to free it explicitly or there will be a double free(). Fixes: 90ad200b4cbc ("drm/armada: Use devm_drm_dev_alloc") Signed-off-by: Christophe JAILLET Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/c4f3c9207a9fce35cb6dd2cc60e755275961588a.1640536364.git.christophe.jaillet@wanadoo.fr commit 793cfd598370cf9440d7877ddddda1251307f729 Merge: 43fef9ae02fb5 93942b7046157 Author: Linus Torvalds Date: Tue Apr 11 10:09:29 2023 -0700 Merge tag 'mtd/fixes-for-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel Raynal: "Core fix: - mtdblock: Tolerate corrected bit-flips Raw NAND fixes: - meson: Fix bitmask for length in command word - stm32_fmc2: - Remove unsupported EDO mode - Use timings.mode instead of checking tRC_min. The first patch is the real fix but nowadays we use timings.mode instead of bare timings, so in order to ease the backports, the fix was split into two steps, the first one easy to backport on older kernels, the second one just as a follow-up so recent stable kernels would look like the mainline" * tag 'mtd/fixes-for-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: meson: fix bitmask for length in command word mtdblock: tolerate corrected bit-flips mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min mtd: rawnand: stm32_fmc2: remove unsupported EDO mode commit 43fef9ae02fb5fa554e5df3c1899f06e4394cffc Merge: aa4c9185f0a16 2096134b5a00b Author: Linus Torvalds Date: Tue Apr 11 09:51:45 2023 -0700 Merge tag 'ata-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: - Update my email address in the MAINTAINERS file * tag 'ata-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: MAINTAINERS: Change ata maintainer email addresses commit aa4c9185f0a16662c25d814c713b3cd0b4f4e97a Merge: 0d3eb744aed40 0bf9601f8ef07 Author: Linus Torvalds Date: Tue Apr 11 09:36:42 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "Two ARM fixes: - Ensure the guest PMU context is restored before the first KVM_RUN, fixing an issue where EL0 event counting is broken after vCPU save/restore - Actually initialize ID_AA64PFR0_EL1.{CSV2,CSV3} based on the sanitized, system-wide values for protected VMs" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs KVM: arm64: PMU: Restore the guest's EL0 event counting after migration commit 117e4e5bd9d47b89777dbf6b37a709dcfe59520f Author: Srinivas Pandruvada Date: Mon Apr 10 10:35:01 2023 -0700 thermal: intel: Avoid updating unsupported THERM_STATUS_CLEAR mask bits Some older processors don't allow BIT(13) and BIT(15) in the current mask set by "THERM_STATUS_CLEAR_CORE_MASK". This results in: unchecked MSR access error: WRMSR to 0x19c (tried to write 0x000000000000aaa8) at rIP: 0xffffffff816f66a6 (throttle_active_work+0xa6/0x1d0) To avoid unchecked MSR issues, check CPUID for each relevant feature and use that information to set the supported feature bits only in the "clear" mask for cores. Do the same for the analogous package mask set by "THERM_STATUS_CLEAR_PKG_MASK". Introduce functions thermal_intr_init_core_clear_mask() and thermal_intr_init_pkg_clear_mask() to set core and package mask bits, respectively. These functions are called during initialization. Fixes: 6fe1e64b6026 ("thermal: intel: Prevent accidental clearing of HFI status") Reported-by: Rui Salvaterra Link: https://lore.kernel.org/lkml/cdf43fb423368ee3994124a9e8c9b4f8d00712c6.camel@linux.intel.com/T/ Tested-by: Rui Salvaterra Signed-off-by: Srinivas Pandruvada Cc: 6.2+ # 6.2+ [ rjw: Renamed 2 funtions and 2 static variables, edited subject and changelog ] Signed-off-by: Rafael J. Wysocki commit 6fd33a3333c7916689b8f051a185defe4dd515b0 Author: Daniel Vetter Date: Tue Apr 4 21:39:34 2023 +0200 fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace This is an oversight from dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore") - I failed to realize that nasty userspace could set this. It's not pretty to mix up kernel-internal and userspace uapi flags like this, but since the entire fb_var_screeninfo structure is uapi we'd need to either add a new parameter to the ->fb_set_par callback and fb_set_par() function, which has a _lot_ of users. Or some other fairly ugly side-channel int fb_info. Neither is a pretty prospect. Instead just correct the issue at hand by filtering out this kernel-internal flag in the ioctl handling code. Reviewed-by: Javier Martinez Canillas Acked-by: Maarten Lankhorst Signed-off-by: Daniel Vetter Fixes: dc5bdb68b5b3 ("drm/fb-helper: Fix vt restore") Cc: Alex Deucher Cc: shlomo@fastmail.com Cc: Michel Dänzer Cc: Noralf Trønnes Cc: Thomas Zimmermann Cc: Daniel Vetter Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Cc: # v5.7+ Cc: Bartlomiej Zolnierkiewicz Cc: Geert Uytterhoeven Cc: Nathan Chancellor Cc: Qiujun Huang Cc: Peter Rosin Cc: linux-fbdev@vger.kernel.org Cc: Helge Deller Cc: Sam Ravnborg Cc: Geert Uytterhoeven Cc: Samuel Thibault Cc: Tetsuo Handa Cc: Shigeru Yoshida Link: https://patchwork.freedesktop.org/patch/msgid/20230404193934.472457-1-daniel.vetter@ffwll.ch commit a4506722dc39ca840593f14e3faa4c9ba9408211 Author: Radu Pirea (OSS) Date: Thu Apr 6 12:59:04 2023 +0300 net: phy: nxp-c45-tja11xx: add remove callback Unregister PTP clock when the driver is removed. Purge the RX and TX skb queues. Fixes: 514def5dd339 ("phy: nxp-c45-tja11xx: add timestamping support") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Radu Pirea (OSS) Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230406095904.75456-1-radu-nicolae.pirea@oss.nxp.com Signed-off-by: Paolo Abeni commit 7c7504067c709905fc188c61ac3072d6022d1209 Author: Axel Lin Date: Sun Apr 9 10:55:29 2023 +0800 regulator: sm5703: Fix missing n_voltages for fixed regulators Set n_voltages = 1 for fixed regulators. Signed-off-by: Axel Lin Reviewed-by: Markuss Broks Link: https://lore.kernel.org/r/20230409025529.241699-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit 86d8740dae5a397d8344ae75f8758103c1fcba97 Author: Karol Herbst Date: Wed Apr 5 13:04:55 2023 +0200 drm/nouveau/fb: add missing sysmen flush callbacks Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/203 Fixes: 5728d064190e1 ("drm/nouveau/fb: handle sysmem flush page from common code") Signed-off-by: Karol Herbst Reviewed-by: Lyude Paul Reviewed-by: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/20230405110455.1368428-1-kherbst@redhat.com commit 6b8446859c971a5783a2cdc90adf32e64de3bd23 Author: Jani Nikula Date: Wed Mar 1 17:14:09 2023 +0200 drm/i915/dsi: fix DSS CTL register offsets for TGL+ On TGL+ the DSS control registers are at different offsets, and there's one per pipe. Fix the offsets to fix dual link DSI for TGL+. There would be helpers for this in the DSC code, but just do the quick fix now for DSI. Long term, we should probably move all the DSS handling into intel_vdsc.c, so exporting the helpers seems counter-productive. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8232 Cc: Ville Syrjala Cc: stable@vger.kernel.org Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230301151409.1581574-1-jani.nikula@intel.com (cherry picked from commit 1a62dd9895dca78bee28bba3a36f08836fdd143d) commit a042d7feae7eff98a9ad5a9de5004e60883a96d3 Merge: 265f1ecff7bf5 dc70eb868b9cd Author: Greg Kroah-Hartman Date: Tue Apr 11 09:41:40 2023 +0200 Merge tag 'fpga-for-6.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next Xu writes: FPGA Manager changes for 6.3-final Intel m10 bmc secure update: - Ilpo's change fixes the return value of driver internal function DFL PCI driver: - Bjorn's change drops redundant pci_enable_pcie_error_reporting() Xilinx: - Michal's change uses xlnx_pr_decouple_read() instead of readl() to resolve sparse issue. FPGA core: - Alexis's change fixes kernel warning on fpga bridge register All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our fixes branch) Signed-off-by: Xu Yilun * tag 'fpga-for-6.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: bridge: properly initialize bridge device before populating children fpga: xilinx-pr-decoupler: Use readl wrapper instead of pure readl fpga: dfl-pci: Drop redundant pci_enable_pcie_error_reporting() fpga: m10bmc-sec: Fix rsu_send_data() to return FW_UPLOAD_ERR_HW_ERROR commit 265f1ecff7bf570f4fb9eaa0a40110e4e2091cea Merge: 09a9639e56c01 b1cb00d51e361 Author: Greg Kroah-Hartman Date: Tue Apr 11 09:37:19 2023 +0200 Merge tag 'iio-fixes-for-6.3b' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: 2nd set of IIO fixes for the 6.3 cycle. adi,ad5755 - Fix missing fwnode_handle_put() in error path. atmel,at91-sam5d2 - Fix error code when trigger allocation fails that would have looked like success. taos,tsl2772 - Store the proximity-diodes value read from the device tree so it is actually used rather than ignored. * tag 'iio-fixes-for-6.3b' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: light: tsl2772: fix reading proximity-diodes from device tree iio: dac: ad5755: Add missing fwnode_handle_put() iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() commit 2096134b5a00bf0bd15745d3a492039e801e84c0 Author: Damien Le Moal Date: Mon Apr 10 11:31:11 2023 +0900 MAINTAINERS: Change ata maintainer email addresses Change my email address referenced in the MAINTAINERS file for the ata subsystem to dlemoal@kernel.org. And while at it, also change other references for zonefs and the k210 drivers to the same address. Signed-off-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni commit aa7d233f45b4c549750044c9921f7afcbe50925b Author: Masahiro Yamada Date: Mon Apr 10 21:09:07 2023 +0900 kbuild: give up untracked files for source package builds When the source tree is dirty and contains untracked files, package builds may fail, for example, when a broken symlink exists, a file path contains whitespaces, etc. Since commit 05e96e96a315 ("kbuild: use git-archive for source package creation"), the source tarball only contains committed files because it is created by 'git archive'. scripts/package/gen-diff-patch tries to address the diff from HEAD, but including untracked files by the hand-crafted script introduces more complexity. I wrote a patch [1] to make it work in most cases, but still wonder if this is what we should aim for. To simplify the code, this patch just gives up untracked files. Going forward, it is your responsibility to do 'git add' for what you want in the source package. The script shows a warning just in case you forgot to do so. It should be checked only when building source packages. [1]: https://lore.kernel.org/all/CAK7LNAShbZ56gSh9PrbLnBDYKnjtTkHMoCXeGrhcxMvqXGq9=g@mail.gmail.com/2-0001-kbuild-make-package-builds-more-robust.patch Fixes: 05e96e96a315 ("kbuild: use git-archive for source package creation") Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 0d3eb744aed40ffce820cded61d7eac515199165 Merge: dfc1915448646 5da7cb193db32 Author: Linus Torvalds Date: Mon Apr 10 14:15:17 2023 -0700 Merge tag 'urgent-rcu.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU fix from Paul McKenney: "This fixes a pair of bugs in which an improbable but very real sequence of events can cause kfree_rcu() to be a bit too quick about freeing the memory passed to it. It turns out that this pair of bugs is about two years old, and so this is not a v6.3 regression. However: (1) It just started showing up in the wild and (2) Its consequences are dire, so its fix needs to go in sooner rather than later. Testing is of course being upgraded, and the upgraded tests detect this situation very quickly. But to the best of my knowledge right now, the tests are not particularly urgent and will thus most likely show up in the v6.5 merge window (the one after this coming one). Kudos to Ziwei Dai and his group for tracking this one down the hard way!" * tag 'urgent-rcu.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period commit dfc191544864601a056ce7691d600e70d60d3ca1 Merge: c118b59e71d2a 9da667e50c7e6 Author: Linus Torvalds Date: Mon Apr 10 13:35:54 2023 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Some last minute fixes - most of them for regressions" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vdpa_sim_net: complete the initialization before register the device vdpa/mlx5: Add and remove debugfs in setup/teardown driver tools/virtio: fix typo in README instructions vhost-scsi: Fix crash during LUN unmapping vhost-scsi: Fix vhost_scsi struct use after free virtio-blk: fix ZBD probe in kernels without ZBD support virtio-blk: fix to match virtio spec commit c118b59e71d2a910ee300f8be40fa864a91bb6ca Merge: 411eb01410859 347dca97f75d4 Author: Linus Torvalds Date: Mon Apr 10 13:25:08 2023 -0700 Merge tag '9p-6.3-fixes-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs Pull 9p fixes from Eric Van Hensbergen: "These are some collected fixes for the 6.3-rc series that have been passed our 9p regression tests and been in for-next for at least a week. They include a fix for a KASAN reported problem in the extended attribute handling code and a use after free in the xen transport. This also includes some updates for the MAINTAINERS file including the transition of our development mailing list from sourceforge.net to lists.linux.dev" * tag '9p-6.3-fixes-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: Update email address and mailing list for v9fs 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition 9P FS: Fix wild-memory-access write in v9fs_get_acl commit 411eb014108594d160a20381e8738de6c62e2e5b Merge: 09a9639e56c01 a3046a618a284 Author: Linus Torvalds Date: Mon Apr 10 13:13:33 2023 -0700 Merge tag 'uml-for-linus-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML fix from Richard Weinberger: - Build regression fix for older gcc versions * tag 'uml-for-linus-6.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: Only disable SSE on clang to work around old GCC bugs commit a2a9339e1c9deb7e1e079e12e27a0265aea8421a Author: Luiz Augusto von Dentz Date: Thu Apr 6 09:33:09 2023 -0700 Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed. Cc: stable@kernel.org Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Min Li commit d2e4f1b1cba8742db66aaf77374cab7c0c7c8656 Author: Claudia Draghicescu Date: Wed Apr 5 14:19:18 2023 +0300 Bluetooth: Set ISO Data Path on broadcast sink This patch enables ISO data rx on broadcast sink. Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Signed-off-by: Claudia Draghicescu Signed-off-by: Luiz Augusto von Dentz commit 5dc7d23e167e2882ef118456ceccd57873e876d8 Author: Luiz Augusto von Dentz Date: Mon Apr 3 14:19:14 2023 -0700 Bluetooth: hci_conn: Fix possible UAF This fixes the following trace: ================================================================== BUG: KASAN: slab-use-after-free in hci_conn_del+0xba/0x3a0 Write of size 8 at addr ffff88800208e9c8 by task iso-tester/31 CPU: 0 PID: 31 Comm: iso-tester Not tainted 6.3.0-rc2-g991aa4a69a47 #4716 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc36 04/01/2014 Call Trace: dump_stack_lvl+0x1d/0x70 print_report+0xce/0x610 ? __virt_addr_valid+0xd4/0x150 ? hci_conn_del+0xba/0x3a0 kasan_report+0xdd/0x110 ? hci_conn_del+0xba/0x3a0 hci_conn_del+0xba/0x3a0 hci_conn_hash_flush+0xf2/0x120 hci_dev_close_sync+0x388/0x920 hci_unregister_dev+0x122/0x260 vhci_release+0x4f/0x90 __fput+0x102/0x430 task_work_run+0xf1/0x160 ? __pfx_task_work_run+0x10/0x10 ? mark_held_locks+0x24/0x90 exit_to_user_mode_prepare+0x170/0x180 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x4e/0x90 entry_SYSCALL_64_after_hwframe+0x70/0xda Fixes: 0f00cd322d22 ("Bluetooth: Free potentially unfreed SCO connection") Link: https://syzkaller.appspot.com/bug?extid=8bb72f86fc823817bc5d Cc: Signed-off-by: Luiz Augusto von Dentz commit 975abc0c90fc485ff9b4a6afa475c3b1398d5d47 Author: Luiz Augusto von Dentz Date: Thu Mar 30 14:45:03 2023 -0700 Bluetooth: SCO: Fix possible circular locking dependency sco_sock_getsockopt This attempts to fix the following trace: ====================================================== WARNING: possible circular locking dependency detected 6.3.0-rc2-g68fcb3a7bf97 #4706 Not tainted ------------------------------------------------------ sco-tester/31 is trying to acquire lock: ffff8880025b8070 (&hdev->lock){+.+.}-{3:3}, at: sco_sock_getsockopt+0x1fc/0xa90 but task is already holding lock: ffff888001eeb130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_sock_getsockopt+0x104/0xa90 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}: lock_sock_nested+0x32/0x80 sco_connect_cfm+0x118/0x4a0 hci_sync_conn_complete_evt+0x1e6/0x3d0 hci_event_packet+0x55c/0x7c0 hci_rx_work+0x34c/0xa00 process_one_work+0x575/0x910 worker_thread+0x89/0x6f0 kthread+0x14e/0x180 ret_from_fork+0x2b/0x50 -> #1 (hci_cb_list_lock){+.+.}-{3:3}: __mutex_lock+0x13b/0xcc0 hci_sync_conn_complete_evt+0x1ad/0x3d0 hci_event_packet+0x55c/0x7c0 hci_rx_work+0x34c/0xa00 process_one_work+0x575/0x910 worker_thread+0x89/0x6f0 kthread+0x14e/0x180 ret_from_fork+0x2b/0x50 -> #0 (&hdev->lock){+.+.}-{3:3}: __lock_acquire+0x18cc/0x3740 lock_acquire+0x151/0x3a0 __mutex_lock+0x13b/0xcc0 sco_sock_getsockopt+0x1fc/0xa90 __sys_getsockopt+0xe9/0x190 __x64_sys_getsockopt+0x5b/0x70 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x70/0xda other info that might help us debug this: Chain exists of: &hdev->lock --> hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); lock(&hdev->lock); *** DEADLOCK *** 1 lock held by sco-tester/31: #0: ffff888001eeb130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_sock_getsockopt+0x104/0xa90 Fixes: 248733e87d50 ("Bluetooth: Allow querying of supported offload codecs over SCO socket") Signed-off-by: Luiz Augusto von Dentz commit 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 Author: Luiz Augusto von Dentz Date: Thu Mar 30 14:15:50 2023 -0700 Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm This attempts to fix the following trace: ====================================================== WARNING: possible circular locking dependency detected 6.3.0-rc2-g0b93eeba4454 #4703 Not tainted ------------------------------------------------------ kworker/u3:0/46 is trying to acquire lock: ffff888001fd9130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x118/0x4a0 but task is already holding lock: ffffffff831e3340 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0x1ad/0x3d0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (hci_cb_list_lock){+.+.}-{3:3}: __mutex_lock+0x13b/0xcc0 hci_sync_conn_complete_evt+0x1ad/0x3d0 hci_event_packet+0x55c/0x7c0 hci_rx_work+0x34c/0xa00 process_one_work+0x575/0x910 worker_thread+0x89/0x6f0 kthread+0x14e/0x180 ret_from_fork+0x2b/0x50 -> #1 (&hdev->lock){+.+.}-{3:3}: __mutex_lock+0x13b/0xcc0 sco_sock_connect+0xfc/0x630 __sys_connect+0x197/0x1b0 __x64_sys_connect+0x37/0x50 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x70/0xda -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}: __lock_acquire+0x18cc/0x3740 lock_acquire+0x151/0x3a0 lock_sock_nested+0x32/0x80 sco_connect_cfm+0x118/0x4a0 hci_sync_conn_complete_evt+0x1e6/0x3d0 hci_event_packet+0x55c/0x7c0 hci_rx_work+0x34c/0xa00 process_one_work+0x575/0x910 worker_thread+0x89/0x6f0 kthread+0x14e/0x180 ret_from_fork+0x2b/0x50 other info that might help us debug this: Chain exists of: sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hci_cb_list_lock); lock(&hdev->lock); lock(hci_cb_list_lock); lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO); *** DEADLOCK *** 4 locks held by kworker/u3:0/46: #0: ffff8880028d1130 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x4c0/0x910 #1: ffff8880013dfde0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x4c0/0x910 #2: ffff8880025d8070 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0xa6/0x3d0 #3: ffffffffb79e3340 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0x1ad/0x3d0 Signed-off-by: Luiz Augusto von Dentz commit b76abe4648c1acc791a207e7c08d1719eb9f4ea8 Author: Sasha Finkelstein Date: Fri Mar 10 11:28:42 2023 +0100 bluetooth: btbcm: Fix logic error in forming the board name. This patch fixes an incorrect loop exit condition in code that replaces '/' symbols in the board name. There might also be a memory corruption issue here, but it is unlikely to be a real problem. Cc: Signed-off-by: Sasha Finkelstein Signed-off-by: Luiz Augusto von Dentz commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 Author: Zheng Wang Date: Thu Mar 9 00:45:01 2023 +0800 Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove. Signed-off-by: Zheng Wang Signed-off-by: Luiz Augusto von Dentz commit c95930abd687fcd1aa040dc4fe90dff947916460 Author: Min Li Date: Sat Mar 4 22:23:30 2023 +0800 Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_del_timer is called in hidp_session_thread(). After hidp_session_put, then 'session' will be freed, causing kernel panic when hidp_idle_timeout is running. The solution is to use del_timer_sync instead of del_timer. Here is the call trace: ? hidp_session_probe+0x780/0x780 call_timer_fn+0x2d/0x1e0 __run_timers.part.0+0x569/0x940 hidp_session_probe+0x780/0x780 call_timer_fn+0x1e0/0x1e0 ktime_get+0x5c/0xf0 lapic_next_deadline+0x2c/0x40 clockevents_program_event+0x205/0x320 run_timer_softirq+0xa9/0x1b0 __do_softirq+0x1b9/0x641 __irq_exit_rcu+0xdc/0x190 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0xa1/0xc0 Cc: stable@vger.kernel.org Signed-off-by: Min Li Signed-off-by: Luiz Augusto von Dentz commit b62e72200eaad523f08d8319bba50fc652e032a8 Author: Luiz Augusto von Dentz Date: Fri Mar 24 13:18:20 2023 -0700 Bluetooth: Fix printing errors if LE Connection times out This fixes errors like bellow when LE Connection times out since that is actually not a controller error: Bluetooth: hci0: Opcode 0x200d failed: -110 Bluetooth: hci0: request failed to create LE connection: err -110 Instead the code shall properly detect if -ETIMEDOUT is returned and send HCI_OP_LE_CREATE_CONN_CANCEL to give up on the connection. Link: https://github.com/bluez/bluez/issues/340 Fixes: 8e8b92ee60de ("Bluetooth: hci_sync: Add hci_le_create_conn_sync") Signed-off-by: Luiz Augusto von Dentz commit 19cf60bf63cbaf5262eac400c707966e19999b83 Author: Luiz Augusto von Dentz Date: Fri Mar 24 10:57:55 2023 -0700 Bluetooth: hci_conn: Fix not cleaning up on LE Connection failure hci_connect_le_scan_cleanup shall always be invoked to cleanup the states and re-enable passive scanning if necessary, otherwise it may cause the pending action to stay active causing multiple attempts to connect. Fixes: 9b3628d79b46 ("Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted") Signed-off-by: Luiz Augusto von Dentz commit b3d80fd27a3c2d8715a40cbf876139b56195f162 Author: Soumya Negi Date: Sun Apr 9 19:12:04 2023 -0700 Input: pegasus-notetaker - check pipe type when probing Fix WARNING in pegasus_open/usb_submit_urb Syzbot bug: https://syzkaller.appspot.com/bug?id=bbc107584dcf3262253ce93183e51f3612aaeb13 Warning raised because pegasus_driver submits transfer request for bogus URB (pipe type does not match endpoint type). Add sanity check at probe time for pipe value extracted from endpoint descriptor. Probe will fail if sanity check fails. Reported-and-tested-by: syzbot+04ee0cb4caccaed12d78@syzkaller.appspotmail.com Signed-off-by: Soumya Negi Link: https://lore.kernel.org/r/20230404074145.11523-1-soumya.negi97@gmail.com Signed-off-by: Dmitry Torokhov commit 09a9639e56c01c7a00d6c0ca63f4c7c41abe075d Author: Linus Torvalds Date: Sun Apr 9 11:15:57 2023 -0700 Linux 6.3-rc6 commit faf8f41858e2792925b2c526e16d2f539a53a730 Merge: 4ba115e2694dc 24d3ae2f37d8b Author: Linus Torvalds Date: Sun Apr 9 10:10:46 2023 -0700 Merge tag 'perf_urgent_for_v6.3_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Fix "same task" check when redirecting event output - Do not wait unconditionally for RCU on the event migration path if there are no events to migrate * tag 'perf_urgent_for_v6.3_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix the same task check in perf_event_set_output perf: Optimize perf_pmu_migrate_context() commit 4ba115e2694dc9a10abfe94766d70b64ae9479c7 Merge: c08cfd6716a17 81515ecf155a3 Author: Linus Torvalds Date: Sun Apr 9 10:00:16 2023 -0700 Merge tag 'x86_urgent_for_v6.3_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Add a new Intel Arrow Lake CPU model number - Fix a confusion about how to check the version of the ACPI spec which supports a "online capable" bit in the MADT table which lead to a bunch of boot breakages with Zen1 systems and VMs * tag 'x86_urgent_for_v6.3_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Add model number for Intel Arrow Lake processor x86/acpi/boot: Correct acpi_is_processor_usable() check x86/ACPI/boot: Use FADT version to check support for online capable commit c08cfd6716a170c549c1140f1d4a0e749c888a79 Merge: cdc9718d5e590 ca712e4705467 Author: Linus Torvalds Date: Sun Apr 9 09:45:46 2023 -0700 Merge tag 'cxl-fixes-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull compute express link (cxl) fixes from Dan Williams: "Several fixes for driver startup regressions that landed during the merge window as well as some older bugs. The regressions were due to a lack of testing with what the CXL specification calls Restricted CXL Host (RCH) topologies compared to the testing with Virtual Host (VH) CXL topologies. A VH topology is typical PCIe while RCH topologies map CXL endpoints as Root Complex Integrated endpoints. The impact is some driver crashes on startup. This merge window also added compatibility for range registers (the mechanism that CXL 1.1 defined for mapping memory) to treat them like HDM decoders (the mechanism that CXL 2.0 defined for mapping Host-managed Device Memory). That work collided with the new region enumeration code that was tested with CXL 2.0 setups, and fails with crashes at startup. Lastly, the DOE (Data Object Exchange) implementation for retrieving an ACPI-like data table from CXL devices is being reworked for v6.4. Several fixes fell out of that work that are suitable for v6.3. All of this has been in linux-next for a while, and all reported issues [1] have been addressed. Summary: - Fix several issues with region enumeration in RCH topologies that can trigger crashes on driver startup or shutdown. - Fix CXL DVSEC range register compatibility versus region enumeration that leads to startup crashes - Fix CDAT endiannes handling - Fix multiple buffer handling boundary conditions - Fix Data Object Exchange (DOE) workqueue usage vs CONFIG_DEBUG_OBJECTS warn splats" Link: http://lore.kernel.org/r/20230405075704.33de8121@canb.auug.org.au [1] * tag 'cxl-fixes-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/hdm: Extend DVSEC range register emulation for region enumeration cxl/hdm: Limit emulation to the number of range registers cxl/region: Move coherence tracking into cxl_region_attach() cxl/region: Fix region setup/teardown for RCDs cxl/port: Fix find_cxl_root() for RCDs and simplify it cxl/hdm: Skip emulation when driver manages mem_enable cxl/hdm: Fix double allocation of @cxlhdm PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y PCI/DOE: Silence WARN splat with CONFIG_DEBUG_OBJECTS=y cxl/pci: Handle excessive CDAT length cxl/pci: Handle truncated CDAT entries cxl/pci: Handle truncated CDAT header cxl/pci: Fix CDAT retrieval on big endian commit 9a06fe08ae938bc2c2fb96e36ebcdb7b1a5133c4 Merge: 5cc33f139e11b bef227c1537cb Author: David S. Miller Date: Sun Apr 9 16:01:28 2023 +0100 Merge branch 'sfp-eeprom' Ivan Bornyakov says: ==================== net: fix EEPROM read of absent SFP module The patchset is to improve EEPROM read requests when SFP module is absent. ChangeLog: v1: https://lore.kernel.org/netdev/20230405153900.747-1-i.bornyakov@metrotek.ru/ v2: * reword commit message of "net: sfp: initialize sfp->i2c_block_size at sfp allocation" * add second patch to eliminate excessive I2C transfers in sfp_module_eeprom() and sfp_module_eeprom_by_page() ==================== Signed-off-by: David S. Miller commit bef227c1537cb8005311c0842bc5449e8c7a5973 Author: Ivan Bornyakov Date: Thu Apr 6 16:08:33 2023 +0300 net: sfp: avoid EEPROM read of absent SFP module If SFP module is not present, it is sensible to fail sfp_module_eeprom() and sfp_module_eeprom_by_page() early to avoid excessive I2C transfers which are garanteed to fail. Suggested-by: Andrew Lunn Signed-off-by: Ivan Bornyakov Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 813c2dd78618f108fdcf9cd726ea90f081ee2881 Author: Ivan Bornyakov Date: Thu Apr 6 16:08:32 2023 +0300 net: sfp: initialize sfp->i2c_block_size at sfp allocation sfp->i2c_block_size is initialized at SFP module insertion in sfp_sm_mod_probe(). Because of that, if SFP module was never inserted since boot, sfp_read() call will lead to zero-length I2C read attempt, and not all I2C controllers are happy with zero-length reads. One way to issue sfp_read() on empty SFP cage is to execute ethtool -m. If SFP module was never plugged since boot, there will be a zero-length I2C read attempt. # ethtool -m xge0 i2c i2c-3: adapter quirk: no zero length (addr 0x0050, size 0, read) Cannot get Module EEPROM data: Operation not supported If SFP module was plugged then removed at least once, sfp->i2c_block_size will be initialized and ethtool -m will fail with different exit code and without I2C error # ethtool -m xge0 Cannot get Module EEPROM data: Remote I/O error Fix this by initializing sfp->i2_block_size at struct sfp allocation stage so no wild sfp_read() could issue zero-length I2C read. Signed-off-by: Ivan Bornyakov Fixes: 0d035bed2a4a ("net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0 workaround") Cc: stable@vger.kernel.org Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit cdc9718d5e590d6905361800b938b93f2b66818e Merge: 68047c48b2288 4f5d5b33fc400 Author: Linus Torvalds Date: Sat Apr 8 18:37:45 2023 -0700 Merge tag '6.3-rc5-smb3-cifs-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Two cifs/smb3 client fixes, one for stable: - double lock fix for a cifs/smb1 reconnect path - DFS prefixpath fix for reconnect when server moved" * tag '6.3-rc5-smb3-cifs-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: double lock in cifs_reconnect_tcon() cifs: sanitize paths in cifs_update_super_prepath. commit 68047c48b2288803c441df9f3e61d0d26bed87df Merge: aa46fe36bbac6 4bffd2c7a3fc1 Author: Linus Torvalds Date: Sat Apr 8 12:21:37 2023 -0700 Merge tag 'char-misc-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a small set of various small driver changes for 6.3-rc6. Included in here are: - iio driver fixes for reported problems - coresight hwtracing bugfix for reported problem - small counter driver bugfixes All have been in linux-next for a while with no reported problems" * tag 'char-misc-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: coresight: etm4x: Do not access TRCIDR1 for identification coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip iio: adc: palmas_gpadc: fix NULL dereference on rmmod counter: 104-quad-8: Fix Synapse action reported for Index signals counter: 104-quad-8: Fix race condition between FLAG and CNTR reads iio: adc: max11410: fix read_poll_timeout() usage iio: dac: cio-dac: Fix max DAC write value check for 12-bit iio: light: cm32181: Unregister second I2C client if present iio: accel: kionix-kx022a: Get the timestamp from the driver's private data in the trigger_handler iio: adc: ad7791: fix IRQ flags iio: buffer: make sure O_NONBLOCK is respected iio: buffer: correctly return bytes written in output buffers iio: light: vcnl4000: Fix WARN_ON on uninitialized lock iio: adis16480: select CONFIG_CRC32 drivers: iio: adc: ltc2497: fix LSB shift iio: adc: qcom-spmi-adc5: Fix the channel name commit aa46fe36bbac623d58817eb12ed0222d88fe6b16 Merge: a211b1c05d487 f92ed0cd9328a Author: Linus Torvalds Date: Sat Apr 8 12:17:46 2023 -0700 Merge tag 'tty-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty and serial driver fixes for some reported problems: - fsl_uart driver bugfixes - sh-sci serial driver bugfixes - renesas serial driver DT binding bugfixes - 8250 DMA bugfix All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: serial: sh-sci: Fix Rx on RZ/G2L SCI tty: serial: fsl_lpuart: fix crash in lpuart_uport_is_active tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty serial: 8250: Prevent starting up DMA Rx on THRI interrupt dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs tty: serial: sh-sci: Fix transmit end interrupt handler commit a211b1c05d487dc9f78688ac3058d2d7a4581807 Merge: a79d5c76f705d 1edf48991a783 Author: Linus Torvalds Date: Sat Apr 8 12:13:39 2023 -0700 Merge tag 'usb-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB bugfixes from Greg KH: "Here are some small USB bugfixes for 6.3-rc6 that have been in my tree, and in linux-next, for a while. Included in here are: - new usb-serial driver device ids - xhci bugfixes for reported problems - gadget driver bugfixes for reported problems - dwc3 new device id All have been in linux-next with no reported problems" * tag 'usb-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: cdnsp: Fixes error: uninitialized symbol 'len' usb: gadgetfs: Fix ep_read_iter to handle ITER_UBUF usb: gadget: f_fs: Fix ffs_epfile_read_iter to handle ITER_UBUF usb: typec: altmodes/displayport: Fix configure initial pin assignment usb: dwc3: pci: add support for the Intel Meteor Lake-S xhci: Free the command allocated for setting LPM if we return early Revert "usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS" xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu USB: serial: option: add Quectel RM500U-CN modem usb: xhci: tegra: fix sleep in atomic call USB: serial: option: add Telit FE990 compositions USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs commit a79d5c76f705de81cb6b55ad279dde9759da06d2 Merge: da0af3c55955e 48b19b79cfa37 Author: Linus Torvalds Date: Sat Apr 8 11:57:05 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes, all in drivers. They're all one or two lines except for the ufs one, but that's a simple revert of a previous feature" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) scsi: Revert "scsi: ufs: core: Initialize devfreq synchronously" commit da0af3c55955efceb7d23f40c8f3d9f4b590d34a Merge: d3f05a4c42856 3723091ea1884 Author: Linus Torvalds Date: Sat Apr 8 11:40:41 2023 -0700 Merge tag 'block-6.3-2023-04-06' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Ensure that ublk always reads the whole sqe upfront (me) - Fix for a block size probing issue with ublk (Ming) - Fix for the bio based polling (Keith) - NVMe pull request via Christoph: - fix discard support without oncs (Keith Busch) - Partition scan error handling regression fix (Yu) * tag 'block-6.3-2023-04-06' of git://git.kernel.dk/linux: block: don't set GD_NEED_PART_SCAN if scan partition failed block: ublk: make sure that block size is set correctly ublk: read any SQE values upfront nvme: fix discard support without oncs blk-mq: directly poll requests commit d3f05a4c428565163f26b5d34f60f02ee4ea4009 Merge: 973ad544f04a5 b4a72c0589fde Author: Linus Torvalds Date: Sat Apr 8 11:34:17 2023 -0700 Merge tag 'io_uring-6.3-2023-04-06' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Just two minor fixes for provided buffers - one where we could potentially leak a buffer, and one where the returned values was off-by-one in some cases" * tag 'io_uring-6.3-2023-04-06' of git://git.kernel.dk/linux: io_uring: fix memory leak when removing provided buffers io_uring: fix return value when removing provided buffers commit 973ad544f04a5eff3435fd36e02392c5afeafc0f Merge: 1a8a804a4f5d6 bbb73a103fbbe Author: Linus Torvalds Date: Sat Apr 8 11:10:49 2023 -0700 Merge tag 'dma-mapping-6.3-2023-04-08' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fix from Christoph Hellwig: - fix a braino in the swiotlb alignment check fix (Petr Tesarik) * tag 'dma-mapping-6.3-2023-04-08' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: fix a braino in the alignment check fix commit 1a8a804a4f5d6d0ec77831ca776b8db4a7a98306 Merge: 6fda0bb806fa7 31c683967174b Author: Linus Torvalds Date: Sat Apr 8 11:02:03 2023 -0700 Merge tag 'trace-v6.3-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: "A couple more minor fixes: - Reset direct->addr back to its original value on error in updating the direct trampoline code - Make lastcmd_mutex static" * tag 'trace-v6.3-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/synthetic: Make lastcmd_mutex static ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() commit 6fda0bb806fa77c9cfe12cdcbbd8cbbe946b9c37 Merge: aa318c48808c0 c45ea315a602d Author: Linus Torvalds Date: Sat Apr 8 10:51:12 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-04-07-16-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM fixes from Andrew Morton: "28 hotfixes. 23 are cc:stable and the other five address issues which were introduced during this merge cycle. 20 are for MM and the remainder are for other subsystems" * tag 'mm-hotfixes-stable-2023-04-07-16-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (28 commits) maple_tree: fix a potential concurrency bug in RCU mode maple_tree: fix get wrong data_end in mtree_lookup_walk() mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() nilfs2: fix sysfs interface lifetime mm: take a page reference when removing device exclusive entries mm: vmalloc: avoid warn_alloc noise caused by fatal signal nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() zsmalloc: document freeable stats zsmalloc: document new fullness grouping fsdax: force clear dirty mark if CoW mm/hugetlb: fix uffd wr-protection for CoW optimization path mm: enable maple tree RCU mode by default maple_tree: add RCU lock checking to rcu callback functions maple_tree: add smp_rmb() to dead node detection maple_tree: fix write memory barrier of nodes once dead for RCU mode maple_tree: remove extra smp_wmb() from mas_dead_leaves() maple_tree: fix freeing of nodes in rcu mode maple_tree: detect dead nodes in mas_start() maple_tree: be more cautious about dead nodes ... commit dcc11ac9dcaffdce428794f282c100a736244b55 Author: Nathan Chancellor Date: Fri Apr 7 14:42:48 2023 -0700 Documentation/llvm: Add a note about prebuilt kernel.org toolchains I recently started uploading prebuilt stable versions of LLVM to kernel.org, which should make building the kernel with LLVM more accessible to maintainers and developers. Link them in the LLVM documentation to make this more visible. Link: https://lore.kernel.org/20230319235619.GA18547@dev-arch.thelio-3990X/ Suggested-by: Nick Desaulniers Reviewed-by: Bill Wendling Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit d83806c4c0cccc0d6d3c3581a11983a9c186a138 Author: Alyssa Ross Date: Sun Mar 26 18:21:21 2023 +0000 purgatory: fix disabling debug info Since 32ef9e5054ec, -Wa,-gdwarf-2 is no longer used in KBUILD_AFLAGS. Instead, it includes -g, the appropriate -gdwarf-* flag, and also the -Wa versions of both of those if building with Clang and GNU as. As a result, debug info was being generated for the purgatory objects, even though the intention was that it not be. Fixes: 32ef9e5054ec ("Makefile.debug: re-enable debug info for .S files") Signed-off-by: Alyssa Ross Cc: stable@vger.kernel.org Acked-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit b1cb00d51e361cf5af93649917d9790e1623647e Author: Brian Masney Date: Mon Apr 3 21:14:55 2023 -0400 iio: light: tsl2772: fix reading proximity-diodes from device tree tsl2772_read_prox_diodes() will correctly parse the properties from device tree to determine which proximity diode(s) to read from, however it didn't actually set this value on the struct tsl2772_settings. Let's go ahead and fix that. Reported-by: Tom Rix Link: https://lore.kernel.org/lkml/20230327120823.1369700-1-trix@redhat.com/ Fixes: 94cd1113aaa0 ("iio: tsl2772: add support for reading proximity led settings from device tree") Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20230404011455.339454-1-bmasney@redhat.com Cc: Signed-off-by: Jonathan Cameron commit 5cc33f139e11b893ff6dc60d8a0ae865a65521ac Author: Douglas Anderson Date: Thu Apr 6 17:14:26 2023 -0700 r8152: Add __GFP_NOWARN to big allocations When memory is a little tight on my system, it's pretty easy to see warnings that look like this. ksoftirqd/0: page allocation failure: order:3, mode:0x40a20(GFP_ATOMIC|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 ... Call trace: dump_backtrace+0x0/0x1e8 show_stack+0x20/0x2c dump_stack_lvl+0x60/0x78 dump_stack+0x18/0x38 warn_alloc+0x104/0x174 __alloc_pages+0x588/0x67c alloc_rx_agg+0xa0/0x190 [r8152 ...] r8152_poll+0x270/0x760 [r8152 ...] __napi_poll+0x44/0x1ec net_rx_action+0x100/0x300 __do_softirq+0xec/0x38c run_ksoftirqd+0x38/0xec smpboot_thread_fn+0xb8/0x248 kthread+0x134/0x154 ret_from_fork+0x10/0x20 On a fragmented system it's normal that order 3 allocations will sometimes fail, especially atomic ones. The driver handles these failures fine and the WARN just creates spam in the logs for this case. The __GFP_NOWARN flag is exactly for this situation, so add it to the allocation. NOTE: my testing is on a 5.15 system, but there should be no reason that this would be fundamentally different on a mainline kernel. Signed-off-by: Douglas Anderson Acked-by: Hayes Wang Link: https://lore.kernel.org/r/20230406171411.1.I84dbef45786af440fd269b71e9436a96a8e7a152@changeid Signed-off-by: Jakub Kicinski commit bdaaecc127d471c422ee9e994978617c8aa79e1e Author: Radu Pirea (OSS) Date: Thu Apr 6 12:59:53 2023 +0300 net: phy: nxp-c45-tja11xx: fix unsigned long multiplication overflow Any multiplication between GENMASK(31, 0) and a number bigger than 1 will be truncated because of the overflow, if the size of unsigned long is 32 bits. Replaced GENMASK with GENMASK_ULL to make sure that multiplication will be between 64 bits values. Cc: # 5.15+ Fixes: 514def5dd339 ("phy: nxp-c45-tja11xx: add timestamping support") Signed-off-by: Radu Pirea (OSS) Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230406095953.75622-1-radu-nicolae.pirea@oss.nxp.com Signed-off-by: Jakub Kicinski commit 066b86787fa3d97b7aefb5ac0a99a22dad2d15f8 Author: Felix Huettner Date: Wed Apr 5 07:53:41 2023 +0000 net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces "server" and "client" 3. two ovs interfaces "server" and "client" on the bridge 4. for each ovs interface a veth pair with a matching name and 32 rx and tx queues 5. move the ends of the veth pairs to the respective network namespaces 6. assign ip addresses to each of the veth ends in the namespaces (needs to be the same subnet) 7. start some http server on the server network namespace 8. test if a client in the client namespace can reach the http server when following the actions below the host has a chance of getting a cpu stuck in a infinite loop: 1. send a large amount of parallel requests to the http server (around 3000 curls should work) 2. in parallel delete the network namespace (do not delete interfaces or stop the server, just kill the namespace) there is a low chance that this will cause the below kernel cpu stuck message. If this does not happen just retry. Below there is also the output of bpftrace for the functions mentioned in the output. The series of events happening here is: 1. the network namespace is deleted calling `unregister_netdevice_many_notify` somewhere in the process 2. this sets first `NETREG_UNREGISTERING` on both ends of the veth and then runs `synchronize_net` 3. it then calls `call_netdevice_notifiers` with `NETDEV_UNREGISTER` 4. this is then handled by `dp_device_event` which calls `ovs_netdev_detach_dev` (if a vport is found, which is the case for the veth interface attached to ovs) 5. this removes the rx_handlers of the device but does not prevent packages to be sent to the device 6. `dp_device_event` then queues the vport deletion to work in background as a ovs_lock is needed that we do not hold in the unregistration path 7. `unregister_netdevice_many_notify` continues to call `netdev_unregister_kobject` which sets `real_num_tx_queues` to 0 8. port deletion continues (but details are not relevant for this issue) 9. at some future point the background task deletes the vport If after 7. but before 9. a packet is send to the ovs vport (which is not deleted at this point in time) which forwards it to the `dev_queue_xmit` flow even though the device is unregistering. In `skb_tx_hash` (which is called in the `dev_queue_xmit`) path there is a while loop (if the packet has a rx_queue recorded) that is infinite if `dev->real_num_tx_queues` is zero. To prevent this from happening we update `do_output` to handle devices without carrier the same as if the device is not found (which would be the code path after 9. is done). Additionally we now produce a warning in `skb_tx_hash` if we will hit the infinite loop. bpftrace (first word is function name): __dev_queue_xmit server: real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1 netdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues: 1, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 1 dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 2, reg_state: 1 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 6, reg_state: 2 ovs_netdev_detach_dev server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, reg_state: 2 netdev_rx_handler_unregister server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 netdev_rx_handler_unregister ret server: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024, reg_state: 2 dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 27, reg_state: 2 dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 22, reg_state: 2 dp_device_event server: real_num_tx_queues: 1 cpu 9, pid: 21024, tid: 21024, event 18, reg_state: 2 netdev_unregister_kobject: real_num_tx_queues: 1, cpu: 9, pid: 21024, tid: 21024 synchronize_rcu_expedited: cpu 9, pid: 21024, tid: 21024 ovs_vport_send server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2 __dev_queue_xmit server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2 netdev_core_pick_tx server: addr: 0xffff9f0a46d4a000 real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024, skb_addr: 0xffff9edb6f207000, reg_state: 2 broken device server: real_num_tx_queues: 0, cpu: 2, pid: 28024, tid: 28024 ovs_dp_detach_port server: real_num_tx_queues: 0 cpu 9, pid: 9124, tid: 9124, reg_state: 2 synchronize_rcu_expedited: cpu 9, pid: 33604, tid: 33604 stuck message: watchdog: BUG: soft lockup - CPU#5 stuck for 26s! [curl:1929279] Modules linked in: veth pktgen bridge stp llc ip_set_hash_net nft_counter xt_set nft_compat nf_tables ip_set_hash_ip ip_set nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 tls binfmt_misc nls_iso8859_1 input_leds joydev serio_raw dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua sch_fq_codel drm efi_pstore virtio_rng ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear hid_generic usbhid hid crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel virtio_net ahci net_failover crypto_simd cryptd psmouse libahci virtio_blk failover CPU: 5 PID: 1929279 Comm: curl Not tainted 5.15.0-67-generic #74-Ubuntu Hardware name: OpenStack Foundation OpenStack Nova, BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:netdev_pick_tx+0xf1/0x320 Code: 00 00 8d 48 ff 0f b7 c1 66 39 ca 0f 86 e9 01 00 00 45 0f b7 ff 41 39 c7 0f 87 5b 01 00 00 44 29 f8 41 39 c7 0f 87 4f 01 00 00 f2 0f 1f 44 00 00 49 8b 94 24 28 04 00 00 48 85 d2 0f 84 53 01 RSP: 0018:ffffb78b40298820 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff9c8773adc2e0 RCX: 000000000000083f RDX: 0000000000000000 RSI: ffff9c8773adc2e0 RDI: ffff9c870a25e000 RBP: ffffb78b40298858 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9c870a25e000 R13: ffff9c870a25e000 R14: ffff9c87fe043480 R15: 0000000000000000 FS: 00007f7b80008f00(0000) GS:ffff9c8e5f740000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7b80f6a0b0 CR3: 0000000329d66000 CR4: 0000000000350ee0 Call Trace: netdev_core_pick_tx+0xa4/0xb0 __dev_queue_xmit+0xf8/0x510 ? __bpf_prog_exit+0x1e/0x30 dev_queue_xmit+0x10/0x20 ovs_vport_send+0xad/0x170 [openvswitch] do_output+0x59/0x180 [openvswitch] do_execute_actions+0xa80/0xaa0 [openvswitch] ? kfree+0x1/0x250 ? kfree+0x1/0x250 ? kprobe_perf_func+0x4f/0x2b0 ? flow_lookup.constprop.0+0x5c/0x110 [openvswitch] ovs_execute_actions+0x4c/0x120 [openvswitch] ovs_dp_process_packet+0xa1/0x200 [openvswitch] ? ovs_ct_update_key.isra.0+0xa8/0x120 [openvswitch] ? ovs_ct_fill_key+0x1d/0x30 [openvswitch] ? ovs_flow_key_extract+0x2db/0x350 [openvswitch] ovs_vport_receive+0x77/0xd0 [openvswitch] ? __htab_map_lookup_elem+0x4e/0x60 ? bpf_prog_680e8aff8547aec1_kfree+0x3b/0x714 ? trace_call_bpf+0xc8/0x150 ? kfree+0x1/0x250 ? kfree+0x1/0x250 ? kprobe_perf_func+0x4f/0x2b0 ? kprobe_perf_func+0x4f/0x2b0 ? __mod_memcg_lruvec_state+0x63/0xe0 netdev_port_receive+0xc4/0x180 [openvswitch] ? netdev_port_receive+0x180/0x180 [openvswitch] netdev_frame_hook+0x1f/0x40 [openvswitch] __netif_receive_skb_core.constprop.0+0x23d/0xf00 __netif_receive_skb_one_core+0x3f/0xa0 __netif_receive_skb+0x15/0x60 process_backlog+0x9e/0x170 __napi_poll+0x33/0x180 net_rx_action+0x126/0x280 ? ttwu_do_activate+0x72/0xf0 __do_softirq+0xd9/0x2e7 ? rcu_report_exp_cpu_mult+0x1b0/0x1b0 do_softirq+0x7d/0xb0 __local_bh_enable_ip+0x54/0x60 ip_finish_output2+0x191/0x460 __ip_finish_output+0xb7/0x180 ip_finish_output+0x2e/0xc0 ip_output+0x78/0x100 ? __ip_finish_output+0x180/0x180 ip_local_out+0x5e/0x70 __ip_queue_xmit+0x184/0x440 ? tcp_syn_options+0x1f9/0x300 ip_queue_xmit+0x15/0x20 __tcp_transmit_skb+0x910/0x9c0 ? __mod_memcg_state+0x44/0xa0 tcp_connect+0x437/0x4e0 ? ktime_get_with_offset+0x60/0xf0 tcp_v4_connect+0x436/0x530 __inet_stream_connect+0xd4/0x3a0 ? kprobe_perf_func+0x4f/0x2b0 ? aa_sk_perm+0x43/0x1c0 inet_stream_connect+0x3b/0x60 __sys_connect_file+0x63/0x70 __sys_connect+0xa6/0xd0 ? setfl+0x108/0x170 ? do_fcntl+0xe8/0x5a0 __x64_sys_connect+0x18/0x20 do_syscall_64+0x5c/0xc0 ? __x64_sys_fcntl+0xa9/0xd0 ? exit_to_user_mode_prepare+0x37/0xb0 ? syscall_exit_to_user_mode+0x27/0x50 ? do_syscall_64+0x69/0xc0 ? __sys_setsockopt+0xea/0x1e0 ? exit_to_user_mode_prepare+0x37/0xb0 ? syscall_exit_to_user_mode+0x27/0x50 ? __x64_sys_setsockopt+0x1f/0x30 ? do_syscall_64+0x69/0xc0 ? irqentry_exit+0x1d/0x30 ? exc_page_fault+0x89/0x170 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f7b8101c6a7 Code: 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 18 89 54 24 0c 48 89 34 24 89 RSP: 002b:00007ffffd6b2198 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7b8101c6a7 RDX: 0000000000000010 RSI: 00007ffffd6b2360 RDI: 0000000000000005 RBP: 0000561f1370d560 R08: 00002795ad21d1ac R09: 0030312e302e302e R10: 00007ffffd73f080 R11: 0000000000000246 R12: 0000561f1370c410 R13: 0000000000000000 R14: 0000000000000005 R15: 0000000000000000 Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action") Co-developed-by: Luca Czesla Signed-off-by: Luca Czesla Signed-off-by: Felix Huettner Reviewed-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/ZC0pBXBAgh7c76CA@kernel-bug-kernel-bug Signed-off-by: Jakub Kicinski commit 029294d01907ac4ae7c57bbb122fef2367136ed4 Merge: b9881d9a761a7 919e659ed1256 Author: Jakub Kicinski Date: Fri Apr 7 18:23:36 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-04-08 We've added 4 non-merge commits during the last 11 day(s) which contain a total of 5 files changed, 39 insertions(+), 6 deletions(-). The main changes are: 1) Fix BPF TCP socket iterator to use correct helper for dropping socket's refcount, that is, sock_gen_put instead of sock_put, from Martin KaFai Lau. 2) Fix a BTI exception splat in BPF trampoline-generated code on arm64, from Xu Kuohai. 3) Fix a LongArch JIT error from missing BPF_NOSPEC no-op, from George Guo. 4) Fix dynamic XDP feature detection of veth in xdp_redirect selftest, from Lorenzo Bianconi. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: fix xdp_redirect xdp-features selftest for veth driver bpf, arm64: Fixed a BTI error on returning to patched function LoongArch, bpf: Fix jit to skip speculation barrier opcode bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp ==================== Link: https://lore.kernel.org/r/20230407224642.30906-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit aa318c48808c0aa73216bd94c54c4553d3663add Merge: c9797dba13141 7b75c4703609a Author: Linus Torvalds Date: Fri Apr 7 13:53:16 2023 -0700 Merge tag 'gpio-fixes-for-v6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix irq handling in gpio-davinci - fix Kconfig dependencies for gpio-regmap * tag 'gpio-fixes-for-v6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: davinci: Add irq chip flag to skip set wake gpio: davinci: Do not clear the bank intr enable bit in save_context gpio: GPIO_REGMAP: select REGMAP instead of depending on it commit c9797dba13141de7d7211aacfadb4cdba67a4716 Merge: d523dc7b16c4a a5b2781dcab2c Author: Linus Torvalds Date: Fri Apr 7 13:32:54 2023 -0700 Merge tag 'acpi-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Fix the ACPI backlight override mechanism for the cases when acpi_backlight=video is set through the kernel command line or a DMI quirk and add backlight quirks for Apple iMac14,1 and iMac14,2 and Lenovo ThinkPad W530 (Hans de Goede)" * tag 'acpi-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: video: Add acpi_backlight=video quirk for Lenovo ThinkPad W530 ACPI: video: Add acpi_backlight=video quirk for Apple iMac14,1 and iMac14,2 ACPI: video: Make acpi_backlight=video work independent from GPU driver ACPI: video: Add auto_detect arg to __acpi_video_get_backlight_type() commit d523dc7b16c4a3697700348d77a8a9bf37555e97 Merge: a1e6fff395d32 32d8599968060 Author: Linus Torvalds Date: Fri Apr 7 13:27:02 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Fix uninitialised variable warning (from smatch) in the arm64 compat alignment fixup code" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: compat: Work around uninitialized variable warning commit a1e6fff395d3209511f6a2264c5b6256614afaa3 Merge: f2afccfefe7be dc8289f912387 Author: Linus Torvalds Date: Fri Apr 7 13:10:23 2023 -0700 Merge tag '6.3-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: "Four fixes, three for stable: - slab out of bounds fix - lock cancellation fix - minor cleanup to address clang warning - fix for xfstest 551 (wrong parms passed to kvmalloc)" * tag '6.3-rc5-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: delete asynchronous work from list ksmbd: remove unused is_char_allowed function ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN commit 75eab749e7aec0b7b515d7c50ed429ef4e1c5f3f Author: Abhinav Kumar Date: Wed Mar 29 16:34:16 2023 -0700 arm64: dts: qcom: sc7280: remove hbr3 support on herobrine boards There are some interop issues seen across a few DP monitors with HBR3 and herobrine boards where the DP display stays blank with hbr3. This is still under investigation but in preparation for supporting higher resolutions, its better to disable HBR3 till the issues are root-caused as there is really no guarantee which monitors will show the issue and which would not. This can be enabled back after successful validation across more DP sinks. Signed-off-by: Abhinav Kumar Reviewed-by: Douglas Anderson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230329233416.27152-1-quic_abhinavk@quicinc.com commit 9c85b7fa12ef2e4fc11a4e31ac595fb5f9d0ddf9 Author: Ahmed Zaki Date: Thu Apr 6 15:35:28 2023 -0600 iavf: remove active_cvlans and active_svlans bitmaps The VLAN filters info is currently being held in a list and 2 bitmaps (active_cvlans and active_svlans). We are experiencing some racing where data is not in sync in the list and bitmaps. For example, the VLAN is initially added to the list but only when the PF replies, it is added to the bitmap. If a user adds many V2 VLANS before the PF responds: while [ $((i++)) ] ip l add l eth0 name eth0.$i type vlan id $i we might end up with more VLAN list entries than the designated limit. Also, The "ip link show" will show more links added than the PF limit. On the other and, the bitmaps are only used to check the number of VLAN filters and to re-enable the filters when the interface goes from DOWN to UP. This patch gets rid of the bitmaps and uses the list only. To do that, the states of the VLAN filter are modified: 1 - IAVF_VLAN_REMOVE: the entry needs to be totally removed after informing the PF. This is the "ip link del eth0.$i" path. 2 - IAVF_VLAN_DISABLE: (new) the netdev went down. The filter needs to be removed from the PF and then marked INACTIVE. 3 - IAVF_VLAN_INACTIVE: (new) no PF filter exists, but the user did not delete the VLAN. Fixes: 48ccc43ecf10 ("iavf: Add support VIRTCHNL_VF_OFFLOAD_VLAN_V2 during netdev config") Signed-off-by: Ahmed Zaki Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 0c0da0e951053fda20412cd284e2714bbbb31bff Author: Ahmed Zaki Date: Thu Apr 6 15:35:27 2023 -0600 iavf: refactor VLAN filter states The VLAN filter states are currently being saved as individual bits. This is error prone as multiple bits might be mistakenly set. Fix by replacing the bits with a single state enum. Also, add an "ACTIVE" state for filters that are accepted by the PF. Signed-off-by: Ahmed Zaki Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit b9881d9a761a7e078c394ff8e30e1659d74f898f Merge: dc5110c2d959c 2e825f8accb44 Author: David S. Miller Date: Fri Apr 7 08:47:20 2023 +0100 Merge branch 'bonding-ns-validation-fixes' Hangbin Liu says: ==================== bonding: fix ns validation on backup slaves The first patch fixed a ns validation issue on backup slaves. The second patch re-format the bond option test and add a test lib file. The third patch add the arp validate regression test for the kernel patch. Here is the new bonding option test without the kernel fix: ]# ./bond_options.sh TEST: prio (active-backup miimon primary_reselect 0) [ OK ] TEST: prio (active-backup miimon primary_reselect 1) [ OK ] TEST: prio (active-backup miimon primary_reselect 2) [ OK ] TEST: prio (active-backup arp_ip_target primary_reselect 0) [ OK ] TEST: prio (active-backup arp_ip_target primary_reselect 1) [ OK ] TEST: prio (active-backup arp_ip_target primary_reselect 2) [ OK ] TEST: prio (active-backup ns_ip6_target primary_reselect 0) [ OK ] TEST: prio (active-backup ns_ip6_target primary_reselect 1) [ OK ] TEST: prio (active-backup ns_ip6_target primary_reselect 2) [ OK ] TEST: prio (balance-tlb miimon primary_reselect 0) [ OK ] TEST: prio (balance-tlb miimon primary_reselect 1) [ OK ] TEST: prio (balance-tlb miimon primary_reselect 2) [ OK ] TEST: prio (balance-tlb arp_ip_target primary_reselect 0) [ OK ] TEST: prio (balance-tlb arp_ip_target primary_reselect 1) [ OK ] TEST: prio (balance-tlb arp_ip_target primary_reselect 2) [ OK ] TEST: prio (balance-tlb ns_ip6_target primary_reselect 0) [ OK ] TEST: prio (balance-tlb ns_ip6_target primary_reselect 1) [ OK ] TEST: prio (balance-tlb ns_ip6_target primary_reselect 2) [ OK ] TEST: prio (balance-alb miimon primary_reselect 0) [ OK ] TEST: prio (balance-alb miimon primary_reselect 1) [ OK ] TEST: prio (balance-alb miimon primary_reselect 2) [ OK ] TEST: prio (balance-alb arp_ip_target primary_reselect 0) [ OK ] TEST: prio (balance-alb arp_ip_target primary_reselect 1) [ OK ] TEST: prio (balance-alb arp_ip_target primary_reselect 2) [ OK ] TEST: prio (balance-alb ns_ip6_target primary_reselect 0) [ OK ] TEST: prio (balance-alb ns_ip6_target primary_reselect 1) [ OK ] TEST: prio (balance-alb ns_ip6_target primary_reselect 2) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 0) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 1) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 2) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 3) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 4) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 5) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 6) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 0) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 1) [ OK ] TEST: arp_validate (interface eth1 mii_status DOWN) [FAIL] TEST: arp_validate (interface eth2 mii_status DOWN) [FAIL] TEST: arp_validate (active-backup ns_ip6_target arp_validate 2) [FAIL] TEST: arp_validate (interface eth1 mii_status DOWN) [FAIL] TEST: arp_validate (interface eth2 mii_status DOWN) [FAIL] TEST: arp_validate (active-backup ns_ip6_target arp_validate 3) [FAIL] TEST: arp_validate (active-backup ns_ip6_target arp_validate 4) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 5) [ OK ] TEST: arp_validate (interface eth1 mii_status DOWN) [FAIL] TEST: arp_validate (interface eth2 mii_status DOWN) [FAIL] TEST: arp_validate (active-backup ns_ip6_target arp_validate 6) [FAIL] Here is the test result after the kernel fix: TEST: arp_validate (active-backup arp_ip_target arp_validate 0) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 1) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 2) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 3) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 4) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 5) [ OK ] TEST: arp_validate (active-backup arp_ip_target arp_validate 6) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 0) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 1) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 2) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 3) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 4) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 5) [ OK ] TEST: arp_validate (active-backup ns_ip6_target arp_validate 6) [ OK ] ==================== Signed-off-by: David S. Miller commit 2e825f8accb4491466677162cd9893fe77aea2f9 Author: Hangbin Liu Date: Thu Apr 6 16:23:52 2023 +0800 selftests: bonding: add arp validate test This patch add bonding arp validate tests with mode active backup, monitor arp_ip_target and ns_ip6_target. It also checks mii_status to make sure all slaves are UP. Acked-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit 481b56e0391ea46d6bf1a2604422a21063615901 Author: Hangbin Liu Date: Thu Apr 6 16:23:51 2023 +0800 selftests: bonding: re-format bond option tests To improve the testing process for bond options, A new bond topology lib is added to our testing setup. The current option_prio.sh file will be renamed to bond_options.sh so that all bonding options can be tested here. Specifically, for priority testing, we will run all tests using modes 1, 5, and 6. These changes will help us streamline the testing process and ensure that our bond options are rigorously evaluated. Acked-by: Jay Vosburgh Signed-off-by: Hangbin Liu Acked-by: Jonathan Toppins Signed-off-by: David S. Miller commit 4598380f9c548aa161eb4e990a1583f0a7d1e0d7 Author: Hangbin Liu Date: Thu Apr 6 16:23:50 2023 +0800 bonding: fix ns validation on backup slaves When arp_validate is set to 2, 3, or 6, validation is performed for backup slaves as well. As stated in the bond documentation, validation involves checking the broadcast ARP request sent out via the active slave. This helps determine which slaves are more likely to function in the event of an active slave failure. However, when the target is an IPv6 address, the NS message sent from the active interface is not checked on backup slaves. Additionally, based on the bond_arp_rcv() rule b, we must reverse the saddr and daddr when checking the NS message. Note that when checking the NS message, the destination address is a multicast address. Therefore, we must convert the target address to solicited multicast in the bond_get_targets_ip6() function. Prior to the fix, the backup slaves had a mii status of "down", but after the fix, all of the slaves' mii status was updated to "UP". Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Reviewed-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller commit dc5110c2d959c1707e12df5f792f41d90614adaa Author: YueHaibing Date: Thu Apr 6 14:34:50 2023 +0800 tcp: restrict net.ipv4.tcp_app_win UBSAN: shift-out-of-bounds in net/ipv4/tcp_input.c:555:23 shift exponent 255 is too large for 32-bit type 'int' CPU: 1 PID: 7907 Comm: ssh Not tainted 6.3.0-rc4-00161-g62bad54b26db-dirty #206 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x136/0x150 __ubsan_handle_shift_out_of_bounds+0x21f/0x5a0 tcp_init_transfer.cold+0x3a/0xb9 tcp_finish_connect+0x1d0/0x620 tcp_rcv_state_process+0xd78/0x4d60 tcp_v4_do_rcv+0x33d/0x9d0 __release_sock+0x133/0x3b0 release_sock+0x58/0x1b0 'maxwin' is int, shifting int for 32 or more bits is undefined behaviour. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: YueHaibing Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 8ce07be703456acb00e83d99f3b8036252c33b02 Author: Harshit Mogalapalli Date: Wed Apr 5 23:31:18 2023 -0700 niu: Fix missing unwind goto in niu_alloc_channels() Smatch reports: drivers/net/ethernet/sun/niu.c:4525 niu_alloc_channels() warn: missing unwind goto? If niu_rbr_fill() fails, then we are directly returning 'err' without freeing the channels. Fix this by changing direct return to a goto 'out_err'. Fixes: a3138df9f20e ("[NIU]: Add Sun Neptune ethernet driver.") Signed-off-by: Harshit Mogalapalli Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 4f5d5b33fc400911d6e1f49095522b361d9cbe13 Author: Dan Carpenter Date: Thu Apr 6 11:55:47 2023 +0300 cifs: double lock in cifs_reconnect_tcon() This lock was supposed to be an unlock. Fixes: 6cc041e90c17 ("cifs: avoid races in parallel reconnects in smb1") Signed-off-by: Dan Carpenter Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 3723091ea1884d599cc8b8bf719d6f42e8d4d8b1 Author: Yu Kuai Date: Wed Mar 22 11:59:26 2023 +0800 block: don't set GD_NEED_PART_SCAN if scan partition failed Currently if disk_scan_partitions() failed, GD_NEED_PART_SCAN will still set, and partition scan will be proceed again when blkdev_get_by_dev() is called. However, this will cause a problem that re-assemble partitioned raid device will creat partition for underlying disk. Test procedure: mdadm -CR /dev/md0 -l 1 -n 2 /dev/sda /dev/sdb -e 1.0 sgdisk -n 0:0:+100MiB /dev/md0 blockdev --rereadpt /dev/sda blockdev --rereadpt /dev/sdb mdadm -S /dev/md0 mdadm -A /dev/md0 /dev/sda /dev/sdb Test result: underlying disk partition and raid partition can be observed at the same time Note that this can still happen in come corner cases that GD_NEED_PART_SCAN can be set for underlying disk while re-assemble raid device. Fixes: e5cfefa97bcc ("block: fix scan partition for exclusively open device again") Reviewed-by: Jan Kara Reviewed-by: Ming Lei Signed-off-by: Yu Kuai Signed-off-by: Jens Axboe commit 30ba2d09edb5ea857a1473ae3d820911347ada62 Author: Rob Herring Date: Wed Mar 29 07:38:35 2023 -0500 PCI: Fix use-after-free in pci_bus_release_domain_nr() Commit c14f7ccc9f5d ("PCI: Assign PCI domain IDs by ida_alloc()") introduced a use-after-free bug in the bus removal cleanup. The issue was found with kfence: [ 19.293351] BUG: KFENCE: use-after-free read in pci_bus_release_domain_nr+0x10/0x70 [ 19.302817] Use-after-free read at 0x000000007f3b80eb (in kfence-#115): [ 19.309677] pci_bus_release_domain_nr+0x10/0x70 [ 19.309691] dw_pcie_host_deinit+0x28/0x78 [ 19.309702] tegra_pcie_deinit_controller+0x1c/0x38 [pcie_tegra194] [ 19.309734] tegra_pcie_dw_probe+0x648/0xb28 [pcie_tegra194] [ 19.309752] platform_probe+0x90/0xd8 ... [ 19.311457] kfence-#115: 0x00000000063a155a-0x00000000ba698da8, size=1072, cache=kmalloc-2k [ 19.311469] allocated by task 96 on cpu 10 at 19.279323s: [ 19.311562] __kmem_cache_alloc_node+0x260/0x278 [ 19.311571] kmalloc_trace+0x24/0x30 [ 19.311580] pci_alloc_bus+0x24/0xa0 [ 19.311590] pci_register_host_bridge+0x48/0x4b8 [ 19.311601] pci_scan_root_bus_bridge+0xc0/0xe8 [ 19.311613] pci_host_probe+0x18/0xc0 [ 19.311623] dw_pcie_host_init+0x2c0/0x568 [ 19.311630] tegra_pcie_dw_probe+0x610/0xb28 [pcie_tegra194] [ 19.311647] platform_probe+0x90/0xd8 ... [ 19.311782] freed by task 96 on cpu 10 at 19.285833s: [ 19.311799] release_pcibus_dev+0x30/0x40 [ 19.311808] device_release+0x30/0x90 [ 19.311814] kobject_put+0xa8/0x120 [ 19.311832] device_unregister+0x20/0x30 [ 19.311839] pci_remove_bus+0x78/0x88 [ 19.311850] pci_remove_root_bus+0x5c/0x98 [ 19.311860] dw_pcie_host_deinit+0x28/0x78 [ 19.311866] tegra_pcie_deinit_controller+0x1c/0x38 [pcie_tegra194] [ 19.311883] tegra_pcie_dw_probe+0x648/0xb28 [pcie_tegra194] [ 19.311900] platform_probe+0x90/0xd8 ... [ 19.313579] CPU: 10 PID: 96 Comm: kworker/u24:2 Not tainted 6.2.0 #4 [ 19.320171] Hardware name: /, BIOS 1.0-d7fb19b 08/10/2022 [ 19.325852] Workqueue: events_unbound deferred_probe_work_func The stack trace is a bit misleading as dw_pcie_host_deinit() doesn't directly call pci_bus_release_domain_nr(). The issue turns out to be in pci_remove_root_bus() which first calls pci_remove_bus() which frees the struct pci_bus when its struct device is released. Then pci_bus_release_domain_nr() is called and accesses the freed struct pci_bus. Reordering these fixes the issue. Fixes: c14f7ccc9f5d ("PCI: Assign PCI domain IDs by ida_alloc()") Link: https://lore.kernel.org/r/20230329123835.2724518-1-robh@kernel.org Link: https://lore.kernel.org/r/b529cb69-0602-9eed-fc02-2f068707a006@nvidia.com Reported-by: Jon Hunter Tested-by: Jon Hunter Signed-off-by: Rob Herring Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: stable@vger.kernel.org # v6.2+ Cc: Pali Rohár commit 1c5f054f0b12875096e339861c7f44a7c952ce56 Author: Vincenzo Palazzo Date: Thu Mar 2 14:21:07 2023 +0100 rust: build: Fix grep warning Fix grep warning during the build, with GNU grep 3.8 with the following command `grep -v '^\#\|^$$' rust/bindgen_parameters` I see the following warning ``` grep: warning: stray \ before # --opaque-type xregs_state --opaque-type desc_struct --opaque-type arch_lbr_state --opaque-type local_apic --opaque-type x86_msi_data --opaque-type x86_msi_addr_lo --opaque-type kunit_try_catch --opaque-type spinlock --no-doc-comments ``` Signed-off-by: Vincenzo Palazzo Tested-by: Martin Rodriguez Reboredo Reviewed-by: Martin Rodriguez Reboredo Signed-off-by: Miguel Ojeda commit 5c7548d5a25306dcdb97689479be81cacc8ce596 Author: Asahi Lina Date: Fri Apr 7 00:25:22 2023 +0200 scripts: generate_rust_analyzer: Handle sub-modules with no Makefile More complex drivers might want to use modules to organize their Rust code, but those module folders do not need a Makefile. generate_rust_analyzer.py currently crashes on those. Fix it so that a missing Makefile is silently ignored. Link: https://github.com/Rust-for-Linux/linux/pull/883 Signed-off-by: Asahi Lina Signed-off-by: Miguel Ojeda commit 1e1d3574e69f70b848f9d50eca2c5ff04931b7ba Author: Asahi Lina Date: Thu Apr 6 01:37:39 2023 +0900 drm/scheduler: Fix UAF race in drm_sched_entity_push_job() After a job is pushed into the queue, it is owned by the scheduler core and may be freed at any time, so we can't write nor read the submit timestamp after that point. Fixes oopses observed with the drm/asahi driver, found with kASAN. Signed-off-by: Asahi Lina Link: https://lore.kernel.org/r/20230406-scheduler-uaf-2-v1-1-972531cf0a81@asahilina.net Reviewed-by: Luben Tuikov Signed-off-by: Luben Tuikov commit f195fc1e9715ba826c3b62d58038f760f66a4fe9 Author: Basavaraj Natikar Date: Wed Mar 29 22:58:59 2023 +0530 x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot The AMD [1022:15b8] USB controller loses some internal functional MSI-X context when transitioning from D0 to D3hot. BIOS normally traps D0->D3hot and D3hot->D0 transitions so it can save and restore that internal context, but some firmware in the field can't do this because it fails to clear the AMD_15B8_RCC_DEV2_EPF0_STRAP2 NO_SOFT_RESET bit. Clear AMD_15B8_RCC_DEV2_EPF0_STRAP2 NO_SOFT_RESET bit before USB controller initialization during boot. Link: https://lore.kernel.org/linux-usb/Y%2Fz9GdHjPyF2rNG3@glanzmann.de/T/#u Link: https://lore.kernel.org/r/20230329172859.699743-1-Basavaraj.Natikar@amd.com Reported-by: Thomas Glanzmann Tested-by: Thomas Glanzmann Signed-off-by: Basavaraj Natikar Signed-off-by: Bjorn Helgaas Reviewed-by: Mario Limonciello Cc: stable@vger.kernel.org commit 195d8e5da3acb17c5357526494f818a21e97cd10 Author: Reinette Chatre Date: Wed Mar 29 13:13:11 2023 -0700 PCI/MSI: Provide missing stub for pci_msix_can_alloc_dyn() pci_msix_can_alloc_dyn() is not declared when CONFIG_PCI_MSI is disabled. There is no existing user of pci_msix_can_alloc_dyn() but work is in progress to change this. This work encounters the following error when CONFIG_PCI_MSI is disabled: drivers/vfio/pci/vfio_pci_intrs.c:427:21: error: implicit declaration of function 'pci_msix_can_alloc_dyn' [-Werror=implicit-function-declaration] Provide definition for pci_msix_can_alloc_dyn() in preparation for users that need to compile when CONFIG_PCI_MSI is disabled. [bhelgaas: Also reported by Arnd Bergmann in drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c; added his Fixes: line] Fixes: fb0a6a268dcd ("net/mlx5: Provide external API for allocating vectors") Fixes: 34026364df8e ("PCI/MSI: Provide post-enable dynamic allocation interfaces for MSI-X") Link: https://lore.kernel.org/oe-kbuild-all/202303291000.PWFqGCxH-lkp@intel.com/ Link: https://lore.kernel.org/r/310ecc4815dae4174031062f525245f0755c70e2.1680119924.git.reinette.chatre@intel.com Reported-by: kernel test robot Signed-off-by: Reinette Chatre Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: stable@vger.kernel.org # v6.2+ commit 4f7e22b8b6341e6411cec9db97e20c2a2dbcdbff Merge: a425efcb6e079 8056dc043d7f7 Author: Arnd Bergmann Date: Thu Apr 6 23:18:58 2023 +0200 Merge tag 'riscv-dt-fixes-for-v6.3-final' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V Devicetree fixes for v6.3-final A solitary fix here from Krzysztof for an invalid property that should've probably been removed months ago, but was missed due to it being in a dtb that doesn't build w/ defconfig. Signed-off-by: Conor Dooley * tag 'riscv-dt-fixes-for-v6.3-final' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: canaan: drop invalid spi-max-frequency Link: https://lore.kernel.org/r/20230406-negate-octagon-0fc2e47dbde5@spud Signed-off-by: Arnd Bergmann commit c682e4c37d2b8ba3bde1125cbbea4ee88824b4e2 Author: David Gow Date: Wed Feb 15 06:47:35 2023 +0800 rust: kernel: Mark rust_fmt_argument as extern "C" The rust_fmt_argument function is called from printk() to handle the %pA format specifier. Since it's called from C, we should mark it extern "C" to make sure it's ABI compatible. Cc: stable@vger.kernel.org Fixes: 247b365dc8dc ("rust: add `kernel` crate") Signed-off-by: David Gow Reviewed-by: Gary Guo Reviewed-by: Björn Roy Baron Reviewed-by: Vincenzo Palazzo [Applied `rustfmt`] Signed-off-by: Miguel Ojeda commit e5e86572e3f20222b5d308df9ae986c06f229321 Author: Thomas Bamelis Date: Sun Feb 26 15:29:29 2023 +0000 rust: sort uml documentation arch support table The arch_support table was not sorted alphabetically. Sorts the table properly. Fixes: 0438aadfa69a ("rust: arch/um: Add support for CONFIG_RUST under x86_64 UML") Link: https://lore.kernel.org/rust-for-linux/CANiq72nXMsnUsJNZOG-QZiCVOqa9dRUSMc4RAS3ExLZNJ7VhHg@mail.gmail.com Reported-by: Miguel Ojeda Signed-off-by: Thomas Bamelis Reviewed-by: David Gow Signed-off-by: Miguel Ojeda commit c5d5b55b3c1a314137a251efc1001dfd435c6242 Author: Cristian Ciocaltea Date: Thu Apr 6 20:18:01 2023 +0300 regulator: fan53555: Fix wrong TCS_SLEW_MASK The support for TCS4525 regulator has been introduced with a wrong ramp-rate mask, which has been defined as a logical expression instead of a bit shift operation. For clarity, fix it using GENMASK() macro. Fixes: 914df8faa7d6 ("regulator: fan53555: Add TCS4525 DCDC support") Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20230406171806.948290-4-cristian.ciocaltea@collabora.com Signed-off-by: Mark Brown commit 4fb9a5060f73627303bc531ceaab1b19d0a24aef Author: Cristian Ciocaltea Date: Thu Apr 6 20:18:00 2023 +0300 regulator: fan53555: Explicitly include bits header Since commit f2a9eb975ab2 ("regulator: fan53555: Add support for FAN53526") the driver makes use of the BIT() macro, but relies on the bits header being implicitly included. Explicitly pull the header in to avoid potential build failures in some configurations. While here, reorder include directives alphabetically. Fixes: f2a9eb975ab2 ("regulator: fan53555: Add support for FAN53526") Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20230406171806.948290-3-cristian.ciocaltea@collabora.com Signed-off-by: Mark Brown commit 88e8c2ec4ab84f9f05ed5af9693a3972baf386c4 Author: Patrick Blass Date: Fri Mar 3 20:06:29 2023 +0100 rust: str: fix requierments->requirements typo Fix a trivial spelling error in the `rust/kernel/str.rs` file. Fixes: 247b365dc8dc ("rust: add `kernel` crate") Reported-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/978 Signed-off-by: Patrick Blass Reviewed-by: Vincenzo Palazzo [Reworded slightly] Signed-off-by: Miguel Ojeda commit 31c683967174b487939efaf65e41f5ff1404e141 Author: Steven Rostedt (Google) Date: Thu Apr 6 11:10:33 2023 -0400 tracing/synthetic: Make lastcmd_mutex static The lastcmd_mutex is only used in trace_events_synth.c and should be static. Link: https://lore.kernel.org/linux-trace-kernel/202304062033.cRStgOuP-lkp@intel.com/ Link: https://lore.kernel.org/linux-trace-kernel/20230406111033.6e26de93@gandalf.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Tze-nan Wu Fixes: 4ccf11c4e8a8e ("tracing/synthetic: Fix races on freeing last_cmd") Reviewed-by: Mukesh Ojha Reported-by: kernel test robot Signed-off-by: Steven Rostedt (Google) commit 10b6b4a8ac6120ec36555fd286eed577f7632e3b Author: Mario Limonciello Date: Fri Mar 31 11:08:42 2023 -0500 ACPI: x86: utils: Add Picasso to the list for forcing StorageD3Enable Picasso was the first APU that introduced s2idle support from AMD, and it was predating before vendors started to use `StorageD3Enable` in their firmware. Windows doesn't have problems with this hardware and NVME so it was likely on the list of hardcoded CPUs to use this behavior in Windows. Add it to the list for Linux to avoid NVME resume issues. Reported-by: Stuart Axon Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2449 Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit f2afccfefe7be1f7346564fe619277110d341f9b Merge: 8f2e1a855b47f 8fbc10b995a50 Author: Linus Torvalds Date: Thu Apr 6 11:39:07 2023 -0700 Merge tag 'net-6.3-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless and can. Current release - regressions: - wifi: mac80211: - fix potential null pointer dereference - fix receiving mesh packets in forwarding=0 networks - fix mesh forwarding Current release - new code bugs: - virtio/vsock: fix leaks due to missing skb owner Previous releases - regressions: - raw: fix NULL deref in raw_get_next(). - sctp: check send stream number after wait_for_sndbuf - qrtr: - fix a refcount bug in qrtr_recvmsg() - do not do DEL_SERVER broadcast after DEL_CLIENT - wifi: brcmfmac: fix SDIO suspend/resume regression - wifi: mt76: fix use-after-free in fw features query. - can: fix race between isotp_sendsmg() and isotp_release() - eth: mtk_eth_soc: fix remaining throughput regression - eth: ice: reset FDIR counter in FDIR init stage Previous releases - always broken: - core: don't let netpoll invoke NAPI if in xmit context - icmp: guard against too small mtu - ipv6: fix an uninit variable access bug in __ip6_make_skb() - wifi: mac80211: fix the size calculation of ieee80211_ie_len_eht_cap() - can: fix poll() to not report false EPOLLOUT events - eth: gve: secure enough bytes in the first TX desc for all TCP pkts" * tag 'net-6.3-rc6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) net: stmmac: check fwnode for phy device before scanning for phy net: stmmac: Add queue reset into stmmac_xdp_open() function selftests: net: rps_default_mask.sh: delete veth link specifically net: fec: make use of MDIO C45 quirk can: isotp: fix race between isotp_sendsmg() and isotp_release() can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access gve: Secure enough bytes in the first TX desc for all TCP pkts netlink: annotate lockless accesses to nlk->max_recvmsg_len ethtool: reset #lanes when lanes is omitted ping: Fix potentail NULL deref for /proc/net/icmp. raw: Fix NULL deref in raw_get_next(). ice: Reset FDIR counter in FDIR init stage ice: fix wrong fallback logic for FDIR net: stmmac: fix up RX flow hash indirection table when setting channels net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe wifi: mt76: ignore key disable commands wifi: ath11k: reduce the MHI timeout to 20s ipv6: Fix an uninit variable access bug in __ip6_make_skb() ... commit 8f2e1a855b47fa9fd936eafa617a7ab4582bd916 Merge: 105b64c83872c f1594bc676579 Author: Linus Torvalds Date: Thu Apr 6 11:34:18 2023 -0700 Merge tag 'linux-kselftest-fixes-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "One single fix to mount_setattr_test build failure" * tag 'linux-kselftest-fixes-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests mount: Fix mount_setattr_test builds failed commit 105b64c83872c39d86c1e3dea9ee4185c62114dc Merge: ae52f797904ef 13a0d1ae7ee6b Author: Linus Torvalds Date: Thu Apr 6 11:27:21 2023 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: - An invalid VA range can be be put in a pages and eventually trigger WARN_ON, reject it early - Use of the wrong start index value when doing the complex batch carry scheme - Wrong store ordering resulting in corrupting data used in a later calculation that corrupted the batch structure during carry * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Do not corrupt the pfn list when doing batch carry iommufd: Fix unpinning of pages when an access is present iommufd: Check for uptr overflow commit ae52f797904ef0e98951e43d15a274fa8e80bbe5 Merge: ac6c043391b26 1271a7b98e798 Author: Linus Torvalds Date: Thu Apr 6 11:08:03 2023 -0700 Merge tag 'pwm/for-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm fixes from Thierry Reding: "These are some fixes to make sure the PWM state structure is always initialized to a known state. Prior to this it could happen in some situations that random data from the stack would leak into the data structure and cause subtle bugs" * tag 'pwm/for-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: Zero-initialize the pwm_state passed to driver's .get_state() pwm: meson: Explicitly set .polarity in .get_state() pwm: sprd: Explicitly set .polarity in .get_state() pwm: iqs620a: Explicitly set .polarity in .get_state() pwm: cros-ec: Explicitly set .polarity in .get_state() pwm: hibvt: Explicitly set .polarity in .get_state() commit 0bf9601f8ef0703523018e975d6c1f3fdfcff4b9 Merge: fb5015bc8b733 e81625218bf79 Author: Paolo Bonzini Date: Thu Apr 6 13:34:19 2023 -0400 Merge tag 'kvmarm-fixes-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.3, part #3 - Ensure the guest PMU context is restored before the first KVM_RUN, fixing an issue where EL0 event counting is broken after vCPU save/restore - Actually initialize ID_AA64PFR0_EL1.{CSV2,CSV3} based on the sanitized, system-wide values for protected VMs commit ac6c043391b266a360a53f933638003365bd10c9 Merge: 2a28a8b3659cf 3dfa8926efa91 Author: Linus Torvalds Date: Thu Apr 6 10:25:27 2023 -0700 Merge tag 'drm-fixes-2023-04-06' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Mostly i915 fixes: dp mst for compression/dsc, perf ioctl uaf, ctx rpm accounting, gt reset vs huc loading. And a few individual driver fixes: ivpu dma fence&suspend, panfrost mmap, nouveau color depth" * tag 'drm-fixes-2023-04-06' of git://anongit.freedesktop.org/drm/drm: accel/ivpu: Fix S3 system suspend when not idle accel/ivpu: Add dma fence to command buffers only drm/i915: Fix context runtime accounting drm/i915: fix race condition UAF in i915_perf_add_config_ioctl drm/i915: Use compressed bpp when calculating m/n value for DP MST DSC drm/i915/huc: Cancel HuC delayed load timer on reset. drm/i915/ttm: fix sparse warning drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path drm/nouveau/disp: Support more modes by checking with lower bpc commit 2a28a8b3659cff2dd2042baacd7cca53badca9d6 Merge: 8dfab5237d9f7 f785f5ee968f7 Author: Linus Torvalds Date: Thu Apr 6 10:19:30 2023 -0700 Merge tag 'sound-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "The majority of changes here are various fixes for Intel drivers, and there is a change in ASoC PCM core for the format constraints. In addition, a workaround for HD-audio HDMI regressions and usual HD-audio quirks are found" * tag 'sound-6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/hdmi: Preserve the previous PCM device upon re-enablement ALSA: hda/realtek: Add quirk for Clevo X370SNW ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook ASoC: SOF: avoid a NULL dereference with unsupported widgets ASoC: da7213.c: add missing pm_runtime_disable() ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() ASoC: codecs: lpass: fix the order or clks turn off during suspend ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 ASoC: SOF: ipc4: Ensure DSP is in D0I0 during sof_ipc4_set_get_data() ASoC: amd: yc: Add DMI entries to support Victus by HP Laptop 16-e1xxx (8A22) ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm ASoC: Intel: soc-acpi: add table for Intel 'Rooks County' NUC M15 ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15 commit 8dfab5237d9f728fab8528a5673d8348996a898f Merge: fcff5f99eaf06 9a469c6dfab38 Author: Linus Torvalds Date: Thu Apr 6 10:13:23 2023 -0700 Merge tag 'platform-drivers-x86-v6.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: - more think-lmi fixes - one DMI quirk addition * tag 'platform-drivers-x86-v6.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: thinkpad_acpi: Add missing T14s Gen1 type to s2idle quirk list platform/x86: think-lmi: Clean up display of current_value on Thinkstation platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings platform/x86: think-lmi: Fix memory leak when showing current settings commit 5da7cb193db32da783a3f3e77d8b639989321d48 Author: Ziwei Dai Date: Fri Mar 31 20:42:09 2023 +0800 rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period Memory passed to kvfree_rcu() that is to be freed is tracked by a per-CPU kfree_rcu_cpu structure, which in turn contains pointers to kvfree_rcu_bulk_data structures that contain pointers to memory that has not yet been handed to RCU, along with an kfree_rcu_cpu_work structure that tracks the memory that has already been handed to RCU. These structures track three categories of memory: (1) Memory for kfree(), (2) Memory for kvfree(), and (3) Memory for both that arrived during an OOM episode. The first two categories are tracked in a cache-friendly manner involving a dynamically allocated page of pointers (the aforementioned kvfree_rcu_bulk_data structures), while the third uses a simple (but decidedly cache-unfriendly) linked list through the rcu_head structures in each block of memory. On a given CPU, these three categories are handled as a unit, with that CPU's kfree_rcu_cpu_work structure having one pointer for each of the three categories. Clearly, new memory for a given category cannot be placed in the corresponding kfree_rcu_cpu_work structure until any old memory has had its grace period elapse and thus has been removed. And the kfree_rcu_monitor() function does in fact check for this. Except that the kfree_rcu_monitor() function checks these pointers one at a time. This means that if the previous kfree_rcu() memory passed to RCU had only category 1 and the current one has only category 2, the kfree_rcu_monitor() function will send that current category-2 memory along immediately. This can result in memory being freed too soon, that is, out from under unsuspecting RCU readers. To see this, consider the following sequence of events, in which: o Task A on CPU 0 calls rcu_read_lock(), then uses "from_cset", then is preempted. o CPU 1 calls kfree_rcu(cset, rcu_head) in order to free "from_cset" after a later grace period. Except that "from_cset" is freed right after the previous grace period ended, so that "from_cset" is immediately freed. Task A resumes and references "from_cset"'s member, after which nothing good happens. In full detail: CPU 0 CPU 1 ---------------------- ---------------------- count_memcg_event_mm() |rcu_read_lock() <--- |mem_cgroup_from_task() |// css_set_ptr is the "from_cset" mentioned on CPU 1 |css_set_ptr = rcu_dereference((task)->cgroups) |// Hard irq comes, current task is scheduled out. cgroup_attach_task() |cgroup_migrate() |cgroup_migrate_execute() |css_set_move_task(task, from_cset, to_cset, true) |cgroup_move_task(task, to_cset) |rcu_assign_pointer(.., to_cset) |... |cgroup_migrate_finish() |put_css_set_locked(from_cset) |from_cset->refcount return 0 |kfree_rcu(cset, rcu_head) // free from_cset after new gp |add_ptr_to_bulk_krc_lock() |schedule_delayed_work(&krcp->monitor_work, ..) kfree_rcu_monitor() |krcp->bulk_head[0]'s work attached to krwp->bulk_head_free[] |queue_rcu_work(system_wq, &krwp->rcu_work) |if rwork->rcu.work is not in WORK_STRUCT_PENDING_BIT state, |call_rcu(&rwork->rcu, rcu_work_rcufn) <--- request new gp // There is a perious call_rcu(.., rcu_work_rcufn) // gp end, rcu_work_rcufn() is called. rcu_work_rcufn() |__queue_work(.., rwork->wq, &rwork->work); |kfree_rcu_work() |krwp->bulk_head_free[0] bulk is freed before new gp end!!! |The "from_cset" is freed before new gp end. // the task resumes some time later. |css_set_ptr->subsys[(subsys_id) <--- Caused kernel crash, because css_set_ptr is freed. This commit therefore causes kfree_rcu_monitor() to refrain from moving kfree_rcu() memory to the kfree_rcu_cpu_work structure until the RCU grace period has completed for all three categories. v2: Use helper function instead of inserted code block at kfree_rcu_monitor(). Fixes: 34c881745549 ("rcu: Support kfree_bulk() interface in kfree_rcu()") Fixes: 5f3c8d620447 ("rcu/tree: Maintain separate array for vmalloc ptrs") Reported-by: Mukesh Ojha Signed-off-by: Ziwei Dai Reviewed-by: Uladzislau Rezki (Sony) Tested-by: Uladzislau Rezki (Sony) Signed-off-by: Paul E. McKenney commit fcff5f99eaf06ff6818e14751ffeeb677a325127 Merge: 99ddf2254feba 656e9007ef586 Author: Linus Torvalds Date: Thu Apr 6 09:51:04 2023 -0700 Merge tag 'asm-generic-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic fixes from Arnd Bergmann: "These are minor fixes to address false-positive build warnings: Some of the less common I/O accessors are missing __force casts and cause sparse warnings for their implied byteswap, and a recent change to __generic_cmpxchg_local() causes a warning about constant integer truncation" * tag 'asm-generic-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic: avoid __generic_cmpxchg_local warnings asm-generic/io.h: suppress endianness warnings for relaxed accessors asm-generic/io.h: suppress endianness warnings for readq() and writeq() commit 919e659ed12568b5b8ba6c2ffdd82d8d31fc28af Author: Lorenzo Bianconi Date: Thu Apr 6 12:40:19 2023 +0200 selftests/bpf: fix xdp_redirect xdp-features selftest for veth driver xdp-features supported by veth driver are no more static, but they depends on veth configuration (e.g. if GRO is enabled/disabled or TX/RX queue configuration). Take it into account in xdp_redirect xdp-features selftest for veth driver. Fixes: fccca038f300 ("veth: take into account device reconfiguration for xdp_features flag") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/bc35455cfbb1d4f7f52536955ded81ad47d8dc54.1680777371.git.lorenzo@kernel.org Signed-off-by: Martin KaFai Lau commit dc70eb868b9cd2ca01313e5a394e6ea001d513e9 Author: Alexis Lothoré Date: Tue Apr 4 15:31:02 2023 +0200 fpga: bridge: properly initialize bridge device before populating children The current code path can lead to warnings because of uninitialized device, which contains, as a consequence, uninitialized kobject. The uninitialized device is passed to of_platform_populate, which will at some point, while creating child device, try to get a reference on uninitialized parent, resulting in the following warning: kobject: '(null)' ((ptrval)): is not initialized, yet kobject_get() is being called. The warning is observed after migrating a kernel 5.10.x to 6.1.x. Reverting commit 0d70af3c2530 ("fpga: bridge: Use standard dev_release for class driver") seems to remove the warning. This commit aggregates device_initialize() and device_add() into device_register() but this new call is done AFTER of_platform_populate Fixes: 0d70af3c2530 ("fpga: bridge: Use standard dev_release for class driver") Signed-off-by: Alexis Lothoré Acked-by: Xu Yilun Link: https://lore.kernel.org/r/20230404133102.2837535-2-alexis.lothore@bootlin.com Signed-off-by: Xu Yilun commit 352e1eb17eee86ab4dd66c0c9df528b350aaace2 Author: Long Wang Date: Thu Apr 6 10:45:35 2023 -0500 ASoC: max98373: change power down sequence for smart amp In order to avoid pop noise which occurs when switching device from speaker to headphone, the amplifier should power down first when stopping playback. Signed-off-by: Long Wang Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Rander Wang Link: https://lore.kernel.org/r/20230406154535.18205-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit e959f2beec8e655dba79c5a7111beedae5e757e0 Author: Pierre-Louis Bossart Date: Thu Apr 6 10:27:25 2023 -0500 ALSA: hda: patch_realtek: add quirk for Asus N7601ZM Add pins and verbs needed to enable speakers and jack. The pins and verbs configurations were identified by snooping the Windows driver commands, with a nice write-up here: https://brakkee.org/site/2023/02/07/fixing-sound-on-the-asus-n7601zm/ Reported-by: Erik Brakkee Link: https://github.com/thesofproject/linux/issues/4176 Tested-by: Erik Brakkee Signed-off-by: Pierre-Louis Bossart Reviewed-by: Kai Vehmanen Reviewed-by: Bard Liao Cc: Link: https://lore.kernel.org/r/20230406152725.15191-1-pierre-louis.bossart@linux.intel.com Signed-off-by: Takashi Iwai commit 8fbc10b995a506e173f1080dfa2764f232a65e02 Author: Michael Sit Wei Hong Date: Thu Apr 6 10:45:41 2023 +0800 net: stmmac: check fwnode for phy device before scanning for phy Some DT devices already have phy device configured in the DT/ACPI. Current implementation scans for a phy unconditionally even though there is a phy listed in the DT/ACPI and already attached. We should check the fwnode if there is any phy device listed in fwnode and decide whether to scan for a phy to attach to. Fixes: fe2cfbc96803 ("net: stmmac: check if MAC needs to attach to a PHY") Reported-by: Martin Blumenstingl Link: https://lore.kernel.org/lkml/20230403212434.296975-1-martin.blumenstingl@googlemail.com/ Tested-by: Guenter Roeck Tested-by: Shahab Vahedi Tested-by: Marek Szyprowski Tested-by: Martin Blumenstingl Suggested-by: Russell King (Oracle) Signed-off-by: Michael Sit Wei Hong Link: https://lore.kernel.org/r/20230406024541.3556305-1-michael.wei.hong.sit@intel.com Signed-off-by: Jakub Kicinski commit 2a2d8c51defb446e8d89a83f42f8e5cd529111e9 Author: Zheng Yejian Date: Thu Mar 30 10:52:23 2023 +0800 ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct() Syzkaller report a WARNING: "WARN_ON(!direct)" in modify_ftrace_direct(). Root cause is 'direct->addr' was changed from 'old_addr' to 'new_addr' but not restored if error happened on calling ftrace_modify_direct_caller(). Then it can no longer find 'direct' by that 'old_addr'. To fix it, restore 'direct->addr' to 'old_addr' explicitly in error path. Link: https://lore.kernel.org/linux-trace-kernel/20230330025223.1046087-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Cc: Cc: Cc: Cc: Fixes: 8a141dd7f706 ("ftrace: Fix modify_ftrace_direct.") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit bbb73a103fbbed6f63cb738d3783261c4241b4b2 Author: Petr Tesarik Date: Thu Apr 6 16:35:39 2023 +0200 swiotlb: fix a braino in the alignment check fix The alignment mask in swiotlb_do_find_slots() masks off the high bits which are not relevant for the alignment, so multiple requirements are combined with a bitwise OR rather than AND. In plain English, the stricter the alignment, the more bits must be set in iotlb_align_mask. Confusion may arise from the fact that the same variable is also used to mask off the offset within a swiotlb slot, which is achieved with a bitwise AND. Fixes: 0eee5ae10256 ("swiotlb: fix slot alignment checks") Reported-by: Dexuan Cui Link: https://lore.kernel.org/all/CAA42JLa1y9jJ7BgQvXeUYQh-K2mDNHd2BYZ4iZUz33r5zY7oAQ@mail.gmail.com/ Reported-by: Kelsey Steele Link: https://lore.kernel.org/all/20230405003549.GA21326@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/ Signed-off-by: Petr Tesarik Tested-by: Dexuan Cui Signed-off-by: Christoph Hellwig commit fb4a624f88f658c7b7ae124452bd42eaa8ac7168 Author: Xu Biang Date: Thu Apr 6 06:28:01 2023 -0700 ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex() Smatch Warns: sound/firewire/tascam/tascam-stream.c:493 snd_tscm_stream_start_duplex() warn: missing unwind goto? The direct return will cause the stream list of "&tscm->domain" unemptied and the session in "tscm" unfinished if amdtp_domain_start() returns with an error. Fix this by changing the direct return to a goto which will empty the stream list of "&tscm->domain" and finish the session in "tscm". The snd_tscm_stream_start_duplex() function is called in the prepare callback of PCM. According to "ALSA Kernel API Documentation", the prepare callback of PCM will be called many times at each setup. So, if the "&d->streams" list is not emptied, when the prepare callback is called next time, snd_tscm_stream_start_duplex() will receive -EBUSY from amdtp_domain_add_stream() that tries to add an existing stream to the domain. The error handling code after the "error" label will be executed in this case, and the "&d->streams" list will be emptied. So not emptying the "&d->streams" list will not cause an issue. But it is more efficient and readable to empty it on the first error by changing the direct return to a goto statement. The session in "tscm" has been begun before amdtp_domain_start(), so it needs to be finished when amdtp_domain_start() fails. Fixes: c281d46a51e3 ("ALSA: firewire-tascam: support AMDTP domain") Signed-off-by: Xu Biang Reviewed-by: Dan Carpenter Acked-by: Takashi Sakamoto Cc: Link: https://lore.kernel.org/r/20230406132801.105108-1-xubiang@hust.edu.cn Signed-off-by: Takashi Iwai commit 68d99ab0e9221ef54506f827576c5a914680eeaf Author: Christoph Hellwig Date: Wed Mar 29 09:13:05 2023 +0900 btrfs: fix fast csum implementation detection The BTRFS_FS_CSUM_IMPL_FAST flag is currently set whenever a non-generic crc32c is detected, which is the incorrect check if the file system uses a different checksumming algorithm. Refactor the code to only check this if crc32c is actually used. Note that in an ideal world the information if an algorithm is hardware accelerated or not should be provided by the crypto API instead, but that's left for another day. CC: stable@vger.kernel.org # 5.4.x: c8a5f8ca9a9c: btrfs: print checksum type and implementation at mount time CC: stable@vger.kernel.org # 5.4.x Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 40fac6472f22a59f5694496e179988ab4a1dfe07 Author: Christoph Hellwig Date: Tue Mar 28 12:56:13 2023 +0900 btrfs: restore the thread_pool= behavior in remount for the end I/O workqueues Commit d7b9416fe5c5 ("btrfs: remove btrfs_end_io_wq") converted the read and I/O handling from btrfs_workqueues to Linux workqueues, and as part of that lost the code to apply the thread_pool= based max_active limit on remount. Restore it. Fixes: d7b9416fe5c5 ("btrfs: remove btrfs_end_io_wq") CC: stable@vger.kernel.org # 6.0+ Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5b3b9197c28c8245c3c13ddf3ddf4eb10c2b23e1 Merge: 1d1665279a845 d3205ab75e99a Author: Jens Axboe Date: Thu Apr 6 08:12:19 2023 -0600 Merge tag 'nvme-6.3-2023-04-06' of git://git.infradead.org/nvme into block-6.3 Pull NVMe fix from Christoph: "nvme fixes for Linux 6.3 - fix discard support without oncs (Keith Busch)" * tag 'nvme-6.3-2023-04-06' of git://git.infradead.org/nvme: nvme: fix discard support without oncs commit 1d1665279a845d16c93687389e364386e3fe0f38 Author: Ming Lei Date: Thu Apr 6 20:40:59 2023 +0800 block: ublk: make sure that block size is set correctly block size is one very key setting for block layer, and bad block size could panic kernel easily. Make sure that block size is set correctly. Meantime if ublk_validate_params() fails, clear ub->params so that disk is prevented from being added. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reported-and-tested-by: Breno Leitao Signed-off-by: Ming Lei Signed-off-by: Jens Axboe commit af0acf22aea359e04412237d68787401f96bb583 Author: Chen Aotian Date: Thu Apr 6 12:01:51 2023 +0800 netfilter: nf_tables: Modify nla_memdup's flag to GFP_KERNEL_ACCOUNT For memory alloc that store user data from nla[NFTA_OBJ_USERDATA], use GFP_KERNEL_ACCOUNT is more suitable. Fixes: 33758c891479 ("memcg: enable accounting for nft objects") Signed-off-by: Chen Aotian Signed-off-by: Pablo Neira Ayuso commit 94623f579ce338b5fa61b5acaa5beb8aa657fb9e Author: Florian Westphal Date: Mon Apr 3 13:54:37 2023 +0200 netfilter: br_netfilter: fix recent physdev match breakage Recent attempt to ensure PREROUTING hook is executed again when a decrypted ipsec packet received on a bridge passes through the network stack a second time broke the physdev match in INPUT hook. We can't discard the nf_bridge info strct from sabotage_in hook, as this is needed by the physdev match. Keep the struct around and handle this with another conditional instead. Fixes: 2b272bb558f1 ("netfilter: br_netfilter: disable sabotage_in hook after first suppression") Reported-and-tested-by: Farid BENAMROUCHE Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a425efcb6e07929e16813453a98b69f719502218 Merge: a3c40af4a7ea4 86d5b27b37925 Author: Arnd Bergmann Date: Thu Apr 6 10:18:39 2023 +0200 Merge tag 'imx-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.3, 2nd round: - Fix 'reg' address length for i.MX8MP LCDIF2 device. - A couple of changes from Fabio Estevam to fix DTC warnings caused unnecessary address/size cells. - Re-enable PCI driver support in imx_v6_v7_defconfig. - Fix PMIC clock source property for imx8mm-evk board. - A couple of fixes from Peng Fan to correct off-on delay property for i.MX8 Verdin boards. * tag 'imx-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: imx_v6_v7_defconfig: Fix unintentional disablement of PCI ARM: dts: imx6ull-colibri: Remove unnecessary #address-cells/#size-cells ARM: dts: imx7d-remarkable2: Remove unnecessary #address-cells/#size-cells arm64: dts: imx8mp-verdin: correct off-on-delay arm64: dts: imx8mm-verdin: correct off-on-delay arm64: dts: imx8mm-evk: correct pmic clock source arm64: dts: imx8mp: fix address length for LCDIF2 Link: https://lore.kernel.org/r/20230406021602.GP11367@dragon Signed-off-by: Arnd Bergmann commit 8dd13214a810c695044aa168c0ddba1a9c433e4f Author: Oswald Buddenhagen Date: Wed Apr 5 22:12:20 2023 +0200 ALSA: emu10k1: don't create old pass-through playback device on Audigy It could have never worked, as snd_emu10k1_fx8010_playback_prepare() and snd_emu10k1_fx8010_playback_hw_free() assume the emu10k1 offset for the ETRAM, and the default DSP code includes no handler for it. It also wouldn't make a lot of sense to make it work, as Audigy has an own, much simpler, pass-through mechanism. So just skip creation of the device. Signed-off-by: Oswald Buddenhagen Cc: Link: https://lore.kernel.org/r/20230405201220.2197938-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit b09c551c77c7e01dc6e4f3c8bf06b5ffa7b06db5 Author: Oswald Buddenhagen Date: Wed Apr 5 22:12:20 2023 +0200 ALSA: emu10k1: fix capture interrupt handler unlinking Due to two copy/pastos, closing the MIC or EFX capture device would make a running ADC capture hang due to unsetting its interrupt handler. In principle, this would have also allowed dereferencing dangling pointers, but we're actually rather thorough at disabling and flushing the ints. While it may sound like one, this actually wasn't a hypothetical bug: PortAudio will open a capture stream at startup (and close it right away) even if not asked to. If the first device is busy, it will just proceed with the next one ... thus killing a concurrent capture. Signed-off-by: Oswald Buddenhagen Cc: Link: https://lore.kernel.org/r/20230405201220.2197923-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit f342ac00da1064eb4f94b1f4bcacbdfea955797a Author: Oswald Buddenhagen Date: Wed Apr 5 22:12:20 2023 +0200 ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards The BIOS botches this one completely - it says the 2nd S/PDIF output is used, while in fact it's the 1st one. This is tested on DP45SG, but I'm assuming it's valid for the other boards in the series as well. Also add some comments regarding the pins. FWIW, the codec is apparently still sold by Tempo Semiconductor, Inc., where one can download the documentation. Signed-off-by: Oswald Buddenhagen Cc: Link: https://lore.kernel.org/r/20230405201220.2197826-2-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit c17f8fd31700392b1bb9e7b66924333568cb3700 Author: Oswald Buddenhagen Date: Wed Apr 5 22:12:19 2023 +0200 ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard Like the other boards from the D*45* series, this one sets up the outputs not quite correctly. Signed-off-by: Oswald Buddenhagen Cc: Link: https://lore.kernel.org/r/20230405201220.2197826-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit e98e7a82bca2b6dce3e03719cff800ec913f9af7 Author: Oswald Buddenhagen Date: Wed Apr 5 22:12:19 2023 +0200 ALSA: i2c/cs8427: fix iec958 mixer control deactivation snd_cs8427_iec958_active() would always delete SNDRV_CTL_ELEM_ACCESS_INACTIVE, even though the function has an argument `active`. Signed-off-by: Oswald Buddenhagen Cc: Link: https://lore.kernel.org/r/20230405201219.2197811-1-oswald.buddenhagen@gmx.de Signed-off-by: Takashi Iwai commit 8c68ae3b22fa6fb2dbe83ef955ff10936503d28e Author: Jens Axboe Date: Wed Apr 5 20:00:46 2023 -0600 ublk: read any SQE values upfront Since SQE memory is shared with userspace, we should only be reading it once. We cannot read it multiple times, particularly when it's read once for validation and then read again for the actual use. ublk_ch_uring_cmd() is safe when called as a retry operation, as the memory backing is stable at that point. But for normal issue, we want to ensure that we only read ublksrv_io_cmd once. Wrap the function in a helper that reads the value into an on-stack copy of the struct. Cc: stable@vger.kernel.org # 6.0+ Reviewed-by: Ming Lei Signed-off-by: Jens Axboe commit 24e3fce00c0b557491ff596c0682a29dee6fe848 Author: Song Yoong Siang Date: Tue Apr 4 12:48:23 2023 +0800 net: stmmac: Add queue reset into stmmac_xdp_open() function Queue reset was moved out from __init_dma_rx_desc_rings() and __init_dma_tx_desc_rings() functions. Thus, the driver fails to transmit and receive packet after XDP prog setup. This commit adds the missing queue reset into stmmac_xdp_open() function. Fixes: f9ec5723c3db ("net: ethernet: stmicro: stmmac: move queue reset to dedicated functions") Cc: # 6.0+ Signed-off-by: Song Yoong Siang Reviewed-by: Alexander Duyck Link: https://lore.kernel.org/r/20230404044823.3226144-1-yoong.siang.song@intel.com Signed-off-by: Jakub Kicinski commit 38e058cc7d245dc8034426415bee8fec16ace1bd Author: Hangbin Liu Date: Tue Apr 4 15:24:11 2023 +0800 selftests: net: rps_default_mask.sh: delete veth link specifically When deleting the netns and recreating a new one while re-adding the veth interface, there is a small window of time during which the old veth interface has not yet been removed. This can cause the new addition to fail. To resolve this issue, we can either wait for a short while to ensure that the old veth interface is deleted, or we can specifically remove the veth interface. Before this patch: # ./rps_default_mask.sh empty rps_default_mask [ ok ] changing rps_default_mask dont affect existing devices [ ok ] changing rps_default_mask dont affect existing netns [ ok ] changing rps_default_mask affect newly created devices [ ok ] changing rps_default_mask don't affect newly child netns[II][ ok ] rps_default_mask is 0 by default in child netns [ ok ] RTNETLINK answers: File exists changing rps_default_mask in child ns don't affect the main one[ ok ] cat: /sys/class/net/vethC11an1/queues/rx-0/rps_cpus: No such file or directory changing rps_default_mask in child ns affects new childns devices./rps_default_mask.sh: line 36: [: -eq: unary operator expected [fail] expected 1 found changing rps_default_mask in child ns don't affect existing devices[ ok ] After this patch: # ./rps_default_mask.sh empty rps_default_mask [ ok ] changing rps_default_mask dont affect existing devices [ ok ] changing rps_default_mask dont affect existing netns [ ok ] changing rps_default_mask affect newly created devices [ ok ] changing rps_default_mask don't affect newly child netns[II][ ok ] rps_default_mask is 0 by default in child netns [ ok ] changing rps_default_mask in child ns don't affect the main one[ ok ] changing rps_default_mask in child ns affects new childns devices[ ok ] changing rps_default_mask in child ns don't affect existing devices[ ok ] Fixes: 3a7d84eae03b ("self-tests: more rps self tests") Signed-off-by: Hangbin Liu Acked-by: Paolo Abeni Link: https://lore.kernel.org/r/20230404072411.879476-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit abc33494ddd5c1e4bd0e17c4abe361038fb6693f Author: Greg Ungerer Date: Tue Apr 4 15:22:07 2023 +1000 net: fec: make use of MDIO C45 quirk Not all fec MDIO bus drivers support C45 mode transactions. The older fec hardware block in many ColdFire SoCs does not appear to support them, at least according to most of the different ColdFire SoC reference manuals. The bits used to generate C45 access on the iMX parts, in the OP field of the MMFR register, are documented as generating non-compliant MII frames (it is not documented as to exactly how they are non-compliant). Commit 8d03ad1ab0b0 ("net: fec: Separate C22 and C45 transactions") means the fec driver will always register c45 MDIO read and write methods. During probe these will always be accessed now generating non-compliant MII accesses on ColdFire based devices. Add a quirk define, FEC_QUIRK_HAS_MDIO_C45, that can be used to distinguish silicon that supports MDIO C45 framing or not. Add this to all the existing iMX quirks, so they will be behave as they do now (*). (*) it seems that some iMX parts may not support C45 transactions either. The iMX25 and iMX50 Reference Manuals contain similar wording to the ColdFire Reference Manuals on this. Fixes: 8d03ad1ab0b0 ("net: fec: Separate C22 and C45 transactions") Signed-off-by: Greg Ungerer Reviewed-by: Wei Fang Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230404052207.3064861-1-gerg@linux-m68k.org Signed-off-by: Jakub Kicinski commit 86d5b27b379256cd5d48974b4cd7ad03091eea6b Author: Fabio Estevam Date: Tue Apr 4 09:13:03 2023 -0300 ARM: imx_v6_v7_defconfig: Fix unintentional disablement of PCI Since commit 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") the i.MX6 PCI driver is no longer selected by default. The existing PCI_IMX6 was made a hidden option, selected by new options PCI_IMX6_HOST (for the existing support) and PCI_IMX6_EP (for the endpoint mode), but there has been no corresponding update to imx_v6_v7_defconfig so the PCI_IMX6 ends up getting disabled. Switch imx_v6_v7_defconfig to PCI_IMX6_HOST to preserve the existing functionality. This is based on the same fix done in commit 0cd5780eb625 ("arm64: defconfig: Fix unintentional disablement of PCI on i.MX"). Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") Reported-by: Mattias Barthel Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit c45ea315a602d45569b08b93e9ab30f6a63a38aa Author: Peng Zhang Date: Tue Mar 14 20:42:03 2023 +0800 maple_tree: fix a potential concurrency bug in RCU mode There is a concurrency bug that may cause the wrong value to be loaded when a CPU is modifying the maple tree. CPU1: mtree_insert_range() mas_insert() mas_store_root() ... mas_root_expand() ... rcu_assign_pointer(mas->tree->ma_root, mte_mk_root(mas->node)); ma_set_meta(node, maple_leaf_64, 0, slot); <---IP CPU2: mtree_load() mtree_lookup_walk() ma_data_end(); When CPU1 is about to execute the instruction pointed to by IP, the ma_data_end() executed by CPU2 may return the wrong end position, which will cause the value loaded by mtree_load() to be wrong. An example of triggering the bug: Add mdelay(100) between rcu_assign_pointer() and ma_set_meta() in mas_root_expand(). static DEFINE_MTREE(tree); int work(void *p) { unsigned long val; for (int i = 0 ; i< 30; ++i) { val = (unsigned long)mtree_load(&tree, 8); mdelay(5); pr_info("%lu",val); } return 0; } mt_init_flags(&tree, MT_FLAGS_USE_RCU); mtree_insert(&tree, 0, (void*)12345, GFP_KERNEL); run_thread(work) mtree_insert(&tree, 1, (void*)56789, GFP_KERNEL); In RCU mode, mtree_load() should always return the value before or after the data structure is modified, and in this example mtree_load(&tree, 8) may return 56789 which is not expected, it should always return NULL. Fix it by put ma_set_meta() before rcu_assign_pointer(). Link: https://lkml.kernel.org/r/20230314124203.91572-4-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Reviewed-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit ec07967d7523adb3670f9dfee0232e3bc868f3de Author: Peng Zhang Date: Tue Mar 14 20:42:01 2023 +0800 maple_tree: fix get wrong data_end in mtree_lookup_walk() if (likely(offset > end)) max = pivots[offset]; The above code should be changed to if (likely(offset < end)), which is correct. This affects the correctness of ma_data_end(). Now it seems that the final result will not be wrong, but it is best to change it. This patch does not change the code as above, because it simplifies the code by the way. Link: https://lkml.kernel.org/r/20230314124203.91572-1-zhangpeng.00@bytedance.com Link: https://lkml.kernel.org/r/20230314124203.91572-2-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Reviewed-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit 6fe7d6b992113719e96744d974212df3fcddc76c Author: Rongwei Wang Date: Tue Apr 4 23:47:16 2023 +0800 mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to the available list, which can lead to memory corruption. The only place we have found where this happens is in the swapoff path. This case can be described as below: core 0 core 1 swapoff del_from_avail_list(si) waiting try lock si->lock acquire swap_avail_lock and re-add si into swap_avail_head acquire si->lock but missing si already being added again, and continuing to clear SWP_WRITEOK, etc. It can be easily found that a massive warning messages can be triggered inside get_swap_pages() by some special cases, for example, we call madvise(MADV_PAGEOUT) on blocks of touched memory concurrently, meanwhile, run much swapon-swapoff operations (e.g. stress-ng-swap). However, in the worst case, panic can be caused by the above scene. In swapoff(), the memory used by si could be kept in swap_info[] after turning off a swap. This means memory corruption will not be caused immediately until allocated and reset for a new swap in the swapon path. A panic message caused: (with CONFIG_PLIST_DEBUG enabled) ------------[ cut here ]------------ top: 00000000e58a3003, n: 0000000013e75cda, p: 000000008cd4451a prev: 0000000035b1e58a, n: 000000008cd4451a, p: 000000002150ee8d next: 000000008cd4451a, n: 000000008cd4451a, p: 000000008cd4451a WARNING: CPU: 21 PID: 1843 at lib/plist.c:60 plist_check_prev_next_node+0x50/0x70 Modules linked in: rfkill(E) crct10dif_ce(E)... CPU: 21 PID: 1843 Comm: stress-ng Kdump: ... 5.10.134+ Hardware name: Alibaba Cloud ECS, BIOS 0.0.0 02/06/2015 pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) pc : plist_check_prev_next_node+0x50/0x70 lr : plist_check_prev_next_node+0x50/0x70 sp : ffff0018009d3c30 x29: ffff0018009d3c40 x28: ffff800011b32a98 x27: 0000000000000000 x26: ffff001803908000 x25: ffff8000128ea088 x24: ffff800011b32a48 x23: 0000000000000028 x22: ffff001800875c00 x21: ffff800010f9e520 x20: ffff001800875c00 x19: ffff001800fdc6e0 x18: 0000000000000030 x17: 0000000000000000 x16: 0000000000000000 x15: 0736076307640766 x14: 0730073007380731 x13: 0736076307640766 x12: 0730073007380731 x11: 000000000004058d x10: 0000000085a85b76 x9 : ffff8000101436e4 x8 : ffff800011c8ce08 x7 : 0000000000000000 x6 : 0000000000000001 x5 : ffff0017df9ed338 x4 : 0000000000000001 x3 : ffff8017ce62a000 x2 : ffff0017df9ed340 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: plist_check_prev_next_node+0x50/0x70 plist_check_head+0x80/0xf0 plist_add+0x28/0x140 add_to_avail_list+0x9c/0xf0 _enable_swap_info+0x78/0xb4 __do_sys_swapon+0x918/0xa10 __arm64_sys_swapon+0x20/0x30 el0_svc_common+0x8c/0x220 do_el0_svc+0x2c/0x90 el0_svc+0x1c/0x30 el0_sync_handler+0xa8/0xb0 el0_sync+0x148/0x180 irq event stamp: 2082270 Now, si->lock locked before calling 'del_from_avail_list()' to make sure other thread see the si had been deleted and SWP_WRITEOK cleared together, will not reinsert again. This problem exists in versions after stable 5.10.y. Link: https://lkml.kernel.org/r/20230404154716.23058-1-rongwei.wang@linux.alibaba.com Fixes: a2468cc9bfdff ("swap: choose swap device according to numa node") Tested-by: Yongchen Yin Signed-off-by: Rongwei Wang Cc: Bagas Sanjaya Cc: Matthew Wilcox (Oracle) Cc: Aaron Lu Cc: Signed-off-by: Andrew Morton commit 42560f9c92cc43dce75dbf06cc0d840dced39b12 Author: Ryusuke Konishi Date: Fri Mar 31 05:55:15 2023 +0900 nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, use-after-free, and lockdep warnings. Some of the sysfs attributes for nilfs2 per-filesystem instance refer to metadata file "cpfile", "sufile", or "dat", but nilfs_sysfs_create_device_group that creates those attributes is executed before the inodes for these metadata files are loaded, and nilfs_sysfs_delete_device_group which deletes these sysfs entries is called after releasing their metadata file inodes. Therefore, access to some of these sysfs attributes may occur outside of the lifetime of these metadata files, resulting in inode NULL pointer dereferences or use-after-free. In addition, the call to nilfs_sysfs_create_device_group() is made during the locking period of the semaphore "ns_sem" of nilfs object, so the shrinker call caused by the memory allocation for the sysfs entries, may derive lock dependencies "ns_sem" -> (shrinker) -> "locks acquired in nilfs_evict_inode()". Since nilfs2 may acquire "ns_sem" deep in the call stack holding other locks via its error handler __nilfs_error(), this causes lockdep to report circular locking. This is a false positive and no circular locking actually occurs as no inodes exist yet when nilfs_sysfs_create_device_group() is called. Fortunately, the lockdep warnings can be resolved by simply moving the call to nilfs_sysfs_create_device_group() out of "ns_sem". This fixes these sysfs issues by revising where the device's sysfs interface is created/deleted and keeping its lifetime within the lifetime of the metadata files above. Link: https://lkml.kernel.org/r/20230330205515.6167-1-konishi.ryusuke@gmail.com Fixes: dd70edbde262 ("nilfs2: integrate sysfs support into driver") Signed-off-by: Ryusuke Konishi Reported-by: syzbot+979fa7f9c0d086fdc282@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/0000000000003414b505f7885f7e@google.com Reported-by: syzbot+5b7d542076d9bddc3c6a@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/0000000000006ac86605f5f44eb9@google.com Cc: Viacheslav Dubeyko Cc: Signed-off-by: Andrew Morton commit 7c7b962938ddda6a9cd095de557ee5250706ea88 Author: Alistair Popple Date: Thu Mar 30 12:25:19 2023 +1100 mm: take a page reference when removing device exclusive entries Device exclusive page table entries are used to prevent CPU access to a page whilst it is being accessed from a device. Typically this is used to implement atomic operations when the underlying bus does not support atomic access. When a CPU thread encounters a device exclusive entry it locks the page and restores the original entry after calling mmu notifiers to signal drivers that exclusive access is no longer available. The device exclusive entry holds a reference to the page making it safe to access the struct page whilst the entry is present. However the fault handling code does not hold the PTL when taking the page lock. This means if there are multiple threads faulting concurrently on the device exclusive entry one will remove the entry whilst others will wait on the page lock without holding a reference. This can lead to threads locking or waiting on a folio with a zero refcount. Whilst mmap_lock prevents the pages getting freed via munmap() they may still be freed by a migration. This leads to warnings such as PAGE_FLAGS_CHECK_AT_FREE due to the page being locked when the refcount drops to zero. Fix this by trying to take a reference on the folio before locking it. The code already checks the PTE under the PTL and aborts if the entry is no longer there. It is also possible the folio has been unmapped, freed and re-allocated allowing a reference to be taken on an unrelated folio. This case is also detected by the PTE check and the folio is unlocked without further changes. Link: https://lkml.kernel.org/r/20230330012519.804116-1-apopple@nvidia.com Fixes: b756a3b5e7ea ("mm: device exclusive memory access") Signed-off-by: Alistair Popple Reviewed-by: Ralph Campbell Reviewed-by: John Hubbard Acked-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Christoph Hellwig Cc: Signed-off-by: Andrew Morton commit f349b15e183d6956f1b63d6ff57849ff10c7edd5 Author: Yafang Shao Date: Thu Mar 30 16:26:25 2023 +0000 mm: vmalloc: avoid warn_alloc noise caused by fatal signal There're some suspicious warn_alloc on my test serer, for example, [13366.518837] warn_alloc: 81 callbacks suppressed [13366.518841] test_verifier: vmalloc error: size 4096, page order 0, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [13366.522240] CPU: 30 PID: 722463 Comm: test_verifier Kdump: loaded Tainted: G W O 6.2.0+ #638 [13366.524216] Call Trace: [13366.524702] [13366.525148] dump_stack_lvl+0x6c/0x80 [13366.525712] dump_stack+0x10/0x20 [13366.526239] warn_alloc+0x119/0x190 [13366.526783] ? alloc_pages_bulk_array_mempolicy+0x9e/0x2a0 [13366.527470] __vmalloc_area_node+0x546/0x5b0 [13366.528066] __vmalloc_node_range+0xc2/0x210 [13366.528660] __vmalloc_node+0x42/0x50 [13366.529186] ? bpf_prog_realloc+0x53/0xc0 [13366.529743] __vmalloc+0x1e/0x30 [13366.530235] bpf_prog_realloc+0x53/0xc0 [13366.530771] bpf_patch_insn_single+0x80/0x1b0 [13366.531351] bpf_jit_blind_constants+0xe9/0x1c0 [13366.531932] ? __free_pages+0xee/0x100 [13366.532457] ? free_large_kmalloc+0x58/0xb0 [13366.533002] bpf_int_jit_compile+0x8c/0x5e0 [13366.533546] bpf_prog_select_runtime+0xb4/0x100 [13366.534108] bpf_prog_load+0x6b1/0xa50 [13366.534610] ? perf_event_task_tick+0x96/0xb0 [13366.535151] ? security_capable+0x3a/0x60 [13366.535663] __sys_bpf+0xb38/0x2190 [13366.536120] ? kvm_clock_get_cycles+0x9/0x10 [13366.536643] __x64_sys_bpf+0x1c/0x30 [13366.537094] do_syscall_64+0x38/0x90 [13366.537554] entry_SYSCALL_64_after_hwframe+0x72/0xdc [13366.538107] RIP: 0033:0x7f78310f8e29 [13366.538561] Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 17 e0 2c 00 f7 d8 64 89 01 48 [13366.540286] RSP: 002b:00007ffe2a61fff8 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [13366.541031] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f78310f8e29 [13366.541749] RDX: 0000000000000080 RSI: 00007ffe2a6200b0 RDI: 0000000000000005 [13366.542470] RBP: 00007ffe2a620010 R08: 00007ffe2a6202a0 R09: 00007ffe2a6200b0 [13366.543183] R10: 00000000000f423e R11: 0000000000000206 R12: 0000000000407800 [13366.543900] R13: 00007ffe2a620540 R14: 0000000000000000 R15: 0000000000000000 [13366.544623] [13366.545260] Mem-Info: [13366.546121] active_anon:81319 inactive_anon:20733 isolated_anon:0 active_file:69450 inactive_file:5624 isolated_file:0 unevictable:0 dirty:10 writeback:0 slab_reclaimable:69649 slab_unreclaimable:48930 mapped:27400 shmem:12868 pagetables:4929 sec_pagetables:0 bounce:0 kernel_misc_reclaimable:0 free:15870308 free_pcp:142935 free_cma:0 [13366.551886] Node 0 active_anon:224836kB inactive_anon:33528kB active_file:175692kB inactive_file:13752kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:59248kB dirty:32kB writeback:0kB shmem:18252kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:4616kB pagetables:10664kB sec_pagetables:0kB all_unreclaimable? no [13366.555184] Node 1 active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:50352kB dirty:8kB writeback:0kB shmem:33220kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:3896kB pagetables:9052kB sec_pagetables:0kB all_unreclaimable? no [13366.558262] Node 0 DMA free:15360kB boost:0kB min:304kB low:380kB high:456kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [13366.560821] lowmem_reserve[]: 0 2735 31873 31873 31873 [13366.561981] Node 0 DMA32 free:2790904kB boost:0kB min:56028kB low:70032kB high:84036kB reserved_highatomic:0KB active_anon:1936kB inactive_anon:20kB active_file:396kB inactive_file:344kB unevictable:0kB writepending:0kB present:3129200kB managed:2801520kB mlocked:0kB bounce:0kB free_pcp:5188kB local_pcp:0kB free_cma:0kB [13366.565148] lowmem_reserve[]: 0 0 29137 29137 29137 [13366.566168] Node 0 Normal free:28533824kB boost:0kB min:596740kB low:745924kB high:895108kB reserved_highatomic:28672KB active_anon:222900kB inactive_anon:33508kB active_file:175296kB inactive_file:13408kB unevictable:0kB writepending:32kB present:30408704kB managed:29837172kB mlocked:0kB bounce:0kB free_pcp:295724kB local_pcp:0kB free_cma:0kB [13366.569485] lowmem_reserve[]: 0 0 0 0 0 [13366.570416] Node 1 Normal free:32141144kB boost:0kB min:660504kB low:825628kB high:990752kB reserved_highatomic:69632KB active_anon:100440kB inactive_anon:49404kB active_file:102108kB inactive_file:8744kB unevictable:0kB writepending:8kB present:33554432kB managed:33025372kB mlocked:0kB bounce:0kB free_pcp:270880kB local_pcp:46860kB free_cma:0kB [13366.573403] lowmem_reserve[]: 0 0 0 0 0 [13366.574015] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [13366.575474] Node 0 DMA32: 782*4kB (UME) 756*8kB (UME) 736*16kB (UME) 745*32kB (UME) 694*64kB (UME) 653*128kB (UME) 595*256kB (UME) 552*512kB (UME) 454*1024kB (UME) 347*2048kB (UME) 246*4096kB (UME) = 2790904kB [13366.577442] Node 0 Normal: 33856*4kB (UMEH) 51815*8kB (UMEH) 42418*16kB (UMEH) 36272*32kB (UMEH) 22195*64kB (UMEH) 10296*128kB (UMEH) 7238*256kB (UMEH) 5638*512kB (UEH) 5337*1024kB (UMEH) 3506*2048kB (UMEH) 1470*4096kB (UME) = 28533784kB [13366.580460] Node 1 Normal: 15776*4kB (UMEH) 37485*8kB (UMEH) 29509*16kB (UMEH) 21420*32kB (UMEH) 14818*64kB (UMEH) 13051*128kB (UMEH) 9918*256kB (UMEH) 7374*512kB (UMEH) 5397*1024kB (UMEH) 3887*2048kB (UMEH) 2002*4096kB (UME) = 32141240kB [13366.583027] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [13366.584380] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [13366.585702] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [13366.587042] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [13366.588372] 87386 total pagecache pages [13366.589266] 0 pages in swap cache [13366.590327] Free swap = 0kB [13366.591227] Total swap = 0kB [13366.592142] 16777082 pages RAM [13366.593057] 0 pages HighMem/MovableOnly [13366.594037] 357226 pages reserved [13366.594979] 0 pages hwpoisoned This failure really confuse me as there're still lots of available pages. Finally I figured out it was caused by a fatal signal. When a process is allocating memory via vm_area_alloc_pages(), it will break directly even if it hasn't allocated the requested pages when it receives a fatal signal. In that case, we shouldn't show this warn_alloc, as it is useless. We only need to show this warning when there're really no enough pages. Link: https://lkml.kernel.org/r/20230330162625.13604-1-laoar.shao@gmail.com Signed-off-by: Yafang Shao Reviewed-by: Lorenzo Stoakes Cc: Christoph Hellwig Cc: Uladzislau Rezki (Sony) Cc: Signed-off-by: Andrew Morton commit 7397031622e05ca206e2d674ec199d6bb66fc9ba Author: Tetsuo Handa Date: Mon Mar 27 00:21:46 2023 +0900 nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field nilfs_btree_assign_p() and nilfs_direct_assign_p() are not initializing "struct nilfs_binfo_dat"->bi_pad field, causing uninit-value reports when being passed to CRC function. Link: https://lkml.kernel.org/r/20230326152146.15872-1-konishi.ryusuke@gmail.com Reported-by: syzbot Link: https://syzkaller.appspot.com/bug?extid=048585f3f4227bb2b49b Reported-by: Dipanjan Das Link: https://lkml.kernel.org/r/CANX2M5bVbzRi6zH3PTcNE_31TzerstOXUa9Bay4E6y6dX23_pg@mail.gmail.com Signed-off-by: Tetsuo Handa Signed-off-by: Ryusuke Konishi Cc: Alexander Potapenko Signed-off-by: Andrew Morton commit 6be49d100c22ffea3287a4b19d7639d259888e33 Author: Ryusuke Konishi Date: Tue Mar 28 02:53:18 2023 +0900 nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() The finalization of nilfs_segctor_thread() can race with nilfs_segctor_kill_thread() which terminates that thread, potentially causing a use-after-free BUG as KASAN detected. At the end of nilfs_segctor_thread(), it assigns NULL to "sc_task" member of "struct nilfs_sc_info" to indicate the thread has finished, and then notifies nilfs_segctor_kill_thread() of this using waitqueue "sc_wait_task" on the struct nilfs_sc_info. However, here, immediately after the NULL assignment to "sc_task", it is possible that nilfs_segctor_kill_thread() will detect it and return to continue the deallocation, freeing the nilfs_sc_info structure before the thread does the notification. This fixes the issue by protecting the NULL assignment to "sc_task" and its notification, with spinlock "sc_state_lock" of the struct nilfs_sc_info. Since nilfs_segctor_kill_thread() does a final check to see if "sc_task" is NULL with "sc_state_lock" locked, this can eliminate the race. Link: https://lkml.kernel.org/r/20230327175318.8060-1-konishi.ryusuke@gmail.com Reported-by: syzbot+b08ebcc22f8f3e6be43a@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/00000000000000660d05f7dfa877@google.com Signed-off-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 618a8a917dbf5830e2064d2fa0568940eb5d2584 Author: Sergey Senozhatsky Date: Sat Mar 25 11:46:31 2023 +0900 zsmalloc: document freeable stats When freeable class stat was added to classes file (back in 2016) we forgot to update zsmalloc documentation. Fix that. Link: https://lkml.kernel.org/r/20230325024631.2817153-3-senozhatsky@chromium.org Fixes: 1120ed548394 ("mm/zsmalloc: add `freeable' column to pool stat") Signed-off-by: Sergey Senozhatsky Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton commit 119b57eaf09478ce9e2a8f88a12749c2658b0ed5 Author: Sergey Senozhatsky Date: Sat Mar 25 11:46:30 2023 +0900 zsmalloc: document new fullness grouping Patch series "zsmalloc: minor documentation updates". Two minor patches that bring zsmalloc documentation up to date. This patch (of 2): Update documentation and reflect new zspages fullness grouping (we don't use almost_empty and almost_full anymore). Link: https://lkml.kernel.org/r/20230325024631.2817153-1-senozhatsky@chromium.org Link: https://lkml.kernel.org/r/20230325024631.2817153-2-senozhatsky@chromium.org Signed-off-by: Sergey Senozhatsky Fixes: 67e157eb3639 ("zsmalloc: show per fullness group class stats") Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton commit f76b3a32879de215ced3f8c754c4077b0c2f79e3 Author: Shiyang Ruan Date: Fri Mar 24 10:28:00 2023 +0000 fsdax: force clear dirty mark if CoW XFS allows CoW on non-shared extents to combat fragmentation[1]. The old non-shared extent could be mwrited before, its dax entry is marked dirty. This results in a WARNing: [ 28.512349] ------------[ cut here ]------------ [ 28.512622] WARNING: CPU: 2 PID: 5255 at fs/dax.c:390 dax_insert_entry+0x342/0x390 [ 28.513050] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables [ 28.515462] CPU: 2 PID: 5255 Comm: fsstress Kdump: loaded Not tainted 6.3.0-rc1-00001-g85e1481e19c1-dirty #117 [ 28.515902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.1-1-1 04/01/2014 [ 28.516307] RIP: 0010:dax_insert_entry+0x342/0x390 [ 28.516536] Code: 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 8b 45 20 48 83 c0 01 e9 e2 fe ff ff 48 8b 45 20 48 83 c0 01 e9 cd fe ff ff <0f> 0b e9 53 ff ff ff 48 8b 7c 24 08 31 f6 e8 1b 61 a1 00 eb 8c 48 [ 28.517417] RSP: 0000:ffffc9000845fb18 EFLAGS: 00010086 [ 28.517721] RAX: 0000000000000053 RBX: 0000000000000155 RCX: 000000000018824b [ 28.518113] RDX: 0000000000000000 RSI: ffffffff827525a6 RDI: 00000000ffffffff [ 28.518515] RBP: ffffea00062092c0 R08: 0000000000000000 R09: ffffc9000845f9c8 [ 28.518905] R10: 0000000000000003 R11: ffffffff82ddb7e8 R12: 0000000000000155 [ 28.519301] R13: 0000000000000000 R14: 000000000018824b R15: ffff88810cfa76b8 [ 28.519703] FS: 00007f14a0c94740(0000) GS:ffff88817bd00000(0000) knlGS:0000000000000000 [ 28.520148] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.520472] CR2: 00007f14a0c8d000 CR3: 000000010321c004 CR4: 0000000000770ee0 [ 28.520863] PKRU: 55555554 [ 28.521043] Call Trace: [ 28.521219] [ 28.521368] dax_fault_iter+0x196/0x390 [ 28.521595] dax_iomap_pte_fault+0x19b/0x3d0 [ 28.521852] __xfs_filemap_fault+0x234/0x2b0 [ 28.522116] __do_fault+0x30/0x130 [ 28.522334] do_fault+0x193/0x340 [ 28.522586] __handle_mm_fault+0x2d3/0x690 [ 28.522975] handle_mm_fault+0xe6/0x2c0 [ 28.523259] do_user_addr_fault+0x1bc/0x6f0 [ 28.523521] exc_page_fault+0x60/0x140 [ 28.523763] asm_exc_page_fault+0x22/0x30 [ 28.524001] RIP: 0033:0x7f14a0b589ca [ 28.524225] Code: c5 fe 7f 07 c5 fe 7f 47 20 c5 fe 7f 47 40 c5 fe 7f 47 60 c5 f8 77 c3 66 0f 1f 84 00 00 00 00 00 40 0f b6 c6 48 89 d1 48 89 fa aa 48 89 d0 c5 f8 77 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 [ 28.525198] RSP: 002b:00007fff1dea1c98 EFLAGS: 00010202 [ 28.525505] RAX: 000000000000001e RBX: 000000000014a000 RCX: 0000000000006046 [ 28.525895] RDX: 00007f14a0c82000 RSI: 000000000000001e RDI: 00007f14a0c8d000 [ 28.526290] RBP: 000000000000006f R08: 0000000000000004 R09: 000000000014a000 [ 28.526681] R10: 0000000000000008 R11: 0000000000000246 R12: 028f5c28f5c28f5c [ 28.527067] R13: 8f5c28f5c28f5c29 R14: 0000000000011046 R15: 00007f14a0c946c0 [ 28.527449] [ 28.527600] ---[ end trace 0000000000000000 ]--- To be able to delete this entry, clear its dirty mark before invalidate_inode_pages2_range(). [1] https://lore.kernel.org/linux-xfs/20230321151339.GA11376@frogsfrogsfrogs/ Link: https://lkml.kernel.org/r/1679653680-2-1-git-send-email-ruansy.fnst@fujitsu.com Fixes: f80e1668888f3 ("fsdax: invalidate pages when CoW") Signed-off-by: Shiyang Ruan Cc: Dan Williams Cc: Darrick J. Wong Cc: Jan Kara Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit 60d5b473d61be61ac315e544fcd6a8234a79500e Author: Peter Xu Date: Tue Mar 21 15:18:40 2023 -0400 mm/hugetlb: fix uffd wr-protection for CoW optimization path This patch fixes an issue that a hugetlb uffd-wr-protected mapping can be writable even with uffd-wp bit set. It only happens with hugetlb private mappings, when someone firstly wr-protects a missing pte (which will install a pte marker), then a write to the same page without any prior access to the page. Userfaultfd-wp trap for hugetlb was implemented in hugetlb_fault() before reaching hugetlb_wp() to avoid taking more locks that userfault won't need. However there's one CoW optimization path that can trigger hugetlb_wp() inside hugetlb_no_page(), which will bypass the trap. This patch skips hugetlb_wp() for CoW and retries the fault if uffd-wp bit is detected. The new path will only trigger in the CoW optimization path because generic hugetlb_fault() (e.g. when a present pte was wr-protected) will resolve the uffd-wp bit already. Also make sure anonymous UNSHARE won't be affected and can still be resolved, IOW only skip CoW not CoR. This patch will be needed for v5.19+ hence copy stable. [peterx@redhat.com: v2] Link: https://lkml.kernel.org/r/ZBzOqwF2wrHgBVZb@x1n [peterx@redhat.com: v3] Link: https://lkml.kernel.org/r/20230324142620.2344140-1-peterx@redhat.com Link: https://lkml.kernel.org/r/20230321191840.1897940-1-peterx@redhat.com Fixes: 166f3ecc0daf ("mm/hugetlb: hook page faults for uffd write protection") Signed-off-by: Peter Xu Reported-by: Muhammad Usama Anjum Tested-by: Muhammad Usama Anjum Acked-by: David Hildenbrand Reviewed-by: Mike Kravetz Cc: Andrea Arcangeli Cc: Axel Rasmussen Cc: Mike Rapoport Cc: Nadav Amit Cc: Signed-off-by: Andrew Morton commit 3dd4432549415f3c65dd52d5c687629efbf4ece1 Author: Liam R. Howlett Date: Mon Feb 27 09:36:07 2023 -0800 mm: enable maple tree RCU mode by default Use the maple tree in RCU mode for VMA tracking. The maple tree tracks the stack and is able to update the pivot (lower/upper boundary) in-place to allow the page fault handler to write to the tree while holding just the mmap read lock. This is safe as the writes to the stack have a guard VMA which ensures there will always be a NULL in the direction of the growth and thus will only update a pivot. It is possible, but not recommended, to have VMAs that grow up/down without guard VMAs. syzbot has constructed a testcase which sets up a VMA to grow and consume the empty space. Overwriting the entire NULL entry causes the tree to be altered in a way that is not safe for concurrent readers; the readers may see a node being rewritten or one that does not match the maple state they are using. Enabling RCU mode allows the concurrent readers to see a stable node and will return the expected result. [Liam.Howlett@Oracle.com: we don't need to free the nodes with RCU[ Link: https://lore.kernel.org/linux-mm/000000000000b0a65805f663ace6@google.com/ Link: https://lkml.kernel.org/r/20230227173632.3292573-9-surenb@google.com Fixes: d4af56c5c7c6 ("mm: start tracking VMAs with maple tree") Signed-off-by: Liam R. Howlett Signed-off-by: Suren Baghdasaryan Reported-by: syzbot+8d95422d3537159ca390@syzkaller.appspotmail.com Cc: Signed-off-by: Andrew Morton commit 790e1fa86b340c2bd4a327e01c161f7a1ad885f6 Author: Liam R. Howlett Date: Mon Feb 27 09:36:06 2023 -0800 maple_tree: add RCU lock checking to rcu callback functions Dereferencing RCU objects within the RCU callback without the RCU check has caused lockdep to complain. Fix the RCU dereferencing by using the RCU callback lock to ensure the operation is safe. Also stop creating a new lock to use for dereferencing during destruction of the tree or subtree. Instead, pass through a pointer to the tree that has the lock that is held for RCU dereferencing checking. It also does not make sense to use the maple state in the freeing scenario as the tree walk is a special case where the tree no longer has the normal encodings and parent pointers. Link: https://lkml.kernel.org/r/20230227173632.3292573-8-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 0a2b18d948838e16912b3b627b504ab062b7d02a Author: Liam R. Howlett Date: Mon Feb 27 09:36:05 2023 -0800 maple_tree: add smp_rmb() to dead node detection Add an smp_rmb() before reading the parent pointer to ensure that anything read from the node prior to the parent pointer hasn't been reordered ahead of this check. The is necessary for RCU mode. Link: https://lkml.kernel.org/r/20230227173632.3292573-7-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Signed-off-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit c13af03de46ba27674dd9fb31a17c0d480081139 Author: Liam R. Howlett Date: Mon Feb 27 09:36:04 2023 -0800 maple_tree: fix write memory barrier of nodes once dead for RCU mode During the development of the maple tree, the strategy of freeing multiple nodes changed and, in the process, the pivots were reused to store pointers to dead nodes. To ensure the readers see accurate pivots, the writers need to mark the nodes as dead and call smp_wmb() to ensure any readers can identify the node as dead before using the pivot values. There were two places where the old method of marking the node as dead without smp_wmb() were being used, which resulted in RCU readers seeing the wrong pivot value before seeing the node was dead. Fix this race condition by using mte_set_node_dead() which has the smp_wmb() call to ensure the race is closed. Add a WARN_ON() to the ma_free_rcu() call to ensure all nodes being freed are marked as dead to ensure there are no other call paths besides the two updated paths. This is necessary for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-6-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Signed-off-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 8372f4d83f96f35915106093cde4565836587123 Author: Liam Howlett Date: Mon Feb 27 09:36:03 2023 -0800 maple_tree: remove extra smp_wmb() from mas_dead_leaves() The call to mte_set_dead_node() before the smp_wmb() already calls smp_wmb() so this is not needed. This is an optimization for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-5-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett Signed-off-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 2e5b4921f8efc9e845f4f04741797d16f36847eb Author: Liam Howlett Date: Mon Feb 27 09:36:02 2023 -0800 maple_tree: fix freeing of nodes in rcu mode The walk to destroy the nodes was not always setting the node type and would result in a destroy method potentially using the values as nodes. Avoid this by setting the correct node types. This is necessary for the RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-4-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett Signed-off-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit a7b92d59c885018cb7bb88539892278e4fd64b29 Author: Liam Howlett Date: Mon Feb 27 09:36:01 2023 -0800 maple_tree: detect dead nodes in mas_start() When initially starting a search, the root node may already be in the process of being replaced in RCU mode. Detect and restart the walk if this is the case. This is necessary for RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230227173632.3292573-3-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett Signed-off-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 39d0bd86c499ecd6abae42a9b7112056c5560691 Author: Liam Howlett Date: Mon Feb 27 09:36:00 2023 -0800 maple_tree: be more cautious about dead nodes Patch series "Fix VMA tree modification under mmap read lock". Syzbot reported a BUG_ON in mm/mmap.c which was found to be caused by an inconsistency between threads walking the VMA maple tree. The inconsistency is caused by the page fault handler modifying the maple tree while holding the mmap_lock for read. This only happens for stack VMAs. We had thought this was safe as it only modifies a single pivot in the tree. Unfortunately, syzbot constructed a test case where the stack had no guard page and grew the stack to abut the next VMA. This causes us to delete the NULL entry between the two VMAs and rewrite the node. We considered several options for fixing this, including dropping the mmap_lock, then reacquiring it for write; and relaxing the definition of the tree to permit a zero-length NULL entry in the node. We decided the best option was to backport some of the RCU patches from -next, which solve the problem by allocating a new node and RCU-freeing the old node. Since the problem exists in 6.1, we preferred a solution which is similar to the one we intended to merge next merge window. These patches have been in -next since next-20230301, and have received intensive testing in Android as part of the RCU page fault patchset. They were also sent as part of the "Per-VMA locks" v4 patch series. Patches 1 to 7 are bug fixes for RCU mode of the tree and patch 8 enables RCU mode for the tree. Performance v6.3-rc3 vs patched v6.3-rc3: Running these changes through mmtests showed there was a 15-20% performance decrease in will-it-scale/brk1-processes. This tests creating and inserting a single VMA repeatedly through the brk interface and isn't representative of any real world applications. This patch (of 8): ma_pivots() and ma_data_end() may be called with a dead node. Ensure to that the node isn't dead before using the returned values. This is necessary for RCU mode of the maple tree. Link: https://lkml.kernel.org/r/20230327185532.2354250-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20230227173632.3292573-1-surenb@google.com Link: https://lkml.kernel.org/r/20230227173632.3292573-2-surenb@google.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam Howlett Signed-off-by: Suren Baghdasaryan Cc: Andy Lutomirski Cc: Arjun Roy Cc: Axel Rasmussen Cc: Chris Li Cc: David Hildenbrand Cc: David Howells Cc: Davidlohr Bueso Cc: David Rientjes Cc: Eric Dumazet Cc: freak07 Cc: Greg Thelen Cc: Hugh Dickins Cc: Ingo Molnar Cc: Jann Horn Cc: Joel Fernandes Cc: Johannes Weiner Cc: Kent Overstreet Cc: Laurent Dufour Cc: Lorenzo Stoakes Cc: Matthew Wilcox Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Paul E. McKenney Cc: Peter Oskolkov Cc: Peter Xu Cc: Peter Zijlstra Cc: Punit Agrawal Cc: Sebastian Andrzej Siewior Cc: Shakeel Butt Cc: Soheil Hassas Yeganeh Cc: Song Liu Cc: Vlastimil Babka Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit cbeb1c1b68d99b1435a8784e66ea6dbfb530d7de Merge: b97ee72ac088b e6db67fa871de Author: Jakub Kicinski Date: Wed Apr 5 17:24:26 2023 -0700 Merge tag 'wireless-2023-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.3 mt76 has a fix for leaking cleartext frames on a certain scenario and two firmware file handling related fixes. For brcmfmac we have a fix for an older SDIO suspend regression and for ath11k avoiding a kernel crash during hibernation with SUSE kernels. * tag 'wireless-2023-04-05' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mt76: ignore key disable commands wifi: ath11k: reduce the MHI timeout to 20s wifi: mt76: mt7921: fix fw used for offload check for mt7922 wifi: mt76: mt7921: Fix use-after-free in fw features query. wifi: brcmfmac: Fix SDIO suspend/resume regression ==================== Link: https://lore.kernel.org/r/20230405105536.4E946C433D2@smtp.kernel.org Signed-off-by: Jakub Kicinski commit b97ee72ac088b45cc6be20f7a5f18d98408699c4 Merge: 4181b39ae1ffe 051737439eaee Author: Jakub Kicinski Date: Wed Apr 5 17:22:06 2023 -0700 Merge tag 'linux-can-fixes-for-6.3-20230405' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2023-04-05 The first patch is by Oleksij Rempel and fixes a out-of-bounds memory access in the j1939 protocol. The remaining 3 patches target the ISOTP protocol. Oliver Hartkopp fixes the ISOTP protocol to pass information about dropped PDUs to the user space via control messages. Michal Sojka's patch fixes poll() to not forward false EPOLLOUT events. And Oliver Hartkopp fixes a race condition between isotp_sendsmg() and isotp_release(). * tag 'linux-can-fixes-for-6.3-20230405' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: isotp: fix race between isotp_sendsmg() and isotp_release() can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access ==================== Link: https://lore.kernel.org/r/20230405092444.1802340-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 4181b39ae1ffe768735488538dcd2c7eb0ebce05 Merge: 3ce9345580974 83c911dc5e0e8 Author: Jakub Kicinski Date: Wed Apr 5 17:10:32 2023 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-04-04 (ice) This series contains updates to ice driver only. Simei adjusts error path on adding VF Flow Director filters that were not releasing all resources. Lingyu adds setting/resetting of VF Flow Director filters counters during initialization. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Reset FDIR counter in FDIR init stage ice: fix wrong fallback logic for FDIR ==================== Link: https://lore.kernel.org/r/20230404172306.450880-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3dfa8926efa910d423844bfc0132f70cd07f76e2 Merge: 1a4edef8e846f 0ec8671837a61 Author: Daniel Vetter Date: Wed Apr 5 21:06:27 2023 +0200 Merge tag 'drm-misc-fixes-2023-04-05' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * ivpu: DMA fence and suspend fixes * nouveau: Color-depth fixes * panfrost: Fix mmap error handling Signed-off-by: Daniel Vetter From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230405182855.GA1551@linux-uq9g commit a5b2781dcab2c77979a4b8adda781d2543580901 Author: Hans de Goede Date: Tue Apr 4 13:02:49 2023 +0200 ACPI: video: Add acpi_backlight=video quirk for Lenovo ThinkPad W530 The Lenovo ThinkPad W530 uses a nvidia k1000m GPU. When this gets used together with one of the older nvidia binary driver series (the latest series does not support it), then backlight control does not work. This is caused by commit 3dbc80a3e4c5 ("ACPI: video: Make backlight class device registration a separate step (v2)") combined with commit 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default"). After these changes the acpi_video# backlight device is only registered when requested by a GPU driver calling acpi_video_register_backlight() which the nvidia binary driver does not do. I realize that using the nvidia binary driver is not a supported use-case and users can workaround this by adding acpi_backlight=video on the kernel commandline, but the ThinkPad W530 is a popular model under Linux users, so it seems worthwhile to add a quirk for this. I will also email Nvidia asking them to make the driver call acpi_video_register_backlight() when an internal LCD panel is detected. So maybe the next maintenance release of the drivers will fix this... Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") Cc: All applicable Reviewed-by: Mario Limonciello Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 2699107989431d6db44f8a9e809ea74c387336d1 Author: Hans de Goede Date: Tue Apr 4 13:02:48 2023 +0200 ACPI: video: Add acpi_backlight=video quirk for Apple iMac14,1 and iMac14,2 On the Apple iMac14,1 and iMac14,2 all-in-ones (monitors with builtin "PC") the connection between the GPU and the panel is seen by the GPU driver as regular DP instead of eDP, causing the GPU driver to never call acpi_video_register_backlight(). (GPU drivers only call acpi_video_register_backlight() when an internal panel is detected, to avoid non working acpi_video# devices getting registered on desktops which unfortunately is a real issue.) Fix the missing acpi_video# backlight device on these all-in-ones by adding a acpi_backlight=video DMI quirk, so that video.ko will immediately register the backlight device instead of waiting for an acpi_video_register_backlight() call. Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") Cc: All applicable Reviewed-by: Mario Limonciello Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit e506731c8f35699d746c615164ed620cd53c00ca Author: Hans de Goede Date: Tue Apr 4 13:02:47 2023 +0200 ACPI: video: Make acpi_backlight=video work independent from GPU driver Commit 3dbc80a3e4c5 ("ACPI: video: Make backlight class device registration a separate step (v2)") combined with commit 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") Means that the video.ko code now fully depends on the GPU driver calling acpi_video_register_backlight() for the acpi_video# backlight class devices to get registered. This means that if the GPU driver does not do this, acpi_backlight=video on the cmdline, or DMI quirks for selecting acpi_video# will not work. This is a problem on for example Apple iMac14,1 all-in-ones where the monitor's LCD panel shows up as a regular DP connection instead of eDP so the GPU driver will not call acpi_video_register_backlight() [1]. Fix this by making video.ko directly register the acpi_video# devices when these have been explicitly requested either on the cmdline or through DMI quirks (rather then auto-detection being used). [1] GPU drivers only call acpi_video_register_backlight() when an internal panel is detected, to avoid non working acpi_video# devices getting registered on desktops which unfortunately is a real issue. Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") Cc: All applicable Reviewed-by: Mario Limonciello Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 78dfc9d1d1abb9e400386fa9c5724a8f7d75e3b9 Author: Hans de Goede Date: Tue Apr 4 13:02:46 2023 +0200 ACPI: video: Add auto_detect arg to __acpi_video_get_backlight_type() Allow callers of __acpi_video_get_backlight_type() to pass a pointer to a bool which will get set to false if the backlight-type comes from the cmdline or a DMI quirk and set to true if auto-detection was used. And make __acpi_video_get_backlight_type() non static so that it can be called directly outside of video_detect.c . While at it turn the acpi_video_get_backlight_type() and acpi_video_backlight_use_native() wrappers into static inline functions in include/acpi/video.h, so that we need to export one less symbol. Fixes: 5aa9d943e9b6 ("ACPI: video: Don't enable fallback path for creating ACPI backlight by default") Cc: All applicable Reviewed-by: Mario Limonciello Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 1edf48991a783d00a3a18dc0d27c88139e4030a2 Author: Pawel Laszczak Date: Fri Mar 31 05:06:00 2023 -0400 usb: cdnsp: Fixes error: uninitialized symbol 'len' The patch 5bc38d33a5a1: "usb: cdnsp: Fixes issue with redundant Status Stage" leads to the following Smatch static checker warning: drivers/usb/cdns3/cdnsp-ep0.c:470 cdnsp_setup_analyze() error: uninitialized symbol 'len'. cc: Fixes: 5bc38d33a5a1 ("usb: cdnsp: Fixes issue with redundant Status Stage") Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/20230331090600.454674-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman commit 60a655debd36e3278a46872accc1a51a54f94f02 Author: Krzysztof Kozlowski Date: Sun Mar 26 22:45:18 2023 +0200 arm64: dts: rockchip: correct panel supplies on some rk3326 boards The Anbernic and Odroid Go have different panels and take differently named supplies, so move all the supplies to DTS defining actual panel to fix warnings like: rk3326-odroid-go3.dtb: panel@0: 'IOVCC-supply' is a required property rk3326-odroid-go3.dtb: panel@0: 'iovcc-supply', 'vdd-supply' do not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230326204520.80859-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 2dd16a23e8c687bde605dbdcfedaed97bb2a0c0e Author: Krzysztof Kozlowski Date: Sun Mar 26 22:45:20 2023 +0200 arm64: dts: rockchip: use just "port" in panel on RockPro64 The panel bindings expect to have only one port, thus they do not allow to use "ports" node: rk3399-rockpro64.dtb: panel@0: 'ports' does not match any of the regexes: 'pinctrl-[0-9]+' There is only one endpoint, so use simpler form without "reg". Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230326204520.80859-3-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 5438b349c0512a6fe023976aad8b9f19ca671dd1 Author: Krzysztof Kozlowski Date: Sun Mar 26 22:45:19 2023 +0200 arm64: dts: rockchip: use just "port" in panel on Pinebook Pro The panel bindings expect to have only one port, thus they do not allow to use "ports" node: rk3399-pinebook-pro.dtb: edp-panel: 'ports' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230326204520.80859-2-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit d19342c6609b67f2ba83b9eccca2777e3687f625 Author: Thiago Rafael Becker Date: Wed Apr 5 10:16:48 2023 -0300 cifs: sanitize paths in cifs_update_super_prepath. After a server reboot, clients are failing to move files with ENOENT. This is caused by DFS referrals containing multiple separators, which the server move call doesn't recognize. v1: Initial patch. v2: Move prototype to header. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182472 Fixes: a31080899d5f ("cifs: sanitize multiple delimiters in prepath") Actually-Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api") Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Thiago Rafael Becker Signed-off-by: Steve French commit e07fec475cc86ce6ded82908df1d511edc3303b7 Author: Sandeep Dhavale Date: Sat Apr 1 06:05:09 2023 +0000 usb: gadgetfs: Fix ep_read_iter to handle ITER_UBUF iov_iter for ep_read_iter can be ITER_UBUF with io_uring. In that case dup_iter() does not have to allocate iov and it can return NULL. Fix the assumption by checking for iter_is_ubuf() other wise ep_read_iter can treat this as failure and return -ENOMEM. Fixes: 1e23db450cff ("io_uring: use iter_ubuf for single range imports") Signed-off-by: Sandeep Dhavale Acked-by: Jens Axboe Link: https://lore.kernel.org/r/20230401060509.3608259-3-dhavale@google.com Signed-off-by: Greg Kroah-Hartman commit d356b3cdd00cae4508be566a47c0cfb74e14862a Author: Sandeep Dhavale Date: Sat Apr 1 06:05:08 2023 +0000 usb: gadget: f_fs: Fix ffs_epfile_read_iter to handle ITER_UBUF iov_iter for ffs_epfile_read_iter can be ITER_UBUF with io_uring. In that case dup_iter() does not have to allocate anything and it can return NULL. ffs_epfile_read_iter treats this as a failure and returns -ENOMEM. Fix it by checking if iter_is_ubuf(). Fixes: 1e23db450cff ("io_uring: use iter_ubuf for single range imports") Signed-off-by: Sandeep Dhavale Acked-by: Jens Axboe Link: https://lore.kernel.org/r/20230401060509.3608259-2-dhavale@google.com Signed-off-by: Greg Kroah-Hartman commit eddebe39602efe631b83ff8d03f26eba12cfd760 Author: RD Babiera Date: Wed Mar 29 21:51:59 2023 +0000 usb: typec: altmodes/displayport: Fix configure initial pin assignment While determining the initial pin assignment to be sent in the configure message, using the DP_PIN_ASSIGN_DP_ONLY_MASK mask causes the DFP_U to send both Pin Assignment C and E when both are supported by the DFP_U and UFP_U. The spec (Table 5-7 DFP_U Pin Assignment Selection Mandates, VESA DisplayPort Alt Mode Standard v2.0) indicates that the DFP_U never selects Pin Assignment E when Pin Assignment C is offered. Update the DP_PIN_ASSIGN_DP_ONLY_MASK conditional to intially select only Pin Assignment C if it is available. Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable@vger.kernel.org Signed-off-by: RD Babiera Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230329215159.2046932-1-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman commit ec799c8a92e0be91e0940cc739a27f483242df65 Author: Heikki Krogerus Date: Thu Mar 30 18:02:24 2023 +0300 usb: dwc3: pci: add support for the Intel Meteor Lake-S This patch adds the necessary PCI ID for Intel Meteor Lake-S devices. Signed-off-by: Heikki Krogerus Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230330150224.89316-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 32d85999680601d01b2a36713c9ffd7397c8688b Author: Ard Biesheuvel Date: Tue Apr 4 12:36:25 2023 +0200 arm64: compat: Work around uninitialized variable warning Dan reports that smatch complains about a potential uninitialized variable being used in the compat alignment fixup code. The logic is not wrong per se, but we do end up using an uninitialized variable if reading the instruction that triggered the alignment fault from user space faults, even if the fault ensures that the uninitialized value doesn't propagate any further. Given that we just give up and return 1 if any fault occurs when reading the instruction, let's get rid of the 'success handling' pattern that captures the fault in a variable and aborts later, and instead, just return 1 immediately if any of the get_user() calls result in an exception. Fixes: 3fc24ef32d3b ("arm64: compat: Implement misalignment fixups for multiword loads") Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202304021214.gekJ8yRc-lkp@intel.com/ Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20230404103625.2386382-1-ardb@kernel.org Signed-off-by: Catalin Marinas commit 99ddf2254febae9eab7fb0bcc02c5322243f5c49 Merge: 76f598ba7d8e2 3357c6e429643 Author: Linus Torvalds Date: Wed Apr 5 09:11:08 2023 -0700 Merge tag 'trace-v6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix timerlat notification, as it was not triggering the notify to users when a new max latency was hit. - Do not trigger max latency if the tracing is off. When tracing is off, the ring buffer is not updated, it does not make sense to notify when there's a new max latency detected by the tracer, as why that latency happened is not available. The tracing logic still runs when the ring buffer is disabled, but it should not be triggering notifications. - Fix race on freeing the synthetic event "last_cmd" variable by adding a mutex around it. - Fix race between reader and writer of the ring buffer by adding memory barriers. When the writer is still on the reader page it must have its content visible on the buffer before it moves the commit index that the reader uses to know how much content is on the page. - Make get_lock_parent_ip() always inlined, as it uses _THIS_IP_ and _RET_IP_, which gets broken if it is not inlined. - Make __field(int, arr[5]) in a TRACE_EVENT() macro fail to build. The field formats of trace events are calculated by using sizeof(type) and other means by what is passed into the structure macros like __field(). The __field() macro is only meant for atom types like int, long, short, pointer, etc. It is not meant for arrays. The code will currently compile with arrays, but then the format produced will be inaccurate, and user space parsing tools will break. Two bugs have already been fixed, now add code that will make the kernel fail to build if another trace event includes this buggy field format. - Fix boot up snapshot code: Boot snapshots were triggering when not even asked for on the kernel command line. This was caused by two bugs: 1) It would trigger a snapshot on any instance if one was created from the kernel command line. 2) The error handling would only affect the top level instance. So the fact that a snapshot was done on a instance that didn't allocate a buffer triggered a warning written into the top level buffer, and worse yet, disabled the top level buffer. - Fix memory leak that was caused when an error was logged in a trace buffer instance, and then the buffer instance was removed. The allocated error log messages still needed to be freed. * tag 'trace-v6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Free error logs of tracing instances tracing: Fix ftrace_boot_snapshot command line logic tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance tracing: Error if a trace event has an array for a __field() tracing/osnoise: Fix notify new tracing_max_latency tracing/timerlat: Notify new max thread latency ftrace: Mark get_lock_parent_ip() __always_inline ring-buffer: Fix race while reader and writer are on the same page tracing/synthetic: Fix races on freeing last_cmd commit d3205ab75e99a47539ec91ef85ba488f4ddfeaa9 Author: Keith Busch Date: Mon Apr 3 13:09:25 2023 -0700 nvme: fix discard support without oncs The device can report discard support without setting the ONCS DSM bit. When not set, the driver clears max_discard_size expecting it to be set later. We don't know the size until we have the namespace format, though, so setting it is deferred until configuring one, but the driver was abandoning the discard settings due to that initial clearing. Move the max_discard_size calculation above the check for a '0' discard size. Fixes: 1a86924e4f46475 ("nvme: fix interpretation of DMRSL") Reported-by: Laurence Oberman Signed-off-by: Keith Busch Reviewed-by: Niklas Cassel Reviewed-by: Sagi Grimberg Tested-by: Laurence Oberman Signed-off-by: Christoph Hellwig commit 3847e716b68e871ab64fc0cdad7fac9b7c1b022d Author: Fabio Estevam Date: Tue Mar 28 15:51:47 2023 -0300 ARM: dts: imx6ull-colibri: Remove unnecessary #address-cells/#size-cells Building with W=1 leads to the following dtc warning: arch/arm/boot/dts/imx6ull-colibri.dtsi:36.9-46.5: Warning (graph_child_address): /connector/ports: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary Since a single port is used, 'ports' can be removed, as well as the unnecessary #address-cells/#size-cells. Fixes: bd5880e10982 ("ARM: dts: colibri-imx6ull: Enable dual-role switching") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 82655f90701de5e0f7381b16534602bc2b8fe920 Author: Fabio Estevam Date: Tue Mar 28 15:51:46 2023 -0300 ARM: dts: imx7d-remarkable2: Remove unnecessary #address-cells/#size-cells Building with W=1 leads to the following dtc warning: arch/arm/boot/dts/imx7d-remarkable2.dts:319.19-335.4: Warning (avoid_unnecessary_addr_size): /soc/bus@30800000/i2c@30a50000/pmic@62: unnecessary #address-cells/#size-cells without "ranges" or child "reg" property Remove unnecessary #address-cells/#size-cells to fix it. Fixes: 9076cbaa7757 ("ARM: dts: imx7d-remarkable2: Enable silergy,sy7636a") Signed-off-by: Fabio Estevam Reviewed-by: Alistair Francis Signed-off-by: Shawn Guo commit 02c447a0d79f0c966563e5095a017cbf9477ca6d Author: Peng Fan Date: Tue Mar 28 14:19:05 2023 +0800 arm64: dts: imx8mp-verdin: correct off-on-delay The property should be off-on-delay-us, not off-on-delay Fixes: a39ed23bdf6e ("arm64: dts: freescale: add initial support for verdin imx8m plus") Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 130c1f4306d56301216baaea68afdd909892c73f Author: Peng Fan Date: Tue Mar 28 14:19:04 2023 +0800 arm64: dts: imx8mm-verdin: correct off-on-delay The property should be off-on-delay-us, not off-on-delay Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini") Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 3357c6e429643231e60447b52ffbb7ac895aca22 Author: Steven Rostedt (Google) Date: Tue Apr 4 19:45:04 2023 -0400 tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger # cat instances/foo/error_log [ 117.404795] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=x ^ # rmdir instances/foo Then check for memory leaks: # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff88810d8ec700 (size 192): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... backtrace: [<00000000dae26536>] kmalloc_trace+0x2a/0xa0 [<00000000b2938940>] tracing_log_err+0x277/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff888170c35a00 (size 32): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist 3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x......... backtrace: [<000000006a747de5>] __kmalloc+0x4d/0x160 [<000000000039df5f>] tracing_log_err+0x29b/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc The problem is that the error log needs to be freed when the instance is removed. Link: https://lore.kernel.org/lkml/76134d9f-a5ba-6a0d-37b3-28310b4a1e91@alu.unizg.hr/ Link: https://lore.kernel.org/linux-trace-kernel/20230404194504.5790b95f@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Andrew Morton Cc: Mark Rutland Cc: Thorsten Leemhuis Cc: Ulf Hansson Cc: Eric Biggers Fixes: 2f754e771b1a6 ("tracing: Have the error logs show up in the proper instances") Reported-by: Mirsad Goran Todorovac Tested-by: Mirsad Todorovac Signed-off-by: Steven Rostedt (Google) commit 85af7ffd24da38e416a14bd6bf207154d94faa83 Author: Peng Fan Date: Mon Mar 27 18:03:21 2023 +0800 arm64: dts: imx8mm-evk: correct pmic clock source The osc_32k supports #clock-cells as 0, using an id is wrong, drop it. Fixes: a6a355ede574 ("arm64: dts: imx8mm-evk: Add 32.768 kHz clock to PMIC") Signed-off-by: Peng Fan Reviewed-by: Marco Felsch Signed-off-by: Shawn Guo commit 81515ecf155a38f3532bf5ddef88d651898df6be Author: Tony Luck Date: Tue Apr 4 10:46:41 2023 -0700 x86/cpu: Add model number for Intel Arrow Lake processor Successor to Lunar Lake. Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230404174641.426593-1-tony.luck@intel.com commit 0b186bb06198653d74a141902a7739e0bde20cf4 Author: Daniel Baluta Date: Wed Apr 5 12:26:55 2023 +0300 ASoC: SOF: pm: Tear down pipelines only if DSP was active With PCI if the device was suspended it is brought back to full power and then suspended again. This doesn't happen when device is described via DT. We need to make sure that we tear down pipelines only if the device was previously active (thus the pipelines were setup). Otherwise, we can break the use_count: [ 219.009743] sof-audio-of-imx8m 3b6e8000.dsp: sof_ipc3_tear_down_all_pipelines: widget PIPELINE.2.SAI3.IN is still in use: count -1 and after this everything stops working. Fixes: d185e0689abc ("ASoC: SOF: pm: Always tear down pipelines before DSP suspend") Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Signed-off-by: Daniel Baluta Link: https://lore.kernel.org/r/20230405092655.19587-1-daniel.baluta@oss.nxp.com Signed-off-by: Mark Brown commit 4b6d621c9d859ff89e68cebf6178652592676013 Author: Greg Kroah-Hartman Date: Sat Apr 1 22:03:27 2023 +0200 memstick: fix memory leak if card device is never registered When calling dev_set_name() memory is allocated for the name for the struct device. Once that structure device is registered, or attempted to be registerd, with the driver core, the driver core will handle cleaning up that memory when the device is removed from the system. Unfortunatly for the memstick code, there is an error path that causes the struct device to never be registered, and so the memory allocated in dev_set_name will be leaked. Fix that leak by manually freeing it right before the memory for the device is freed. Cc: Maxim Levitsky Cc: Alex Dubov Cc: Ulf Hansson Cc: "Rafael J. Wysocki" Cc: Hans de Goede Cc: Kay Sievers Cc: linux-mmc@vger.kernel.org Fixes: 0252c3b4f018 ("memstick: struct device - replace bus_id with dev_name(), dev_set_name()") Cc: stable Co-developed-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Co-developed-by: Mirsad Goran Todorovac Signed-off-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/r/20230401200327.16800-1-gregkh@linuxfoundation.org Signed-off-by: Ulf Hansson commit 051737439eaee5bdd03d3c2ef5510d54a478fd05 Author: Oliver Hartkopp Date: Fri Mar 31 15:19:35 2023 +0200 can: isotp: fix race between isotp_sendsmg() and isotp_release() As discussed with Dae R. Jeong and Hillf Danton here [1] the sendmsg() function in isotp.c might get into a race condition when restoring the former tx.state from the old_state. Remove the old_state concept and implement proper locking for the ISOTP_IDLE transitions in isotp_sendmsg(), inspired by a simplification idea from Hillf Danton. Introduce a new tx.state ISOTP_SHUTDOWN and use the same locking mechanism from isotp_release() which resolves a potential race between isotp_sendsmg() and isotp_release(). [1] https://lore.kernel.org/linux-can/ZB%2F93xJxq%2FBUqAgG@dragonet v1: https://lore.kernel.org/all/20230331102114.15164-1-socketcan@hartkopp.net v2: https://lore.kernel.org/all/20230331123600.3550-1-socketcan@hartkopp.net take care of signal interrupts for wait_event_interruptible() in isotp_release() v3: https://lore.kernel.org/all/20230331130654.9886-1-socketcan@hartkopp.net take care of signal interrupts for wait_event_interruptible() in isotp_sendmsg() in the wait_tx_done case v4: https://lore.kernel.org/all/20230331131935.21465-1-socketcan@hartkopp.net take care of signal interrupts for wait_event_interruptible() in isotp_sendmsg() in ALL cases Cc: Dae R. Jeong Cc: Hillf Danton Signed-off-by: Oliver Hartkopp Fixes: 4f027cba8216 ("can: isotp: split tx timer into transmission and timeout") Link: https://lore.kernel.org/all/20230331131935.21465-1-socketcan@hartkopp.net Cc: stable@vger.kernel.org [mkl: rephrase commit message] Signed-off-by: Marc Kleine-Budde commit 1a4edef8e846f0ff7cfbd35b6e62cf26989e59ce Merge: 7e364e56293bb dc3421560a673 Author: Daniel Vetter Date: Wed Apr 5 11:14:18 2023 +0200 Merge tag 'drm-intel-fixes-2023-04-05' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.3-rc6: - Fix DP MST DSC M/N calculation to use compressed bpp - Fix racy use-after-free in perf ioctl - Fix context runtime accounting - Fix handling of GT reset during HuC loading - Fix use of unsigned vm_fault_t for error values Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87zg7mzomz.fsf@intel.com commit 79e19fa79cb5d5f1b3bf3e3ae24989ccb93c7b7b Author: Michal Sojka Date: Fri Mar 31 14:55:11 2023 +0200 can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events When using select()/poll()/epoll() with a non-blocking ISOTP socket to wait for when non-blocking write is possible, a false EPOLLOUT event is sometimes returned. This can happen at least after sending a message which must be split to multiple CAN frames. The reason is that isotp_sendmsg() returns -EAGAIN when tx.state is not equal to ISOTP_IDLE and this behavior is not reflected in datagram_poll(), which is used in isotp_ops. This is fixed by introducing ISOTP-specific poll function, which suppresses the EPOLLOUT events in that case. v2: https://lore.kernel.org/all/20230302092812.320643-1-michal.sojka@cvut.cz v1: https://lore.kernel.org/all/20230224010659.48420-1-michal.sojka@cvut.cz https://lore.kernel.org/all/b53a04a2-ba1f-3858-84c1-d3eb3301ae15@hartkopp.net Signed-off-by: Michal Sojka Reported-by: Jakub Jira Tested-by: Oliver Hartkopp Acked-by: Oliver Hartkopp Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/20230331125511.372783-1-michal.sojka@cvut.cz Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 0145462fc802cd447ef5d029758043c7f15b4b1e Author: Oliver Hartkopp Date: Thu Mar 30 19:02:48 2023 +0200 can: isotp: isotp_recvmsg(): use sock_recv_cmsgs() to get SOCK_RXQ_OVFL infos isotp.c was still using sock_recv_timestamp() which does not provide control messages to detect dropped PDUs in the receive path. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230330170248.62342-1-socketcan@hartkopp.net Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit b45193cb4df556fe6251b285a5ce44046dd36b4a Author: Oleksij Rempel Date: Tue Apr 4 09:31:28 2023 +0200 can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access could occur during the memcpy() operation if the size of skb->cb is larger than the size of struct j1939_sk_buff_cb. This is because the memcpy() operation uses the size of skb->cb, leading to a read beyond the struct j1939_sk_buff_cb. Updated the memcpy() operation to use the size of struct j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the memcpy() operation only reads the memory within the bounds of struct j1939_sk_buff_cb, preventing out-of-bounds memory access. Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb is greater than or equal to the size of struct j1939_sk_buff_cb. This ensures that the skb->cb buffer is large enough to hold the j1939_sk_buff_cb structure. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Reported-by: Shuangpeng Bai Tested-by: Shuangpeng Bai Signed-off-by: Oleksij Rempel Link: https://groups.google.com/g/syzkaller/c/G_LL-C3plRs/m/-8xCi6dCAgAJ Link: https://lore.kernel.org/all/20230404073128.3173900-1-o.rempel@pengutronix.de Cc: stable@vger.kernel.org [mkl: rephrase commit message] Signed-off-by: Marc Kleine-Budde commit 24d3ae2f37d8bc3c14b31d353c5d27baf582b6a6 Author: Kan Liang Date: Wed Mar 22 13:24:49 2023 -0700 perf/core: Fix the same task check in perf_event_set_output The same task check in perf_event_set_output has some potential issues for some usages. For the current perf code, there is a problem if using of perf_event_open() to have multiple samples getting into the same mmap’d memory when they are both attached to the same process. https://lore.kernel.org/all/92645262-D319-4068-9C44-2409EF44888E@gmail.com/ Because the event->ctx is not ready when the perf_event_set_output() is invoked in the perf_event_open(). Besides the above issue, before the commit bd2756811766 ("perf: Rewrite core context handling"), perf record can errors out when sampling with a hardware event and a software event as below. $ perf record -e cycles,dummy --per-thread ls failed to mmap with 22 (Invalid argument) That's because that prior to the commit a hardware event and a software event are from different task context. The problem should be a long time issue since commit c3f00c70276d ("perk: Separate find_get_context() from event initialization"). The task struct is stored in the event->hw.target for each per-thread event. It is a more reliable way to determine whether two events are attached to the same task. The event->hw.target was also introduced several years ago by the commit 50f16a8bf9d7 ("perf: Remove type specific target pointers"). It can not only be used to fix the issue with the current code, but also back port to fix the issues with an older kernel. Note: The event->hw.target was introduced later than commit c3f00c70276d. The patch may cannot be applied between the commit c3f00c70276d and commit 50f16a8bf9d7. Anybody that wants to back-port this at that period may have to find other solutions. Fixes: c3f00c70276d ("perf: Separate find_get_context() from event initialization") Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Zhengjun Xing Link: https://lkml.kernel.org/r/20230322202449.512091-1-kan.liang@linux.intel.com commit b168098912926236bbeebaf7795eb7aab76d2b45 Author: Peter Zijlstra Date: Mon Apr 3 11:08:58 2023 +0200 perf: Optimize perf_pmu_migrate_context() Thomas reported that offlining CPUs spends a lot of time in synchronize_rcu() as called from perf_pmu_migrate_context() even though he's not actually using uncore events. Turns out, the thing is unconditionally waiting for RCU, even if there's no actual events to migrate. Fixes: 0cda4c023132 ("perf: Introduce perf_pmu_migrate_context()") Reported-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Tested-by: Thomas Gleixner Reviewed-by: Thomas Gleixner Reviewed-by: Paul E. McKenney Link: https://lkml.kernel.org/r/20230403090858.GT4253@hirez.programming.kicks-ass.net commit 0ec8671837a61d841462179686c5819d951d3b10 Author: Jacek Lawrynowicz Date: Fri Mar 31 13:36:03 2023 +0200 accel/ivpu: Fix S3 system suspend when not idle Wait for VPU to be idle in ivpu_pm_suspend_cb() before powering off the device, so jobs are not lost and TDRs are not triggered after resume. Fixes: 852be13f3bd3 ("accel/ivpu: Add PM support") Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230331113603.2802515-3-stanislaw.gruszka@linux.intel.com commit 774e7cb50359eff7e966f4e2e80c9486014d3a23 Author: Karol Wachowski Date: Fri Mar 31 13:36:02 2023 +0200 accel/ivpu: Add dma fence to command buffers only Currently job->done_fence is added to every BO handle within a job. If job handle (command buffer) is shared between multiple submits, KMD will add the fence in each of them. Then bo_wait_ioctl() executed on command buffer will exit only when all jobs containing that handle are done. This creates deadlock scenario for user mode driver in case when job handle is added as dependency of another job, because bo_wait_ioctl() of first job will wait until second job finishes, and second job can not finish before first one. Having fences added only to job buffer handle allows user space to execute bo_wait_ioctl() on the job even if it's handle is submitted with other job. Fixes: cd7272215c44 ("accel/ivpu: Add command buffer submission logic") Signed-off-by: Karol Wachowski Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230331113603.2802515-2-stanislaw.gruszka@linux.intel.com commit ad8cd35c58ca3ec5e93f52a0124899627b98efb2 Author: Johan Hovold Date: Mon Mar 27 14:29:48 2023 +0200 arm64: dts: qcom: sc8280xp-pmics: fix pon compatible and registers The pmk8280 PMIC PON peripheral is gen3 and uses two sets of registers; hlos and pbs. This specifically fixes the following error message during boot when the pbs registers are not defined: PON_PBS address missing, can't read HW debounce time Note that this also enables the spurious interrupt workaround introduced by commit 0b65118e6ba3 ("Input: pm8941-pwrkey - add software key press debouncing support") (which may or may not be needed). Fixes: ccd3517faf18 ("arm64: dts: qcom: sc8280xp: Add reference device") Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Tested-by: Steev Klimaszewski #Thinkpad X13s Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230327122948.4323-1-johan+linaro@kernel.org commit e94891641c21f607e4d6887bcd3beff882fcc483 Author: Steven Rostedt (Google) Date: Tue Apr 4 22:21:15 2023 -0400 tracing: Fix ftrace_boot_snapshot command line logic The kernel command line ftrace_boot_snapshot by itself is supposed to trigger a snapshot at the end of boot up of the main top level trace buffer. A ftrace_boot_snapshot=foo will do the same for an instance called foo that was created by trace_instance=foo,... The logic was broken where if ftrace_boot_snapshot was by itself, it would trigger a snapshot for all instances that had tracing enabled, regardless if it asked for a snapshot or not. When a snapshot is requested for a buffer, the buffer's tr->allocated_snapshot is set to true. Use that to know if a trace buffer wants a snapshot at boot up or not. Since the top level buffer is part of the ftrace_trace_arrays list, there's no reason to treat it differently than the other buffers. Just iterate the list if ftrace_boot_snapshot was specified. Link: https://lkml.kernel.org/r/20230405022341.895334039@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrew Morton Cc: Ross Zwisler Fixes: 9c1c251d670bc ("tracing: Allow boot instances to have snapshot buffers") Signed-off-by: Steven Rostedt (Google) commit 9d52727f8043cfda241ae96896628d92fa9c50bb Author: Steven Rostedt (Google) Date: Tue Apr 4 22:21:14 2023 -0400 tracing: Have tracing_snapshot_instance_cond() write errors to the appropriate instance If a trace instance has a failure with its snapshot code, the error message is to be written to that instance's buffer. But currently, the message is written to the top level buffer. Worse yet, it may also disable the top level buffer and not the instance that had the issue. Link: https://lkml.kernel.org/r/20230405022341.688730321@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrew Morton Cc: Ross Zwisler Fixes: 2824f50332486 ("tracing: Make the snapshot trigger work with instances") Signed-off-by: Steven Rostedt (Google) commit 3ce9345580974863c060fa32971537996a7b2d57 Author: Shailend Chand Date: Mon Apr 3 10:28:09 2023 -0700 gve: Secure enough bytes in the first TX desc for all TCP pkts Non-GSO TCP packets whose SKBs' linear portion did not include the entire TCP header were not populating the first Tx descriptor with as many bytes as the vNIC expected. This change ensures that all TCP packets populate the first descriptor with the correct number of bytes. Fixes: 893ce44df565 ("gve: Add basic driver framework for Compute Engine Virtual NIC") Signed-off-by: Shailend Chand Link: https://lore.kernel.org/r/20230403172809.2939306-1-shailend@google.com Signed-off-by: Jakub Kicinski commit a1865f2e7d10dde00d35a2122b38d2e469ae67ed Author: Eric Dumazet Date: Mon Apr 3 21:46:43 2023 +0000 netlink: annotate lockless accesses to nlk->max_recvmsg_len syzbot reported a data-race in data-race in netlink_recvmsg() [1] Indeed, netlink_recvmsg() can be run concurrently, and netlink_dump() also needs protection. [1] BUG: KCSAN: data-race in netlink_recvmsg / netlink_recvmsg read to 0xffff888141840b38 of 8 bytes by task 23057 on cpu 0: netlink_recvmsg+0xea/0x730 net/netlink/af_netlink.c:1988 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg net/socket.c:1038 [inline] __sys_recvfrom+0x1ee/0x2e0 net/socket.c:2194 __do_sys_recvfrom net/socket.c:2212 [inline] __se_sys_recvfrom net/socket.c:2208 [inline] __x64_sys_recvfrom+0x78/0x90 net/socket.c:2208 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd write to 0xffff888141840b38 of 8 bytes by task 23037 on cpu 1: netlink_recvmsg+0x114/0x730 net/netlink/af_netlink.c:1989 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg net/socket.c:1038 [inline] ____sys_recvmsg+0x156/0x310 net/socket.c:2720 ___sys_recvmsg net/socket.c:2762 [inline] do_recvmmsg+0x2e5/0x710 net/socket.c:2856 __sys_recvmmsg net/socket.c:2935 [inline] __do_sys_recvmmsg net/socket.c:2958 [inline] __se_sys_recvmmsg net/socket.c:2951 [inline] __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0x0000000000001000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 23037 Comm: syz-executor.2 Not tainted 6.3.0-rc4-syzkaller-00195-g5a57b48fdfcb #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Fixes: 9063e21fb026 ("netlink: autosize skb lengthes") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230403214643.768555-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e847c7675e19ef344913724dc68f83df31ad6a17 Author: Andy Roulin Date: Mon Apr 3 14:20:53 2023 -0700 ethtool: reset #lanes when lanes is omitted If the number of lanes was forced and then subsequently the user omits this parameter, the ksettings->lanes is reset. The driver should then reset the number of lanes to the device's default for the specified speed. However, although the ksettings->lanes is set to 0, the mod variable is not set to true to indicate the driver and userspace should be notified of the changes. The consequence is that the same ethtool operation will produce different results based on the initial state. If the initial state is: $ ethtool swp1 | grep -A 3 'Speed: ' Speed: 500000Mb/s Lanes: 2 Duplex: Full Auto-negotiation: on then executing 'ethtool -s swp1 speed 50000 autoneg off' will yield: $ ethtool swp1 | grep -A 3 'Speed: ' Speed: 500000Mb/s Lanes: 2 Duplex: Full Auto-negotiation: off While if the initial state is: $ ethtool swp1 | grep -A 3 'Speed: ' Speed: 500000Mb/s Lanes: 1 Duplex: Full Auto-negotiation: off executing the same 'ethtool -s swp1 speed 50000 autoneg off' results in: $ ethtool swp1 | grep -A 3 'Speed: ' Speed: 500000Mb/s Lanes: 1 Duplex: Full Auto-negotiation: off This patch fixes this behavior. Omitting lanes will always results in the driver choosing the default lane width for the chosen speed. In this scenario, regardless of the initial state, the end state will be, e.g., $ ethtool swp1 | grep -A 3 'Speed: ' Speed: 500000Mb/s Lanes: 2 Duplex: Full Auto-negotiation: off Fixes: 012ce4dd3102 ("ethtool: Extend link modes settings uAPI with lanes") Signed-off-by: Andy Roulin Reviewed-by: Danielle Ratson Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/ac238d6b-8726-8156-3810-6471291dbc7f@nvidia.com Signed-off-by: Jakub Kicinski commit 95fac54004a8aebddad74e9984c1c9785190668c Merge: 218c597325f4f ab5fb73ffa010 Author: Jakub Kicinski Date: Tue Apr 4 18:56:59 2023 -0700 Merge branch 'raw-ping-fix-locking-in-proc-net-raw-icmp' Kuniyuki Iwashima says: ==================== raw/ping: Fix locking in /proc/net/{raw,icmp}. The first patch fixes a NULL deref for /proc/net/raw and second one fixes the same issue for ping sockets. The first patch also converts hlist_nulls to hlist, but this is because the current code uses sk_nulls_for_each() for lockless readers, instead of sk_nulls_for_each_rcu() which adds memory barrier, but raw sockets does not use the nulls marker nor SLAB_TYPESAFE_BY_RCU in the first place. OTOH, the ping sockets already uses sk_nulls_for_each_rcu(), and such conversion can be posted later for net-next. ==================== Link: https://lore.kernel.org/r/20230403194959.48928-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit ab5fb73ffa01072b4d8031cc05801fa1cb653bee Author: Kuniyuki Iwashima Date: Mon Apr 3 12:49:59 2023 -0700 ping: Fix potentail NULL deref for /proc/net/icmp. After commit dbca1596bbb0 ("ping: convert to RCU lookups, get rid of rwlock"), we use RCU for ping sockets, but we should use spinlock for /proc/net/icmp to avoid a potential NULL deref mentioned in the previous patch. Let's go back to using spinlock there. Note we can convert ping sockets to use hlist instead of hlist_nulls because we do not use SLAB_TYPESAFE_BY_RCU for ping sockets. Fixes: dbca1596bbb0 ("ping: convert to RCU lookups, get rid of rwlock") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit 0a78cf7264d29abeca098eae0b188a10aabc8a32 Author: Kuniyuki Iwashima Date: Mon Apr 3 12:49:58 2023 -0700 raw: Fix NULL deref in raw_get_next(). Dae R. Jeong reported a NULL deref in raw_get_next() [0]. It seems that the repro was running these sequences in parallel so that one thread was iterating on a socket that was being freed in another netns. unshare(0x40060200) r0 = syz_open_procfs(0x0, &(0x7f0000002080)='net/raw\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) pread64(r0, &(0x7f0000000000)=""/10, 0xa, 0x10000000007f) After commit 0daf07e52709 ("raw: convert raw sockets to RCU"), we use RCU and hlist_nulls_for_each_entry() to iterate over SOCK_RAW sockets. However, we should use spinlock for slow paths to avoid the NULL deref. Also, SOCK_RAW does not use SLAB_TYPESAFE_BY_RCU, and the slab object is not reused during iteration in the grace period. In fact, the lockless readers do not check the nulls marker with get_nulls_value(). So, SOCK_RAW should use hlist instead of hlist_nulls. Instead of adding an unnecessary barrier by sk_nulls_for_each_rcu(), let's convert hlist_nulls to hlist and use sk_for_each_rcu() for fast paths and sk_for_each() and spinlock for /proc/net/raw. [0]: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 2 PID: 20952 Comm: syz-executor.0 Not tainted 6.2.0-g048ec869bafd-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline] RIP: 0010:sock_net include/net/sock.h:649 [inline] RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline] RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline] RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995 Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000 RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338 RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9 R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78 R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030 FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055bb9614b35f CR3: 000000003c672000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: seq_read_iter+0x4c6/0x10f0 fs/seq_file.c:225 seq_read+0x224/0x320 fs/seq_file.c:162 pde_read fs/proc/inode.c:316 [inline] proc_reg_read+0x23f/0x330 fs/proc/inode.c:328 vfs_read+0x31e/0xd30 fs/read_write.c:468 ksys_pread64 fs/read_write.c:665 [inline] __do_sys_pread64 fs/read_write.c:675 [inline] __se_sys_pread64 fs/read_write.c:672 [inline] __x64_sys_pread64+0x1e9/0x280 fs/read_write.c:672 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x478d29 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f843ae8dbe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 RAX: ffffffffffffffda RBX: 0000000000791408 RCX: 0000000000478d29 RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000003 RBP: 00000000f477909a R08: 0000000000000000 R09: 0000000000000000 R10: 000010000000007f R11: 0000000000000246 R12: 0000000000791740 R13: 0000000000791414 R14: 0000000000791408 R15: 00007ffc2eb48a50 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:read_pnet include/net/net_namespace.h:383 [inline] RIP: 0010:sock_net include/net/sock.h:649 [inline] RIP: 0010:raw_get_next net/ipv4/raw.c:974 [inline] RIP: 0010:raw_get_idx net/ipv4/raw.c:986 [inline] RIP: 0010:raw_seq_start+0x431/0x800 net/ipv4/raw.c:995 Code: ef e8 33 3d 94 f7 49 8b 6d 00 4c 89 ef e8 b7 65 5f f7 49 89 ed 49 83 c5 98 0f 84 9a 00 00 00 48 83 c5 c8 48 89 e8 48 c1 e8 03 <42> 80 3c 30 00 74 08 48 89 ef e8 00 3d 94 f7 4c 8b 7d 00 48 89 ef RSP: 0018:ffffc9001154f9b0 EFLAGS: 00010206 RAX: 0000000000000005 RBX: 1ffff1100302c8fd RCX: 0000000000000000 RDX: 0000000000000028 RSI: ffffc9001154f988 RDI: ffffc9000f77a338 RBP: 0000000000000029 R08: ffffffff8a50ffb4 R09: fffffbfff24b6bd9 R10: fffffbfff24b6bd9 R11: 0000000000000000 R12: ffff88801db73b78 R13: fffffffffffffff9 R14: dffffc0000000000 R15: 0000000000000030 FS: 00007f843ae8e700(0000) GS:ffff888063700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f92ff166000 CR3: 000000003c672000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 0daf07e52709 ("raw: convert raw sockets to RCU") Reported-by: syzbot Reported-by: Dae R. Jeong Link: https://lore.kernel.org/netdev/ZCA2mGV_cmq7lIfV@dragonet/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit ca712e47054678c5ce93a0e0f686353ad5561195 Merge: 24b18197184ac abf04be0e7071 Author: Dan Williams Date: Tue Apr 4 15:37:25 2023 -0700 Merge branch 'for-6.3/cxl-doe-fixes' into for-6.3/cxl Pick up the fixes (first 6 patches) from the DOE rework series from Lukas for v6.3-rc. Link: https://lore.kernel.org/all/cover.1678543498.git.lukas@wunner.de/ commit 24b18197184ac39bb8566fb82c0bf788bcd0d45b Author: Dan Williams Date: Mon Apr 3 16:01:32 2023 -0700 cxl/hdm: Extend DVSEC range register emulation for region enumeration One motivation for mapping range registers to decoder objects is to use those settings for region autodiscovery. The need to map a region for devices programmed to use range registers is especially urgent now that the kernel no longer routes "Soft Reserved" ranges in the memory map to device-dax by default. The CXL memory range loses all access mechanisms. Complete the implementation by marking the DPA reservation and setting the endpoint-decoder state to signal autodiscovery. Note that the default settings of ways=1 and granularity=4096 set in cxl_decode_init() do not need to be updated. Fixes: 09d09e04d2fc ("cxl/dax: Create dax devices for CXL RAM regions") Tested-by: Dave Jiang Tested-by: Gregory Price Link: https://lore.kernel.org/r/168012575521.221280.14177293493678527326.stgit@dwillia2-xfh.jf.intel.com Reviewed-by: Dave Jiang Signed-off-by: Dan Williams commit 52cc48ad2a76a5fe82d239044d67944bbb928de6 Author: Dan Williams Date: Mon Apr 3 15:13:37 2023 -0700 cxl/hdm: Limit emulation to the number of range registers Recall that range register emulation seeks to treat the 2 potential range registers as Linux CXL "decoder" objects. The number of range registers can be 1 or 2, while HDM decoder ranges can include more than 2. Be careful not to confuse DVSEC range count with HDM capability decoder count. Commit to range register earlier in devm_cxl_setup_hdm(). Otherwise, a device with more HDM decoders than range registers can set @cxlhdm->decoder_count to an invalid value. Avoid introducing a forward declaration by just moving the definition of should_emulate_decoders() earlier in the file. should_emulate_decoders() is unchanged. Tested-by: Dave Jiang Fixes: d7a2153762c7 ("cxl/hdm: Add emulation when HDM decoders are not committed") Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168012574932.221280.15944705098679646436.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 9ff3eec958cf365857ae8a630237ece4f83bb337 Author: Dan Williams Date: Mon Apr 3 15:01:20 2023 -0700 cxl/region: Move coherence tracking into cxl_region_attach() Each time the contents of a given HPA are potentially changed in a cache incoherent manner the CXL core sets CXL_REGION_F_INCOHERENT to invalidate CPU caches before the region is used. Successful invocation of attach_target() indicates that DPA has been newly assigned to a given HPA in the dynamic region creation flow. However, attach_target() is also reused in the autodiscovery flow where the region was activated by platform firmware. In that case there is no need to invalidate caches because that region is already in active use and nothing about the autodiscovery flow modifies the HPA-to-DPA relationship. In the autodiscovery case cxl_region_attach() exits early after determining the endpoint decoder is already correctly attached to the region. Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery") Reviewed-by: Fan Ni Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168002858817.50647.1217607907088920888.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 030f880342b875c7d714d06d3ca4058ae9f13fee Author: Dan Williams Date: Mon Apr 3 14:44:41 2023 -0700 cxl/region: Fix region setup/teardown for RCDs RCDs (CXL memory devices that link train without VH capability and show up as root complex integrated endpoints), hide the presence of the link between the endpoint and the host-bridge. The CXL region setup/teardown paths assume that a link hop is present and go looking for at least one 'struct cxl_port' instance between the CXL root port-object and an endpoint port-object leading to crashes of the form: BUG: kernel NULL pointer dereference, address: 0000000000000008 [..] RIP: 0010:cxl_region_setup_targets+0x3e9/0xae0 [cxl_core] [..] Call Trace: cxl_region_attach+0x46c/0x7a0 [cxl_core] cxl_create_region+0x20b/0x270 [cxl_core] cxl_mock_mem_probe+0x641/0x800 [cxl_mock_mem] platform_probe+0x5b/0xb0 Detect RCDs explicitly and skip walking the non-existent port hierarchy between root and endpoint in that case. While this has been a problem since: commit 0a19bfc8de93 ("cxl/port: Add RCD endpoint port enumeration") ...it becomes a more reliable crash scenario with the new autodiscovery implementation. Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery") Reviewed-by: Ira Weiny Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168002858268.50647.728091521032131326.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit d35b495ddf92c964eedf2ac86fdbf88dc3e5cbc9 Author: Dan Williams Date: Mon Apr 3 14:39:16 2023 -0700 cxl/port: Fix find_cxl_root() for RCDs and simplify it The find_cxl_root() helper is used to lookup root decoders and other CXL platform topology information for a given endpoint. It turns out that for RCDs it has never worked. The result of find_cxl_root(&cxlmd->dev) is always NULL for the RCH topology case because it expects to find a cxl_port at the host-bridge. RCH topologies only have the root cxl_port object with the host-bridge as a dport. While there are no reports of this being a problem to date, by inspection region enumeration should crash as a result of this problem, and it does in a local unit test for this scenario. However, an observation that ever since: commit f17b558d6663 ("cxl/pmem: Refactor nvdimm device registration, delete the workqueue") ...all callers of find_cxl_root() occur after the memdev connection to the port topology has been established. That means that find_cxl_root() can be simplified to a walk of the endpoint port topology to the root. Switch to that arrangement which also fixes the RCD bug. Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery") Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168002857715.50647.344876437247313909.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit b70c2cf95ee1ca2806cb7191504920f8f5b4454e Author: Dan Williams Date: Mon Apr 3 14:33:48 2023 -0700 cxl/hdm: Skip emulation when driver manages mem_enable If the driver is allowed to enable memory operation itself then it can also turn on HDM decoder support at will. With this the second call to cxl_setup_hdm_decoder_from_dvsec(), when an HDM decoder is not committed, is not needed. Fixes: b777e9bec960 ("cxl/hdm: Emulate HDM decoder from DVSEC range registers") Link: http://lore.kernel.org/r/20230220113657.000042e1@huawei.com Reported-by: Jonathan Cameron Tested-by: Jonathan Cameron Reviewed-by: Jonathan Cameron Reviewed-by: Fan Ni Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/167703068474.185722.664126485486344246.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 82f0832af26a30ae5f21b335c5f68b538e710c29 Author: Dan Williams Date: Tue Apr 4 15:34:12 2023 -0700 cxl/hdm: Fix double allocation of @cxlhdm devm_cxl_setup_emulated_hdm() reallocates an instance of @cxlhdm that was already allocated at the start of devm_cxl_setup_hdm(). Only one is needed and devm_cxl_setup_emulated_hdm() does not do enough to warrant being an explicit helper. Fixes: 4474ce565ee4 ("cxl/hdm: Create emulated cxl_hdm for devices that do not have HDM decoders") Tested-by: Dave Jiang Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/167703067936.185722.7908921750127154779.stgit@dwillia2-xfh.jf.intel.com Link: https://lore.kernel.org/r/168012574357.221280.5001364964799725366.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 38a8c4d1d45006841f0643f4cb29b5e50758837c Author: Keith Busch Date: Fri Mar 31 11:00:56 2023 -0700 blk-mq: directly poll requests Polling needs a bio with a valid bi_bdev, but neither of those are guaranteed for polled driver requests. Make request based polling directly use blk-mq's polling function instead. When executing a request from a polled hctx, we know the request's cookie, and that it's from a live blk-mq queue that supports polling, so we can safely skip everything that bio_poll provides. Cc: stable@kernel.org Reported-by: Martin Belanger Reported-by: Daniel Wagner Signed-off-by: Keith Busch Tested-by: Daniel Wagner Revieded-by: Daniel Wagner Reviewed-by: Chaitanya Kulkarni Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Tested-by: Shin'ichiro Kawasaki Link: https://lore.kernel.org/r/20230331180056.1155862-1-kbusch@meta.com Signed-off-by: Jens Axboe commit 76f598ba7d8e2bfb4855b5298caedd5af0c374a8 Merge: ceeea1b782938 fb5015bc8b733 Author: Linus Torvalds Date: Tue Apr 4 11:29:37 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "PPC: - Hide KVM_CAP_IRQFD_RESAMPLE if XIVE is enabled s390: - Fix handling of external interrupts in protected guests x86: - Resample the pending state of IOAPIC interrupts when unmasking them - Fix usage of Hyper-V "enlightened TLB" on AMD - Small fixes to real mode exceptions - Suppress pending MMIO write exits if emulator detects exception Documentation: - Fix rST syntax" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: docs: kvm: x86: Fix broken field list KVM: PPC: Make KVM_CAP_IRQFD_RESAMPLE platform dependent KVM: s390: pv: fix external interruption loop not always detected KVM: nVMX: Do not report error code when synthesizing VM-Exit from Real Mode KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection KVM: x86: Suppress pending MMIO write exits if emulator detects exception KVM: x86/ioapic: Resample the pending state of an IRQ when unmasking KVM: irqfd: Make resampler_list an RCU list KVM: SVM: Flush Hyper-V TLB when required commit 9da667e50c7e62266f3c2f8ad57b32fca40716b1 Author: Stefano Garzarella Date: Wed Mar 29 18:03:21 2023 +0200 vdpa_sim_net: complete the initialization before register the device Initialization must be completed before calling _vdpa_register_device() since it can connect the device to the vDPA bus, so requests can arrive after that call. So for example vdpasim_net_work(), which uses the net->*_stats variables, can be scheduled before they are initialized. Let's move _vdpa_register_device() to the end of vdpasim_net_dev_add() and add a comment to avoid future issues. Fixes: 0899774cb360 ("vdpa_sim_net: vendor satistics") Signed-off-by: Stefano Garzarella Message-Id: <20230329160321.187176-1-sgarzare@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit ceeea1b78293834378b8d32a18288610de5600f3 Merge: 148341f0a2f53 7de82c2f36fb2 Author: Linus Torvalds Date: Tue Apr 4 11:20:55 2023 -0700 Merge tag 'nfsd-6.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix a crash and a resource leak in NFSv4 COMPOUND processing - Fix issues with AUTH_SYS credential handling - Try again to address an NFS/NFSD/SUNRPC build dependency regression * tag 'nfsd-6.3-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: callback request does not use correct credential for AUTH_SYS NFS: Remove "select RPCSEC_GSS_KRB5 sunrpc: only free unix grouplist after RCU settles nfsd: call op_release, even when op_func returns an error NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL commit fb5015bc8b733323b58f015b88e4f316010ec856 Author: Takahiro Itazuri Date: Fri Mar 31 10:31:16 2023 +0100 docs: kvm: x86: Fix broken field list Add a missing ":" to fix a broken field list. Signed-off-by: Takahiro Itazuri Fixes: ba7bb663f554 ("KVM: x86: Provide per VM capability for disabling PMU virtualization") Message-Id: <20230331093116.99820-1-itazur@amazon.com> Signed-off-by: Paolo Bonzini commit 656e9007ef5862746cdf7ac16267c8e06e7b0989 Author: Arnd Bergmann Date: Thu Mar 2 09:53:31 2023 +0100 asm-generic: avoid __generic_cmpxchg_local warnings Code that passes a 32-bit constant into cmpxchg() produces a harmless sparse warning because of the truncation in the branch that is not taken: fs/erofs/zdata.c: note: in included file (through /home/arnd/arm-soc/arch/arm/include/asm/cmpxchg.h, /home/arnd/arm-soc/arch/arm/include/asm/atomic.h, /home/arnd/arm-soc/include/linux/atomic.h, ...): include/asm-generic/cmpxchg-local.h:29:33: warning: cast truncates bits from constant value (5f0ecafe becomes fe) include/asm-generic/cmpxchg-local.h:33:34: warning: cast truncates bits from constant value (5f0ecafe becomes cafe) include/asm-generic/cmpxchg-local.h:29:33: warning: cast truncates bits from constant value (5f0ecafe becomes fe) include/asm-generic/cmpxchg-local.h:30:42: warning: cast truncates bits from constant value (5f0edead becomes ad) include/asm-generic/cmpxchg-local.h:33:34: warning: cast truncates bits from constant value (5f0ecafe becomes cafe) include/asm-generic/cmpxchg-local.h:34:44: warning: cast truncates bits from constant value (5f0edead becomes dead) This was reported as a regression to Matt's recent __generic_cmpxchg_local patch, though this patch only added more warnings on top of the ones that were already there. Rewording the truncation to use an explicit bitmask instead of a cast to a smaller type avoids the warning but otherwise leaves the code unchanged. I had another look at why the cast is even needed for atomic_cmpxchg(), and as Matt describes the problem here is that atomic_t contains a signed 'int', but cmpxchg() takes an 'unsigned long' argument, and converting between the two leads to a 64-bit sign-extension of negative 32-bit atomics. I checked the other implementations of arch_cmpxchg() and did not find any others that run into the same problem as __generic_cmpxchg_local(), but it's easy to be on the safe side here and always convert the signed int into an unsigned int when calling arch_cmpxchg(), as this will work even when any of the arch_cmpxchg() implementations run into the same problem. Fixes: 624654152284 ("locking/atomic: cmpxchg: Make __generic_cmpxchg_local compare against zero-extended 'old' value") Reviewed-by: Matt Evans Signed-off-by: Arnd Bergmann commit 05d3855b4d21ef3c2df26be1cbba9d2c68915fcb Author: Vladimir Oltean Date: Mon Jan 9 15:11:53 2023 +0200 asm-generic/io.h: suppress endianness warnings for relaxed accessors Copy the forced type casts from the normal MMIO accessors to suppress the sparse warnings that point out __raw_readl() returns a native endian word (just like readl()). Signed-off-by: Vladimir Oltean Signed-off-by: Arnd Bergmann commit d564fa1ff19e893e2971d66e5c8f49dc1cdc8ffc Author: Vladimir Oltean Date: Mon Jan 9 15:11:52 2023 +0200 asm-generic/io.h: suppress endianness warnings for readq() and writeq() Commit c1d55d50139b ("asm-generic/io.h: Fix sparse warnings on big-endian architectures") missed fixing the 64-bit accessors. Arnd explains in the attached link why the casts are necessary, even if __raw_readq() and __raw_writeq() do not take endian-specific types. Link: https://lore.kernel.org/lkml/9105d6fc-880b-4734-857d-e3d30b87ccf6@app.fastmail.com/ Suggested-by: Arnd Bergmann Signed-off-by: Vladimir Oltean Reviewed-by: Jonathan Cameron Signed-off-by: Arnd Bergmann commit e81625218bf7986ba1351a98c43d346b15601d26 Author: Fuad Tabba Date: Tue Apr 4 16:23:21 2023 +0100 KVM: arm64: Advertise ID_AA64PFR0_EL1.CSV2/3 to protected VMs The existing pKVM code attempts to advertise CSV2/3 using values initialized to 0, but never set. To advertise CSV2/3 to protected guests, pass the CSV2/3 values to hyp when initializing hyp's view of guests' ID_AA64PFR0_EL1. Similar to non-protected KVM, these are system-wide, rather than per cpu, for simplicity. Fixes: 6c30bfb18d0b ("KVM: arm64: Add handlers for protected VM System Registers") Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/r/20230404152321.413064-1-tabba@google.com Signed-off-by: Oliver Upton commit 83c911dc5e0e8e6eaa6431c06972a8f159bfe2fc Author: Lingyu Liu Date: Tue Mar 28 10:49:11 2023 +0000 ice: Reset FDIR counter in FDIR init stage Reset the FDIR counters when FDIR inits. Without this patch, when VF initializes or resets, all the FDIR counters are not cleaned, which may cause unexpected behaviors for future FDIR rule create (e.g., rule conflict). Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") Signed-off-by: Junfeng Guo Signed-off-by: Lingyu Liu Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit b4a01ace20f5c93c724abffc0a83ec84f514b98d Author: Simei Su Date: Wed Mar 22 10:24:15 2023 +0800 ice: fix wrong fallback logic for FDIR When adding a FDIR filter, if ice_vc_fdir_set_irq_ctx returns failure, the inserted fdir entry will not be removed and if ice_vc_fdir_write_fltr returns failure, the fdir context info for irq handler will not be cleared which may lead to inconsistent or memory leak issue. This patch refines failure cases to resolve this issue. Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") Signed-off-by: Simei Su Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit f0417e72add5aed5997092b6eb76298290d866c9 Author: Eli Cohen Date: Mon Apr 3 14:40:39 2023 +0300 vdpa/mlx5: Add and remove debugfs in setup/teardown driver The right place to add the debugfs create is in setup_driver() and remove it in teardown_driver(). Current code adds the debugfs when creating the device but resetting a device will remove the debugfs subtree and subsequent set_driver will not be able to create the files since the debugfs pointer is NULL. Fixes: 294221004322 ("vdpa/mlx5: Add debugfs subtree") Signed-off-by: Eli Cohen v3 -> v4: Fix error flow in setup_driver() Message-Id: <20230403114039.11102-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 9513c55ce3e8f0f118c47423452c4a4bdaa80222 Author: Ross Zwisler Date: Wed Feb 15 15:33:50 2023 -0700 tools/virtio: fix typo in README instructions We need to have a unique chardev for each data path, else the chardevs will collide and qemu will die with this message: qemu-system-x86_64: -device virtserialport,bus=virtio-serial0.0,nr=2,chardev=charchannel0, id=channel1,name=trace-path-cpu0: Property 'virtserialport.chardev' can't take value 'charchannel0': Device 'charchannel0' is in use Signed-off-by: Ross Zwisler Message-Id: <20230215223350.2658616-7-zwisler@google.com> Signed-off-by: Michael S. Tsirkin commit 4c363c81f66c77e0a2394b9a4efa707d122dc544 Author: Mike Christie Date: Mon Mar 20 21:06:19 2023 -0500 vhost-scsi: Fix crash during LUN unmapping We normally clear the endpoint then unmap LUNs so the devices are fully shutdown when the LUN is unmapped, but it's legal to unmap before clearing. If the user does that while TMFs are running then we can end up crashing. vhost_scsi_port_unlink assumes that the LUN's tmf struct will always be on the tmf_queue list. However, if a TMF is running then it will have been removed while it's executing. If we do a LUN unmap at this time, then we assume the entry is on the list and just start accessing it and free it. This fixes the bug by just allocating the vhost_scsi_tmf struct when it's needed like is done with the se_tmr struct that's needed when we submit the TMF. In this path perf is not an issue and we can use GFP_KERNEL since it won't swing directly back on us, so we don't need to preallocate the struct. Signed-off-by: Mike Christie Message-Id: <20230321020624.13323-3-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit e508efc3ae7e44eb3caf595a086bfd3824da5b9a Author: Mike Christie Date: Mon Mar 20 21:06:18 2023 -0500 vhost-scsi: Fix vhost_scsi struct use after free If vhost_scsi_setup_vq_cmds fails we leave the tpg->vhost_scsi pointer set. If the device is freed and then the user unmaps the LUN, the call to vhost_scsi_port_unlink -> vhost_scsi_hotunplug will see the that tpg->vhost_scsi is still set and try to use it. This has us clear the vhost_scsi pointer in the failure path. It also has us take tv_tpg_mutex in this failure path, because tv_tpg_vhost_count is accessed under this mutex in vhost_scsi_drop_nexus and in the future we will want to serialize access to tpg->vhost_scsi with that mutex instead of the vhost_scsi_mutex. Signed-off-by: Mike Christie Message-Id: <20230321020624.13323-2-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 10805eb5d6d15fd4f61b05cc7aa269e12ab99848 Author: Dmitry Fomichev Date: Thu Mar 30 17:49:53 2023 -0400 virtio-blk: fix ZBD probe in kernels without ZBD support When the kernel is built without support for zoned block devices, virtio-blk probe needs to error out any host-managed device scans to prevent such devices from appearing in the system as non-zoned. The current virtio-blk code simply bypasses all ZBD checks if CONFIG_BLK_DEV_ZONED is not defined and this leads to host-managed block devices being presented as non-zoned in the OS. This is one of the main problems this patch series is aimed to fix. In this patch, make VIRTIO_BLK_F_ZONED feature defined even when CONFIG_BLK_DEV_ZONED is not. This change makes the code compliant with the voted revision of virtio-blk ZBD spec. Modify the probe code to look at the situation when VIRTIO_BLK_F_ZONED is negotiated in a kernel that is built without ZBD support. In this case, the code checks the zoned model of the device and fails the probe is the device is host-managed. The patch also adds the comment to clarify that the call to perform the zoned device probe is correctly placed after virtio_device ready(). Fixes: 95bfec41bd3d ("virtio-blk: add support for zoned block devices") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Fomichev Reviewed-by: Stefan Hajnoczi Reviewed-by: Damien Le Moal Message-Id: <20230330214953.1088216-3-dmitry.fomichev@wdc.com> Signed-off-by: Michael S. Tsirkin commit f1ba4e674febf5c0e9f725a75ca43b7722b4e963 Author: Dmitry Fomichev Date: Thu Mar 30 17:49:52 2023 -0400 virtio-blk: fix to match virtio spec The merged patch series to support zoned block devices in virtio-blk is not the most up to date version. The merged patch can be found at https://lore.kernel.org/linux-block/20221016034127.330942-3-dmitry.fomichev@wdc.com/ but the latest and reviewed version is https://lore.kernel.org/linux-block/20221110053952.3378990-3-dmitry.fomichev@wdc.com/ The reason is apparently that the correct mailing lists and maintainers were not copied. The differences between the two are mostly cleanups, but there is one change that is very important in terms of compatibility with the approved virtio-zbd specification. Before it was approved, the OASIS virtio spec had a change in VIRTIO_BLK_T_ZONE_APPEND request layout that is not reflected in the current virtio-blk driver code. In the running code, the status is the first byte of the in-header that is followed by some pad bytes and the u64 that carries the sector at which the data has been written to the zone back to the driver, aka the append sector. This layout turned out to be problematic for implementing in QEMU and the request status byte has been eventually made the last byte of the in-header. The current code doesn't expect that and this causes the append sector value always come as zero to the block layer. This needs to be fixed ASAP. Fixes: 95bfec41bd3d ("virtio-blk: add support for zoned block devices") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Fomichev Reviewed-by: Stefan Hajnoczi Reviewed-by: Damien Le Moal Message-Id: <20230330214953.1088216-2-dmitry.fomichev@wdc.com> Signed-off-by: Michael S. Tsirkin commit 7de82c2f36fb26aa78440bbf0efcf360b691d98b Author: Dai Ngo Date: Sat Apr 1 13:22:08 2023 -0700 NFSD: callback request does not use correct credential for AUTH_SYS Currently callback request does not use the credential specified in CREATE_SESSION if the security flavor for the back channel is AUTH_SYS. Problem was discovered by pynfs 4.1 DELEG5 and DELEG7 test with error: DELEG5 st_delegation.testCBSecParms : FAILURE expected callback with uid, gid == 17, 19, got 0, 0 Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Fixes: 8276c902bbe9 ("SUNRPC: remove uid and gid from struct auth_cred") Signed-off-by: Chuck Lever commit 8be8f170e8383fd1421e8b87950e90d7dd45be07 Author: Chuck Lever Date: Tue Mar 28 13:47:58 2023 -0400 NFS: Remove "select RPCSEC_GSS_KRB5 If CONFIG_CRYPTO=n (e.g. arm/shmobile_defconfig): WARNING: unmet direct dependencies detected for RPCSEC_GSS_KRB5 Depends on [n]: NETWORK_FILESYSTEMS [=y] && SUNRPC [=y] && CRYPTO [=n] Selected by [y]: - NFS_V4 [=y] && NETWORK_FILESYSTEMS [=y] && NFS_FS [=y] As NFSv4 can work without crypto enabled, remove the RPCSEC_GSS_KRB5 dependency altogether. Trond says: > It is possible to use the NFSv4.1 client with just AUTH_SYS, and > in fact there are plenty of people out there using only that. The > fact that RFC5661 gets its knickers in a twist about RPCSEC_GSS > support is largely irrelevant to those people. > > The other issue is that ’select’ enforces the strict dependency > that if the NFS client is compiled into the kernel, then the > RPCSEC_GSS and kerberos code needs to be compiled in as well: they > cannot exist as modules. Fixes: e57d06527738 ("NFS & NFSD: Update GSS dependencies") Reported-by: kernel test robot Reported-by: Niklas Söderlund Suggested-by: Trond Myklebust Signed-off-by: Chuck Lever commit 5085e41f9e83a1bec51da1f20b54f2ec3a13a3fe Author: Jeff Layton Date: Thu Mar 30 14:24:27 2023 -0400 sunrpc: only free unix grouplist after RCU settles While the unix_gid object is rcu-freed, the group_info list that it contains is not. Ensure that we only put the group list reference once we are really freeing the unix_gid object. Reported-by: Zhi Li Link: https://bugzilla.redhat.com/show_bug.cgi?id=2183056 Signed-off-by: Jeff Layton Fixes: fd5d2f78261b ("SUNRPC: Make server side AUTH_UNIX use lockless lookups") Signed-off-by: Chuck Lever commit 218c597325f4faf7b7a6049233a30d7842b5b2dc Author: Corinna Vinschen Date: Mon Apr 3 14:11:20 2023 +0200 net: stmmac: fix up RX flow hash indirection table when setting channels stmmac_reinit_queues() fails to fix up the RX hash. Even if the number of channels gets restricted, the output of `ethtool -x' indicates that all RX queues are used: $ ethtool -l enp0s29f2 Channel parameters for enp0s29f2: Pre-set maximums: RX: 8 TX: 8 Other: n/a Combined: n/a Current hardware settings: RX: 8 TX: 8 Other: n/a Combined: n/a $ ethtool -x enp0s29f2 RX flow hash indirection table for enp0s29f2 with 8 RX ring(s): 0: 0 1 2 3 4 5 6 7 8: 0 1 2 3 4 5 6 7 [...] $ ethtool -L enp0s29f2 rx 3 $ ethtool -x enp0s29f2 RX flow hash indirection table for enp0s29f2 with 3 RX ring(s): 0: 0 1 2 3 4 5 6 7 8: 0 1 2 3 4 5 6 7 [...] Fix this by setting the indirection table according to the number of specified queues. The result is now as expected: $ ethtool -L enp0s29f2 rx 3 $ ethtool -x enp0s29f2 RX flow hash indirection table for enp0s29f2 with 3 RX ring(s): 0: 0 1 2 0 1 2 0 1 8: 2 0 1 2 0 1 2 0 [...] Tested on Intel Elkhart Lake. Fixes: 0366f7e06a6b ("net: stmmac: add ethtool support for get/set channels") Signed-off-by: Corinna Vinschen Link: https://lore.kernel.org/r/20230403121120.489138-1-vinschen@redhat.com Signed-off-by: Paolo Abeni commit 13a0d1ae7ee6b438f5537711a8c60cba00554943 Author: Jason Gunthorpe Date: Fri Mar 31 12:32:26 2023 -0300 iommufd: Do not corrupt the pfn list when doing batch carry If batch->end is 0 then setting npfns[0] before computing the new value of pfns will fail to adjust the pfn and result in various page accounting corruptions. It should be ordered after. This seems to result in various kinds of page meta-data corruption related failures: WARNING: CPU: 1 PID: 527 at mm/gup.c:75 try_grab_folio+0x503/0x740 Modules linked in: CPU: 1 PID: 527 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:try_grab_folio+0x503/0x740 Code: e3 01 48 89 de e8 6d c1 dd ff 48 85 db 0f 84 7c fe ff ff e8 4f bf dd ff 49 8d 47 ff 48 89 45 d0 e9 73 fe ff ff e8 3d bf dd ff <0f> 0b 31 db e9 d0 fc ff ff e8 2f bf dd ff 48 8b 5d c8 31 ff 48 89 RSP: 0018:ffffc90000f37908 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 00000000fffffc02 RCX: ffffffff81504c26 RDX: 0000000000000000 RSI: ffff88800d030000 RDI: 0000000000000002 RBP: ffffc90000f37948 R08: 000000000003ca24 R09: 0000000000000008 R10: 000000000003ca00 R11: 0000000000000023 R12: ffffea000035d540 R13: 0000000000000001 R14: 0000000000000000 R15: ffffea000035d540 FS: 00007fecbf659740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200011c3 CR3: 000000000ef66006 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: internal_get_user_pages_fast+0xd32/0x2200 pin_user_pages_fast+0x65/0x90 pfn_reader_user_pin+0x376/0x390 pfn_reader_next+0x14a/0x7b0 pfn_reader_first+0x140/0x1b0 iopt_area_fill_domain+0x74/0x210 iopt_table_add_domain+0x30e/0x6e0 iommufd_device_selftest_attach+0x7f/0x140 iommufd_test+0x10ff/0x16f0 iommufd_fops_ioctl+0x206/0x330 __x64_sys_ioctl+0x10e/0x160 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Cc: Fixes: f394576eb11d ("iommufd: PFN handling for iopt_pages") Link: https://lore.kernel.org/r/3-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: Pengfei Xu Tested-by: Pengfei Xu Signed-off-by: Jason Gunthorpe commit 727c28c1cef2bc013d2c8bb6c50e410a3882a04e Author: Jason Gunthorpe Date: Fri Mar 31 12:32:25 2023 -0300 iommufd: Fix unpinning of pages when an access is present syzkaller found that the calculation of batch_last_index should use 'start_index' since at input to this function the batch is either empty or it has already been adjusted to cross any accesses so it will start at the point we are unmapping from. Getting this wrong causes the unmap to run over the end of the pages which corrupts pages that were never mapped. In most cases this triggers the num pinned debugging: WARNING: CPU: 0 PID: 557 at drivers/iommu/iommufd/pages.c:294 __iopt_area_unfill_domain+0x152/0x560 Modules linked in: CPU: 0 PID: 557 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__iopt_area_unfill_domain+0x152/0x560 Code: d2 0f ff 44 8b 64 24 54 48 8b 44 24 48 31 ff 44 89 e6 48 89 44 24 38 e8 fc d3 0f ff 45 85 e4 0f 85 eb 01 00 00 e8 0e d2 0f ff <0f> 0b e8 07 d2 0f ff 48 8b 44 24 38 89 5c 24 58 89 18 8b 44 24 54 RSP: 0018:ffffc9000108baf0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000ffffffff RCX: ffffffff821e3f85 RDX: 0000000000000000 RSI: ffff88800faf0000 RDI: 0000000000000002 RBP: ffffc9000108bd18 R08: 000000000003ca25 R09: 0000000000000014 R10: 000000000003ca00 R11: 0000000000000024 R12: 0000000000000004 R13: 0000000000000801 R14: 00000000000007ff R15: 0000000000000800 FS: 00007f3499ce1740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000243 CR3: 00000000179c2001 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: iopt_area_unfill_domain+0x32/0x40 iopt_table_remove_domain+0x23f/0x4c0 iommufd_device_selftest_detach+0x3a/0x90 iommufd_selftest_destroy+0x55/0x70 iommufd_object_destroy_user+0xce/0x130 iommufd_destroy+0xa2/0xc0 iommufd_fops_ioctl+0x206/0x330 __x64_sys_ioctl+0x10e/0x160 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Also add some useful WARN_ON sanity checks. Cc: Fixes: 8d160cd4d506 ("iommufd: Algorithms for PFN storage") Link: https://lore.kernel.org/r/2-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: Pengfei Xu Tested-by: Pengfei Xu Signed-off-by: Jason Gunthorpe commit e4395701330fc4aee530905039516fe770b81417 Author: Jason Gunthorpe Date: Fri Mar 31 12:32:24 2023 -0300 iommufd: Check for uptr overflow syzkaller found that setting up a map with a user VA that wraps past zero can trigger WARN_ONs, particularly from pin_user_pages weirdly returning 0 due to invalid arguments. Prevent creating a pages with a uptr and size that would math overflow. WARNING: CPU: 0 PID: 518 at drivers/iommu/iommufd/pages.c:793 pfn_reader_user_pin+0x2e6/0x390 Modules linked in: CPU: 0 PID: 518 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:pfn_reader_user_pin+0x2e6/0x390 Code: b1 11 e9 25 fe ff ff e8 28 e4 0f ff 31 ff 48 89 de e8 2e e6 0f ff 48 85 db 74 0a e8 14 e4 0f ff e9 4d ff ff ff e8 0a e4 0f ff <0f> 0b bb f2 ff ff ff e9 3c ff ff ff e8 f9 e3 0f ff ba 01 00 00 00 RSP: 0018:ffffc90000f9fa30 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff821e2b72 RDX: 0000000000000000 RSI: ffff888014184680 RDI: 0000000000000002 RBP: ffffc90000f9fa78 R08: 00000000000000ff R09: 0000000079de6f4e R10: ffffc90000f9f790 R11: ffff888014185418 R12: ffffc90000f9fc60 R13: 0000000000000002 R14: ffff888007879800 R15: 0000000000000000 FS: 00007f4227555740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000043 CR3: 000000000e748005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: pfn_reader_next+0x14a/0x7b0 ? interval_tree_double_span_iter_update+0x11a/0x140 pfn_reader_first+0x140/0x1b0 iopt_pages_rw_slow+0x71/0x280 ? __this_cpu_preempt_check+0x20/0x30 iopt_pages_rw_access+0x2b2/0x5b0 iommufd_access_rw+0x19f/0x2f0 iommufd_test+0xd11/0x16f0 ? write_comp_data+0x2f/0x90 iommufd_fops_ioctl+0x206/0x330 __x64_sys_ioctl+0x10e/0x160 ? __pfx_iommufd_fops_ioctl+0x10/0x10 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Cc: Fixes: 8d160cd4d506 ("iommufd: Algorithms for PFN storage") Link: https://lore.kernel.org/r/1-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: Pengfei Xu Tested-by: Pengfei Xu Signed-off-by: Jason Gunthorpe commit b277fc793daf258877b4c0744b52f69d6e6ba22e Author: Aneesh Kumar K.V Date: Tue Apr 4 09:44:33 2023 +0530 powerpc/papr_scm: Update the NUMA distance table for the target node Platform device helper routines won't update the NUMA distance table while creating a platform device, even if the device is present on a NUMA node that doesn't have memory or CPU. This is especially true for pmem devices. If the target node of the pmem device is not online, we find the nearest online node to the device and associate the pmem device with that online node. To find the nearest online node, we should have the numa distance table updated correctly. Update the distance information during the device probe. For a papr scm device on NUMA node 3 distance_lookup_table value for distance_ref_points_depth = 2 before and after fix is below: Before fix: node 3 distance depth 0 - 0 node 3 distance depth 1 - 0 node 4 distance depth 0 - 4 node 4 distance depth 1 - 2 node 5 distance depth 0 - 5 node 5 distance depth 1 - 1 After fix node 3 distance depth 0 - 3 node 3 distance depth 1 - 1 node 4 distance depth 0 - 4 node 4 distance depth 1 - 2 node 5 distance depth 0 - 5 node 5 distance depth 1 - 1 Without the fix, the nearest numa node to the pmem device (NUMA node 3) will be picked as 4. After the fix, we get the correct numa node which is 5. Fixes: da1115fdbd6e ("powerpc/nvdimm: Pick nearby online node if the device node is not online") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman Link: https://msgid.link/20230404041433.1781804-1-aneesh.kumar@linux.ibm.com commit c6b486fb33680ad5a3a6390ce693c835caaae3f7 Author: Siddharth Vadapalli Date: Mon Apr 3 14:33:21 2023 +0530 net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe In the am65_cpsw_nuss_probe() function's cleanup path, the call to of_platform_device_destroy() for the common->mdio_dev device is invoked unconditionally. It is possible that either the MDIO node is not present in the device-tree, or the MDIO node is disabled in the device-tree. In both these cases, the MDIO device is not created, resulting in a NULL pointer dereference when the of_platform_device_destroy() function is invoked on the common->mdio_dev device on the cleanup path. Fix this by ensuring that the common->mdio_dev device exists, before attempting to invoke of_platform_device_destroy(). Fixes: a45cfcc69a25 ("net: ethernet: ti: am65-cpsw-nuss: use of_platform_device_create() for mdio") Signed-off-by: Siddharth Vadapalli Reviewed-by: Roger Quadros Link: https://lore.kernel.org/r/20230403090321.835877-1-s-vadapalli@ti.com Signed-off-by: Paolo Abeni commit a3046a618a284579d1189af8711765f553eed707 Author: David Gow Date: Sat Mar 18 12:15:54 2023 +0800 um: Only disable SSE on clang to work around old GCC bugs As part of the Rust support for UML, we disable SSE (and similar flags) to match the normal x86 builds. This both makes sense (we ideally want a similar configuration to x86), and works around a crash bug with SSE generation under Rust with LLVM. However, this breaks compiling stdlib.h under gcc < 11, as the x86_64 ABI requires floating-point return values be stored in an SSE register. gcc 11 fixes this by only doing register allocation when a function is actually used, and since we never use atof(), it shouldn't be a problem: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99652 Nevertheless, only disable SSE on clang setups, as that's a simple way of working around everyone's bugs. Fixes: 884981867947 ("rust: arch/um: Disable FP/SIMD instruction to match x86") Reported-by: Roberto Sassu Link: https://lore.kernel.org/linux-um/6df2ecef9011d85654a82acd607fdcbc93ad593c.camel@huaweicloud.com/ Tested-by: Roberto Sassu Tested-by: SeongJae Park Signed-off-by: David Gow Reviewed-by: Vincenzo Palazzo Tested-by: Arthur Grillo Signed-off-by: Richard Weinberger commit abf04be0e7071f2bcd39bf97ba407e7d4439785e Author: Lukas Wunner Date: Sat Mar 11 15:40:06 2023 +0100 PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y After a pci_doe_task completes, its work_struct needs to be destroyed to avoid a memory leak with CONFIG_DEBUG_OBJECTS=y. Fixes: 9d24322e887b ("PCI/DOE: Add DOE mailbox support functions") Tested-by: Ira Weiny Signed-off-by: Lukas Wunner Reviewed-by: Ira Weiny Reviewed-by: Davidlohr Bueso Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Cc: stable@vger.kernel.org # v6.0+ Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/775768b4912531c3b887d405fc51a50e465e1bf9.1678543498.git.lukas@wunner.de Signed-off-by: Dan Williams commit 92dc899c3b4927f3cfa23f55bf759171234b5802 Author: Lukas Wunner Date: Sat Mar 11 15:40:05 2023 +0100 PCI/DOE: Silence WARN splat with CONFIG_DEBUG_OBJECTS=y Gregory Price reports a WARN splat with CONFIG_DEBUG_OBJECTS=y upon CXL probing because pci_doe_submit_task() invokes INIT_WORK() instead of INIT_WORK_ONSTACK() for a work_struct that was allocated on the stack. All callers of pci_doe_submit_task() allocate the work_struct on the stack, so replace INIT_WORK() with INIT_WORK_ONSTACK() as a backportable short-term fix. The long-term fix implemented by a subsequent commit is to move to a synchronous API which allocates the work_struct internally in the DOE library. Stacktrace for posterity: WARNING: CPU: 0 PID: 23 at lib/debugobjects.c:545 __debug_object_init.cold+0x18/0x183 CPU: 0 PID: 23 Comm: kworker/u2:1 Not tainted 6.1.0-0.rc1.20221019gitaae703b02f92.17.fc38.x86_64 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: pci_doe_submit_task+0x5d/0xd0 pci_doe_discovery+0xb4/0x100 pcim_doe_create_mb+0x219/0x290 cxl_pci_probe+0x192/0x430 local_pci_probe+0x41/0x80 pci_device_probe+0xb3/0x220 really_probe+0xde/0x380 __driver_probe_device+0x78/0x170 driver_probe_device+0x1f/0x90 __driver_attach_async_helper+0x5c/0xe0 async_run_entry_fn+0x30/0x130 process_one_work+0x294/0x5b0 Fixes: 9d24322e887b ("PCI/DOE: Add DOE mailbox support functions") Link: https://lore.kernel.org/linux-cxl/Y1bOniJliOFszvIK@memverge.com/ Reported-by: Gregory Price Tested-by: Ira Weiny Tested-by: Gregory Price Signed-off-by: Lukas Wunner Reviewed-by: Ira Weiny Reviewed-by: Dan Williams Reviewed-by: Gregory Price Cc: stable@vger.kernel.org # v6.0+ Reviewed-by: Jonathan Cameron Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/67a9117f463ecdb38a2dbca6a20391ce2f1e7a06.1678543498.git.lukas@wunner.de Signed-off-by: Dan Williams commit 4fe2c13d59d849be3b45371e3913ec5dc77fc0fb Author: Lukas Wunner Date: Sat Mar 11 15:40:04 2023 +0100 cxl/pci: Handle excessive CDAT length If the length in the CDAT header is larger than the concatenation of the header and all table entries, then the CDAT exposed to user space contains trailing null bytes. Not every consumer may be able to handle that. Per Postel's robustness principle, "be liberal in what you accept" and silently reduce the cached length to avoid exposing those null bytes. Fixes: c97006046c79 ("cxl/port: Read CDAT table") Tested-by: Ira Weiny Signed-off-by: Lukas Wunner Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Cc: stable@vger.kernel.org # v6.0+ Link: https://lore.kernel.org/r/6d98b3c7da5343172bd3ccabfabbc1f31c079d74.1678543498.git.lukas@wunner.de Signed-off-by: Dan Williams commit b56faef2312057db20479b240eb71bd2e51fb51c Author: Lukas Wunner Date: Sat Mar 11 15:40:03 2023 +0100 cxl/pci: Handle truncated CDAT entries If truncated CDAT entries are received from a device, the concatenation of those entries constitutes a corrupt CDAT, yet is happily exposed to user space. Avoid by verifying response lengths and erroring out if truncation is detected. The last CDAT entry may still be truncated despite the checks introduced herein if the length in the CDAT header is too small. However, that is easily detectable by user space because it reaches EOF prematurely. A subsequent commit which rightsizes the CDAT response allocation closes that remaining loophole. The two lines introduced here which exceed 80 chars are shortened to less than 80 chars by a subsequent commit which migrates to a synchronous DOE API and replaces "t.task.rv" by "rc". The existing acpi_cdat_header and acpi_table_cdat struct definitions provided by ACPICA cannot be used because they do not employ __le16 or __le32 types. I believe that cannot be changed because those types are Linux-specific and ACPI is specified for little endian platforms only, hence doesn't care about endianness. So duplicate the structs. Fixes: c97006046c79 ("cxl/port: Read CDAT table") Tested-by: Ira Weiny Signed-off-by: Lukas Wunner Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Cc: stable@vger.kernel.org # v6.0+ Link: https://lore.kernel.org/r/bce3aebc0e8e18a1173425a7a865b232c3912963.1678543498.git.lukas@wunner.de Signed-off-by: Dan Williams commit 34bafc747c54fb58c1908ec3116fa6137393e596 Author: Lukas Wunner Date: Sat Mar 11 15:40:02 2023 +0100 cxl/pci: Handle truncated CDAT header cxl_cdat_get_length() only checks whether the DOE response size is sufficient for the Table Access response header (1 dword), but not the succeeding CDAT header (1 dword length plus other fields). It thus returns whatever uninitialized memory happens to be on the stack if a truncated DOE response with only 1 dword was received. Fix it. Fixes: c97006046c79 ("cxl/port: Read CDAT table") Reported-by: Ming Li Tested-by: Ira Weiny Signed-off-by: Lukas Wunner Reviewed-by: Ming Li Reviewed-by: Dan Williams Reviewed-by: Jonathan Cameron Cc: stable@vger.kernel.org # v6.0+ Reviewed-by: Kuppuswamy Sathyanarayanan Link: https://lore.kernel.org/r/000e69cd163461c8b1bc2cf4155b6e25402c29c7.1678543498.git.lukas@wunner.de Signed-off-by: Dan Williams commit 148341f0a2f53b5e8808d093333d85170586a15d Merge: 2d72ab2449fa9 cb2239c198ad9 Author: Linus Torvalds Date: Mon Apr 3 09:41:24 2023 -0700 Merge tag 'vfs.misc.fixes.v6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfs fix from Christian Brauner: "When a mount or mount tree is made shared the vfs allocates new peer group ids for all mounts that have no peer group id set. Only mounts that aren't marked with MNT_SHARED are relevant here as MNT_SHARED indicates that the mount has fully transitioned to a shared mount. The peer group id handling is done with namespace lock held. On failure, the peer group id settings of mounts for which a new peer group id was allocated need to be reverted and the allocated peer group id freed. The cleanup_group_ids() helper can identify the mounts to cleanup by checking whether a given mount has a peer group id set but isn't marked MNT_SHARED. The deallocation always needs to happen with namespace lock held to protect against concurrent modifications of the propagation settings. This fixes the one place where the namespace lock was dropped before calling cleanup_group_ids()" * tag 'vfs.misc.fixes.v6.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: fs: drop peer group ids under namespace lock commit 2d72ab2449fa9fce8f6898fd5adda10497f7c111 Merge: 7e364e56293bb f8acb24aaf89f Author: Linus Torvalds Date: Mon Apr 3 09:34:08 2023 -0700 Merge tag 'hyperv-fixes-signed-20230402' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Fix a bug in channel allocation for VMbus (Mohammed Gamal) - Do not allow root partition functionality in CVM (Michael Kelley) * tag 'hyperv-fixes-signed-20230402' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/hyperv: Block root partition functionality in a Confidential VM Drivers: vmbus: Check for channel allocation before looking up relids commit 93942b70461574ca7fc3d91494ca89b16a4c64c7 Author: Arseniy Krasnov Date: Wed Mar 29 10:47:26 2023 +0300 mtd: rawnand: meson: fix bitmask for length in command word Valid mask is 0x3FFF, without this patch the following problems were found: 1) [ 0.938914] Could not find a valid ONFI parameter page, trying bit-wise majority to recover it [ 0.947384] ONFI parameter recovery failed, aborting 2) Read with disabled ECC mode was broken. Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") Cc: Signed-off-by: Arseniy Krasnov Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/3794ffbf-dfea-e96f-1f97-fe235b005e19@sberdevices.ru commit 0c3089601f064d80b3838eceb711fcac04bceaad Author: Bang Li Date: Wed Mar 29 00:30:12 2023 +0800 mtdblock: tolerate corrected bit-flips mtd_read() may return -EUCLEAN in case of corrected bit-flips.This particular condition should not be treated like an error. Signed-off-by: Bang Li Fixes: e47f68587b82 ("mtd: check for max_bitflips in mtd_read_oob()") Cc: # v3.7 Acked-by: Richard Weinberger Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230328163012.4264-1-libang.linuxer@gmail.com commit ddbb664b6ab8de7dffa388ae0c88cd18616494e5 Author: Christophe Kerello Date: Tue Mar 28 17:58:19 2023 +0200 mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min Use timings.mode value instead of checking tRC_min timing for EDO mode support. Signed-off-by: Christophe Kerello Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") Cc: stable@vger.kernel.org #v5.10+ Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230328155819.225521-3-christophe.kerello@foss.st.com commit f71e0e329c152c7f11ddfd97ffc62aba152fad3f Author: Christophe Kerello Date: Tue Mar 28 17:58:18 2023 +0200 mtd: rawnand: stm32_fmc2: remove unsupported EDO mode Remove the EDO mode support from as the FMC2 controller does not support the feature. Signed-off-by: Christophe Kerello Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") Cc: stable@vger.kernel.org #v5.4+ Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230328155819.225521-2-christophe.kerello@foss.st.com commit a3c40af4a7ea4fbeecca28a1d4dce6869a8d6995 Merge: 0311454f4f2ef 8671133082176 Author: Arnd Bergmann Date: Mon Apr 3 17:54:01 2023 +0200 Merge tag 'tee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Add explicit cast to (void *) for virt_to_page() argument * tag 'tee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: Pass a pointer to virt_to_page() Link: https://lore.kernel.org/r/20230330124804.GA1943242@rayden Signed-off-by: Arnd Bergmann commit f82e7ca019dfad3b006fd3b772f7ac569672db55 Author: Steven Rostedt (Google) Date: Thu Mar 9 22:13:02 2023 -0500 tracing: Error if a trace event has an array for a __field() A __field() in the TRACE_EVENT() macro is used to set up the fields of the trace event data. It is for single storage units (word, char, int, pointer, etc) and not for complex structures or arrays. Unfortunately, there's nothing preventing the build from accepting: __field(int, arr[5]); from building. It will turn into a array value. This use to work fine, as the offset and size use to be determined by the macro using the field name, but things have changed and the offset and size are now determined by the type. So the above would only be size 4, and the next field will be located 4 bytes from it (instead of 20). The proper way to declare static arrays is to use the __array() macro. Instead of __field(int, arr[5]) it should be __array(int, arr, 5). Add some macro tricks to the building of a trace event from the TRACE_EVENT() macro such that __field(int, arr[5]) will fail to build. A comment by the failure will explain why the build failed. Link: https://lore.kernel.org/lkml/20230306122549.236561-1-douglas.raillard@arm.com/ Link: https://lore.kernel.org/linux-trace-kernel/20230309221302.642e82d9@gandalf.local.home Reported-by: Douglas RAILLARD Signed-off-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) commit d3cba7f02cd82118c32651c73374d8a5a459d9a6 Author: Daniel Bristot de Oliveira Date: Wed Mar 29 17:50:16 2023 +0200 tracing/osnoise: Fix notify new tracing_max_latency osnoise/timerlat tracers are reporting new max latency on instances where the tracing is off, creating inconsistencies between the max reported values in the trace and in the tracing_max_latency. Thus only report new tracing_max_latency on active tracing instances. Link: https://lkml.kernel.org/r/ecd109fde4a0c24ab0f00ba1e9a144ac19a91322.1680104184.git.bristot@kernel.org Cc: stable@vger.kernel.org Fixes: dae181349f1e ("tracing/osnoise: Support a list of trace_array *tr") Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit b9f451a9029a16eb7913ace09b92493d00f2e564 Author: Daniel Bristot de Oliveira Date: Wed Mar 29 17:50:15 2023 +0200 tracing/timerlat: Notify new max thread latency timerlat is not reporting a new tracing_max_latency for the thread latency. The reason is that it is not calling notify_new_max_latency() function after the new thread latency is sampled. Call notify_new_max_latency() after computing the thread latency. Link: https://lkml.kernel.org/r/16e18d61d69073d0192ace07bf61e405cca96e9c.1680104184.git.bristot@kernel.org Cc: stable@vger.kernel.org Fixes: dae181349f1e ("tracing/osnoise: Support a list of trace_array *tr") Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit ea65b41807a26495ff2a73dd8b1bab2751940887 Author: John Keeping Date: Mon Mar 27 18:36:46 2023 +0100 ftrace: Mark get_lock_parent_ip() __always_inline If the compiler decides not to inline this function then preemption tracing will always show an IP inside the preemption disabling path and never the function actually calling preempt_{enable,disable}. Link: https://lore.kernel.org/linux-trace-kernel/20230327173647.1690849-1-john@metanate.com Cc: Masami Hiramatsu Cc: Mark Rutland Cc: stable@vger.kernel.org Fixes: f904f58263e1d ("sched/debug: Fix preempt_disable_ip recording for preempt_disable()") Signed-off-by: John Keeping Signed-off-by: Steven Rostedt (Google) commit 6455b6163d8c680366663cdb8c679514d55fc30c Author: Zheng Yejian Date: Sat Mar 25 10:12:47 2023 +0800 ring-buffer: Fix race while reader and writer are on the same page When user reads file 'trace_pipe', kernel keeps printing following logs that warn at "cpu_buffer->reader_page->read > rb_page_size(reader)" in rb_get_reader_page(). It just looks like there's an infinite loop in tracing_read_pipe(). This problem occurs several times on arm64 platform when testing v5.10 and below. Call trace: rb_get_reader_page+0x248/0x1300 rb_buffer_peek+0x34/0x160 ring_buffer_peek+0xbc/0x224 peek_next_entry+0x98/0xbc __find_next_entry+0xc4/0x1c0 trace_find_next_entry_inc+0x30/0x94 tracing_read_pipe+0x198/0x304 vfs_read+0xb4/0x1e0 ksys_read+0x74/0x100 __arm64_sys_read+0x24/0x30 el0_svc_common.constprop.0+0x7c/0x1bc do_el0_svc+0x2c/0x94 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Then I dump the vmcore and look into the problematic per_cpu ring_buffer, I found that tail_page/commit_page/reader_page are on the same page while reader_page->read is obviously abnormal: tail_page == commit_page == reader_page == { .write = 0x100d20, .read = 0x8f9f4805, // Far greater than 0xd20, obviously abnormal!!! .entries = 0x10004c, .real_end = 0x0, .page = { .time_stamp = 0x857257416af0, .commit = 0xd20, // This page hasn't been full filled. // .data[0...0xd20] seems normal. } } The root cause is most likely the race that reader and writer are on the same page while reader saw an event that not fully committed by writer. To fix this, add memory barriers to make sure the reader can see the content of what is committed. Since commit a0fcaaed0c46 ("ring-buffer: Fix race between reset page and reading page") has added the read barrier in rb_get_reader_page(), here we just need to add the write barrier. Link: https://lore.kernel.org/linux-trace-kernel/20230325021247.2923907-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Fixes: 77ae365eca89 ("ring-buffer: make lockless") Suggested-by: Steven Rostedt (Google) Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 4ccf11c4e8a8e051499d53a12f502196c97a758e Author: Tze-nan Wu Date: Tue Mar 21 19:04:43 2023 +0800 tracing/synthetic: Fix races on freeing last_cmd Currently, the "last_cmd" variable can be accessed by multiple processes asynchronously when multiple users manipulate synthetic_events node at the same time, it could lead to use-after-free or double-free. This patch add "lastcmd_mutex" to prevent "last_cmd" from being accessed asynchronously. ================================================================ It's easy to reproduce in the KASAN environment by running the two scripts below in different shells. script 1: while : do echo -n -e '\x88' > /sys/kernel/tracing/synthetic_events done script 2: while : do echo -n -e '\xb0' > /sys/kernel/tracing/synthetic_events done ================================================================ double-free scenario: process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.free last_cmd(double-free) ================================================================ use-after-free scenario: process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.tracing_log_err(use-after-free) ================================================================ Appendix 1. KASAN report double-free: BUG: KASAN: double-free in kfree+0xdc/0x1d4 Free of addr ***** by task sh/4879 Call trace: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x60/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Allocated by task 4879: ... kstrdup+0x5c/0x98 create_or_delete_synth_event+0x6c/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Freed by task 5464: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x60/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... ================================================================ Appendix 2. KASAN report use-after-free: BUG: KASAN: use-after-free in strlen+0x5c/0x7c Read of size 1 at addr ***** by task sh/5483 sh: CPU: 7 PID: 5483 Comm: sh ... __asan_report_load1_noabort+0x34/0x44 strlen+0x5c/0x7c tracing_log_err+0x60/0x444 create_or_delete_synth_event+0xc4/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Allocated by task 5483: ... kstrdup+0x5c/0x98 create_or_delete_synth_event+0x80/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Freed by task 5480: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x74/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Link: https://lore.kernel.org/linux-trace-kernel/20230321110444.1587-1-Tze-nan.Wu@mediatek.com Fixes: 27c888da9867 ("tracing: Remove size restriction on synthetic event cmd error logging") Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Matthias Brugger Cc: AngeloGioacchino Del Regno Cc: "Tom Zanussi" Signed-off-by: Tze-nan Wu Signed-off-by: Steven Rostedt (Google) commit 0311454f4f2effef609499219a75c70ae21cccc5 Merge: 167fba62c3774 f9d323e7c1724 Author: Arnd Bergmann Date: Mon Apr 3 17:51:09 2023 +0200 Merge tag 'amlogic-fixes-v6.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into arm/fixes Amlogic fixes for v6.3-rc: - fix conflicts between DMC memory space and Amlogic perf driver * tag 'amlogic-fixes-v6.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: perf/amlogic: adjust register offsets arm64: dts: meson-g12-common: resolve conflict between canvas & pmu arm64: dts: meson-g12-common: specify full DMC range Link: https://lore.kernel.org/r/db5fcdb4-60e8-95e6-06b5-1ac474ecabe3@linaro.org Signed-off-by: Arnd Bergmann commit 167fba62c3774b05351cf05e336d66c40f2d43b5 Merge: 7e364e56293bb 172fa6366c0c8 Author: Arnd Bergmann Date: Mon Apr 3 17:50:43 2023 +0200 Merge tag 'optee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes Fixes a spell error in an error message in the OP-TEE driver * tag 'optee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: optee: Fix typo Unuspported -> Unsupported Link: https://lore.kernel.org/r/20230314184441.GA2936721@rayden Signed-off-by: Arnd Bergmann commit 738a96c4a8c36950803fdd27e7c30aca92dccefd Author: Xu Kuohai Date: Sat Apr 1 19:41:44 2023 -0400 bpf, arm64: Fixed a BTI error on returning to patched function When BPF_TRAMP_F_CALL_ORIG is set, BPF trampoline uses BLR to jump back to the instruction next to call site to call the patched function. For BTI-enabled kernel, the instruction next to call site is usually PACIASP, in this case, it's safe to jump back with BLR. But when the call site is not followed by a PACIASP or bti, a BTI exception is triggered. Here is a fault log: Unhandled 64-bit el1h sync exception on CPU0, ESR 0x0000000034000002 -- BTI CPU: 0 PID: 263 Comm: test_progs Tainted: GF Hardware name: linux,dummy-virt (DT) pstate: 40400805 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c) pc : bpf_fentry_test1+0xc/0x30 lr : bpf_trampoline_6442573892_0+0x48/0x1000 sp : ffff80000c0c3a50 x29: ffff80000c0c3a90 x28: ffff0000c2e6c080 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000050 x23: 0000000000000000 x22: 0000ffffcfd2a7f0 x21: 000000000000000a x20: 0000ffffcfd2a7f0 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffcfd2a7f0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff80000914f5e4 x9 : ffff8000082a1528 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0101010101010101 x5 : 0000000000000000 x4 : 00000000fffffff2 x3 : 0000000000000001 x2 : ffff8001f4b82000 x1 : 0000000000000000 x0 : 0000000000000001 Kernel panic - not syncing: Unhandled exception CPU: 0 PID: 263 Comm: test_progs Tainted: GF Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0xec/0x144 show_stack+0x24/0x7c dump_stack_lvl+0x8c/0xb8 dump_stack+0x18/0x34 panic+0x1cc/0x3ec __el0_error_handler_common+0x0/0x130 el1h_64_sync_handler+0x60/0xd0 el1h_64_sync+0x78/0x7c bpf_fentry_test1+0xc/0x30 bpf_fentry_test1+0xc/0x30 bpf_prog_test_run_tracing+0xdc/0x2a0 __sys_bpf+0x438/0x22a0 __arm64_sys_bpf+0x30/0x54 invoke_syscall+0x78/0x110 el0_svc_common.constprop.0+0x6c/0x1d0 do_el0_svc+0x38/0xe0 el0_svc+0x30/0xd0 el0t_64_sync_handler+0x1ac/0x1b0 el0t_64_sync+0x1a0/0x1a4 Kernel Offset: disabled CPU features: 0x0000,00034c24,f994fdab Memory Limit: none And the instruction next to call site of bpf_fentry_test1 is ADD, not PACIASP: : bti c nop nop add w0, w0, #0x1 paciasp For BPF prog, JIT always puts a PACIASP after call site for BTI-enabled kernel, so there is no problem. To fix it, replace BLR with RET to bypass the branch target check. Fixes: efc9909fdce0 ("bpf, arm64: Add bpf trampoline for arm64") Reported-by: Florent Revest Signed-off-by: Xu Kuohai Signed-off-by: Daniel Borkmann Tested-by: Florent Revest Acked-by: Florent Revest Link: https://lore.kernel.org/bpf/20230401234144.3719742-1-xukuohai@huaweicloud.com commit 7b75c4703609a3ebaf67271813521bc0281e1ec1 Author: Dhruva Gole Date: Mon Apr 3 12:54:43 2023 +0530 gpio: davinci: Add irq chip flag to skip set wake Add the IRQCHIP_SKIP_SET_WAKE flag since there are no special IRQ Wake bits that can be set to enable wakeup IRQ. Fixes: 3d9edf09d452 ("[ARM] 4457/2: davinci: GPIO support") Signed-off-by: Dhruva Gole Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit fe092498cb9638418c96675be320c74a16306b48 Author: Dhruva Gole Date: Mon Apr 3 12:54:42 2023 +0530 gpio: davinci: Do not clear the bank intr enable bit in save_context The interrupt enable bits might be set if we want to use the GPIO as wakeup source. Clearing this will mean disabling of interrupts in the GPIO banks that we may want to wakeup from. Thus remove the line that was clearing this bit from the driver's save context function. Cc: Devarsh Thakkar Fixes: 0651a730924b ("gpio: davinci: Add support for system suspend/resume PM") Signed-off-by: Dhruva Gole Reviewed-by: Linus Walleij Acked-by: Keerthy Signed-off-by: Bartosz Golaszewski commit e6db67fa871dee37d22701daba806bfcd4d9df49 Author: Felix Fietkau Date: Thu Mar 30 11:12:59 2023 +0200 wifi: mt76: ignore key disable commands This helps avoid cleartext leakage of already queued or powersave buffered packets, when a reassoc triggers the key deletion. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230330091259.61378-1-nbd@nbd.name commit cf5fa3ca0552f1b7ba8490de40700bbfb6979b17 Author: Kalle Valo Date: Wed Mar 29 19:20:38 2023 +0300 wifi: ath11k: reduce the MHI timeout to 20s Currently ath11k breaks after hibernation, the reason being that ath11k expects that the wireless device will have power during suspend and the firmware will continue running. But of course during hibernation the power from the device is cut off and firmware is not running when resuming, so ath11k will fail. (The reason why ath11k needs the firmware running is the interaction between mac80211 and MHI stack, it's a long story and more info in the bugzilla report.) In SUSE kernels the watchdog timeout is reduced from the default 120 to 60 seconds: CONFIG_DPM_WATCHDOG_TIMEOUT=60 But as the ath11k MHI timeout is 90 seconds the kernel will crash before will ath11k will recover in resume callback. To avoid the crash reduce the MHI timeout to just 20 seconds. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 Link: https://bugzilla.kernel.org/show_bug.cgi?id=214649 Signed-off-by: Kalle Valo Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230329162038.8637-1-kvalo@kernel.org commit de6aa72b265b72bca2b1897d5000c8f0147d3157 Author: Peter Ujfalusi Date: Mon Apr 3 12:09:09 2023 +0300 ASoC: SOF: ipc4-topology: Clarify bind failure caused by missing fw_module The original patch uses a feature in lib/vsprintf.c to handle the invalid address when tring to print *_fw_module->man4_module_entry.name when the *rc_fw_module is NULL. This case is handled by check_pointer_msg() internally and turns the invalid pointer to '(efault)' for printing but it is hiding useful information about the circumstances. Change the print to emmit the name of the widget and a note on which side's fw_module is missing. Fixes: e3720f92e023 ("ASoC: SOF: avoid a NULL dereference with unsupported widgets") Reported-by: Dan Carpenter Link: https://lore.kernel.org/alsa-devel/4826f662-42f0-4a82-ba32-8bf5f8a03256@kili.mountain/ Signed-off-by: Peter Ujfalusi Rule: 'Cc: stable@vger.kernel.org' or 'commit upstream.' Link: https://lore.kernel.org/r/20230403090909.18233-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 9a469c6dfab38326f99f105386db84230be09ee3 Author: Benjamin Asbach Date: Sat Apr 1 01:24:47 2023 +0200 platform/x86: thinkpad_acpi: Add missing T14s Gen1 type to s2idle quirk list From the commit message adding the first s2idle quirks: > Lenovo laptops that contain NVME SSDs across a variety of generations have > trouble resuming from suspend to idle when the IOMMU translation layer is > active for the NVME storage device. > > This generally manifests as a large resume delay or page faults. These > delays and page faults occur as a result of a Lenovo BIOS specific SMI > that runs during the D3->D0 transition on NVME devices. Add the DMI ids for another variant of the T14s Gen1, which also needs the s2idle quirk. Link: https://lore.kernel.org/all/20220503183420.348-1-mario.limonciello@amd.com/ Link: https://bbs.archlinux.org/viewtopic.php?pid=2084655#p2084655 Signed-off-by: Benjamin Asbach Tested-by: Benjamin Asbach Link: https://lore.kernel.org/r/20230331232447.37204-1-asbachb.kernel@impl.it Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 7065655216d4d034d71164641f3bec0b189ad6fa Author: Mark Pearson Date: Sun Apr 2 21:31:20 2023 -0400 platform/x86: think-lmi: Clean up display of current_value on Thinkstation On ThinkStations on retrieving the attribute value the BIOS appends the possible values to the string. Clean up the display in the current_value_show function so the options part is not displayed. Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Reported by Mario Limoncello Link: https://github.com/fwupd/fwupd/issues/5077#issuecomment-1488730526 Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230403013120.2105-2-mpearson-lenovo@squebb.ca Tested-by: Mario Limonciello Tested-by: Mirsad Goran Todorovac Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit e7d796fccdc8d17c2d21817ebe4c7bf5bbfe5433 Author: Mark Pearson Date: Sun Apr 2 21:31:19 2023 -0400 platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings My previous commit introduced a memory leak where the item allocated from tlmi_setting was not freed. This commit also renames it to avoid confusion with the similarly name variable in the same function. Fixes: 8a02d70679fc ("platform/x86: think-lmi: Add possible_values for ThinkStation") Reported-by: Mirsad Todorovac Link: https://lore.kernel.org/lkml/df26ff45-8933-f2b3-25f4-6ee51ccda7d8@gmx.de/T/ Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230403013120.2105-1-mpearson-lenovo@squebb.ca Tested-by: Mario Limonciello Tested-by: Mirsad Goran Todorovac Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit a3c4c053014585dcf20f4df954791b74d8a8afcd Author: Armin Wolf Date: Fri Mar 31 23:33:19 2023 +0200 platform/x86: think-lmi: Fix memory leak when showing current settings When retriving a item string with tlmi_setting(), the result has to be freed using kfree(). In current_value_show() however, malformed item strings are not freed, causing a memory leak. Fix this by eliminating the early return responsible for this. Reported-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/platform-driver-x86/01e920bc-5882-ba0c-dd15-868bf0eca0b8@alu.unizg.hr/T/#t Tested-by: Mirsad Goran Todorovac Fixes: 0fdf10e5fc96 ("platform/x86: think-lmi: Split current_value to reflect only the value") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230331213319.41040-1-W_Armin@gmx.de Tested-by: Mario Limonciello Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit ea30388baebcce37fd594d425a65037ca35e59e8 Author: Ziyang Xuan Date: Mon Apr 3 15:34:17 2023 +0800 ipv6: Fix an uninit variable access bug in __ip6_make_skb() Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] BUG: KMSAN: uninit-value in arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] BUG: KMSAN: uninit-value in atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] BUG: KMSAN: uninit-value in __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 ip6_finish_skb include/net/ipv6.h:1122 [inline] ip6_push_pending_frames+0x10e/0x550 net/ipv6/ip6_output.c:1987 rawv6_push_pending_frames+0xb12/0xb90 net/ipv6/raw.c:579 rawv6_sendmsg+0x297e/0x2e60 net/ipv6/raw.c:922 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline] __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 alloc_skb include/linux/skbuff.h:1270 [inline] __ip6_append_data+0x51c1/0x6bb0 net/ipv6/ip6_output.c:1684 ip6_append_data+0x411/0x580 net/ipv6/ip6_output.c:1854 rawv6_sendmsg+0x2882/0x2e60 net/ipv6/raw.c:915 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because icmp6hdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp6_hdr(skb)->icmp6_type directly will trigger the uninit variable access bug. Use a local variable icmp6_type to carry the correct value in different scenarios. Fixes: 14878f75abd5 ("[IPV6]: Add ICMPMsgStats MIB (RFC 4293) [rev 2]") Reported-by: syzbot+8257f4dcef79de670baf@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=3d605ec1d0a7f2a269a1a6936ac7f2b85975ee9c Signed-off-by: Ziyang Xuan Signed-off-by: David S. Miller commit 839349d13905927d8a567ca4d21d88c82028e31d Author: Sricharan Ramabadhran Date: Mon Apr 3 12:28:51 2023 +0530 net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT On the remote side, when QRTR socket is removed, af_qrtr will call qrtr_port_remove() which broadcasts the DEL_CLIENT packet to all neighbours including local NS. NS upon receiving the DEL_CLIENT packet, will remove the lookups associated with the node:port and broadcasts the DEL_SERVER packet. But on the host side, due to the arrival of the DEL_CLIENT packet, the NS would've already deleted the server belonging to that port. So when the remote's NS again broadcasts the DEL_SERVER for that port, it throws below error message on the host: "failed while handling packet from 2:-2" So fix this error by not broadcasting the DEL_SERVER packet when the DEL_CLIENT packet gets processed." Fixes: 0c2204a4ad71 ("net: qrtr: Migrate nameservice to kernel from userspace") Reviewed-by: Manivannan Sadhasivam Signed-off-by: Ram Kumar Dharuman Signed-off-by: Sricharan Ramabadhran Signed-off-by: David S. Miller commit ad651d68cee75e9ac20002254c4e5d09ee67a84b Author: Daniel Golle Date: Sun Apr 2 12:44:37 2023 +0100 net: sfp: add quirk enabling 2500Base-x for HG MXPD-483II The HG MXPD-483II 1310nm SFP module is meant to operate with 2500Base-X, however, in their EEPROM they incorrectly specify: Transceiver type : Ethernet: 1000BASE-LX ... BR, Nominal : 2600MBd Use sfp_quirk_2500basex for this module to allow 2500Base-X mode anyway. https://forum.banana-pi.org/t/bpi-r3-sfp-module-compatibility/14573/60 Reported-by: chowtom Tested-by: chowtom Signed-off-by: Daniel Golle Reviewed-by: Russell King (Oracle) Signed-off-by: David S. Miller commit dc3421560a67361442f33ec962fc6dd48895a0df Author: Tvrtko Ursulin Date: Mon Mar 20 15:14:23 2023 +0000 drm/i915: Fix context runtime accounting When considering whether to mark one context as stopped and another as started we need to look at whether the previous and new _contexts_ are different and not just requests. Otherwise the software tracked context start time was incorrectly updated to the most recent lite-restore time- stamp, which was in some cases resulting in active time going backward, until the context switch (typically the heartbeat pulse) would synchronise with the hardware tracked context runtime. Easiest use case to observe this behaviour was with a full screen clients with close to 100% engine load. Signed-off-by: Tvrtko Ursulin Fixes: bb6287cb1886 ("drm/i915: Track context current active time") Cc: # v5.19+ Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20230320151423.1708436-1-tvrtko.ursulin@linux.intel.com [tursulin: Fix spelling in commit msg.] (cherry picked from commit b3e70051879c665acdd3a1ab50d0ed58d6a8001f) Signed-off-by: Jani Nikula commit dc30c011469165d57af9adac5baff7d767d20e5c Author: Min Li Date: Tue Mar 28 17:36:27 2023 +0800 drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object. Signed-off-by: Min Li Fixes: f89823c21224 ("drm/i915/perf: Implement I915_PERF_ADD/REMOVE_CONFIG interface") Cc: # v4.14+ Reviewed-by: Andi Shyti Reviewed-by: Umesh Nerlige Ramappa Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20230328093627.5067-1-lm0963hack@gmail.com [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395) Signed-off-by: Jani Nikula commit 95d939bb97ff9be101ae4ceeb322535589da2190 Author: Stanislav Lisovskiy Date: Mon Mar 27 09:42:17 2023 +0300 drm/i915: Use compressed bpp when calculating m/n value for DP MST DSC For obvious reasons, we use compressed bpp instead of pipe bpp for DSC DP SST case. Lets be consistent and use compressed bpp instead of pipe bpp, also in DP MST DSC case. Signed-off-by: Stanislav Lisovskiy Reviewed-by: Vinod Govindapillai Fixes: d51f25eb479a ("drm/i915: Add DSC support to MST path") Link: https://patchwork.freedesktop.org/patch/msgid/20230327064217.24033-1-stanislav.lisovskiy@intel.com (cherry picked from commit ea1deabc6f11575eb3375b454457eaa3c9837abc) Signed-off-by: Jani Nikula commit c74237496fbc799257b091179dd01a3200f7314d Author: Daniele Ceraolo Spurio Date: Mon Mar 13 13:55:56 2023 -0700 drm/i915/huc: Cancel HuC delayed load timer on reset. In the rare case where we do a full GT reset after starting the HuC load and before it completes (which basically boils down to i915 hanging during init), we need to cancel the delayed load fence, as it will be re-initialized in the post-reset recovery. Fixes: 27536e03271d ("drm/i915/huc: track delayed HuC load with a fence") Signed-off-by: Daniele Ceraolo Spurio Cc: Alan Previn Reviewed-by: Alan Previn Link: https://patchwork.freedesktop.org/patch/msgid/20230313205556.1174503-1-daniele.ceraolospurio@intel.com (cherry picked from commit cdf7911f7dbcb37228409a63bf75630776c45a15) Signed-off-by: Jani Nikula commit f1b17f429f066f920a6a1056332e66f8a5b92256 Author: Matthew Auld Date: Mon Jan 30 12:06:31 2023 +0000 drm/i915/ttm: fix sparse warning Sparse complains with: drivers/gpu/drm/i915/gem/i915_gem_ttm.c:1066:21: sparse: expected restricted vm_fault_t [assigned] [usertype] ret drivers/gpu/drm/i915/gem/i915_gem_ttm.c:1066:21: sparse: got int Fixes: 516198d317d8 ("drm/i915: audit bo->resource usage v3") Reported-by: kernel test robot Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20230130101230.25347-1-matthew.auld@intel.com Reviewed-by: Nirmoy Das Acked-by: Christian König Signed-off-by: Christian König (cherry picked from commit fde789e8339c60c8c58e5a71fa819fcfe52d839e) Signed-off-by: Jani Nikula commit 764a2ab9eb56e1200083e771aab16186836edf1d Author: Boris Brezillon Date: Fri May 21 11:38:11 2021 +0200 drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path Make sure all bo->base.pages entries are either NULL or pointing to a valid page before calling drm_gem_shmem_put_pages(). Reported-by: Tomeu Vizoso Cc: Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") Signed-off-by: Boris Brezillon Reviewed-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/20210521093811.1018992-1-boris.brezillon@collabora.com commit dc8289f912387c3bcfbc5d2db29c8947fa207c11 Author: Namjae Jeon Date: Sat Apr 1 13:21:04 2023 +0900 ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that smb2 server operation does not handle it. [ 411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [ 411.400452] CIFS: Attempting to mount \\192.168.45.139\homes [ 411.479312] ksmbd: init_smb2_rsp_hdr : 492 [ 411.479323] ================================================================== [ 411.479327] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199 [ 411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G OE 6.1.21 #3 [ 411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 [ 411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [ 411.479425] Call Trace: [ 411.479428] [ 411.479432] dump_stack_lvl+0x49/0x63 [ 411.479444] print_report+0x171/0x4a8 [ 411.479452] ? kasan_complete_mode_report_info+0x3c/0x200 [ 411.479463] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479497] kasan_report+0xb4/0x130 [ 411.479503] ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479537] kasan_check_range+0x149/0x1e0 [ 411.479543] memcpy+0x24/0x70 [ 411.479550] init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [ 411.479585] handle_ksmbd_work+0x109/0x760 [ksmbd] [ 411.479616] ? _raw_spin_unlock_irqrestore+0x50/0x50 [ 411.479624] ? smb3_encrypt_resp+0x340/0x340 [ksmbd] [ 411.479656] process_one_work+0x49c/0x790 [ 411.479667] worker_thread+0x2b1/0x6e0 [ 411.479674] ? process_one_work+0x790/0x790 [ 411.479680] kthread+0x177/0x1b0 [ 411.479686] ? kthread_complete_and_exit+0x30/0x30 [ 411.479692] ret_from_fork+0x22/0x30 [ 411.479702] Fixes: 39b291b86b59 ("ksmbd: return unsupported error on smb1 mount") Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3a9b557f44ea8f216aab515a7db20e23f0eb51b9 Author: Namjae Jeon Date: Fri Mar 31 08:42:12 2023 +0900 ksmbd: delete asynchronous work from list When smb2_lock request is canceled by smb2_cancel or smb2_close(), ksmbd is missing deleting async_request_entry async_requests list. Because calling init_smb2_rsp_hdr() in smb2_lock() mark ->synchronous as true and then it will not be deleted in ksmbd_conn_try_dequeue_request(). This patch add release_async_work() to release the ones allocated for async work. Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 48b19b79cfa37b1e50da3b5a8af529f994c08901 Author: Zhong Jinghua Date: Wed Mar 29 15:17:39 2023 +0800 scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() The validity of sock should be checked before assignment to avoid incorrect values. Commit 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()") introduced this change which may lead to inconsistent values of tcp_sw_conn->sendpage and conn->datadgst_en. Fix the issue by moving the position of the assignment. Fixes: 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()") Signed-off-by: Zhong Jinghua Link: https://lore.kernel.org/r/20230329071739.2175268-1-zhongjinghua@huaweicloud.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit 85ade4010e13ef152ea925c74d94253db92e5428 Author: Li Zetao Date: Sat Mar 25 11:00:04 2023 +0000 scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() There is a memory leak reported by kmemleak: unreferenced object 0xffffc900003f0000 (size 12288): comm "modprobe", pid 19117, jiffies 4299751452 (age 42490.264s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000629261a8>] __vmalloc_node_range+0xe56/0x1110 [<0000000001906886>] __vmalloc_node+0xbd/0x150 [<000000005bb4dc34>] vmalloc+0x25/0x30 [<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx] [<0000000062b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx] [<00000000641ccc04>] local_pci_probe+0xeb/0x1a0 The root cause is traced to an error-handling path in qla2x00_probe_one() when the adapter "base_vha" initialize failed. The fab_scan_rp "scan.l" is used to record the port information and it is allocated in qla2x00_create_host(). However, it is not released in the error handling path "probe_failed". Fix this by freeing the memory of "scan.l" when an error occurs in the adapter initialization process. Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery") Signed-off-by: Li Zetao Link: https://lore.kernel.org/r/20230325110004.363898-1-lizetao1@huawei.com Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit a3d27dfdcfc27ac3f46de5391bb6d24f04af7941 Author: Ranjan Kumar Date: Fri Mar 31 17:53:17 2023 +0530 scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) The driver is exiting from the fault watchdog thread if it sees the 0xF002 (Soft reset in progress) fault code. If the driver initiates the soft reset, then the driver restarts the watchdog at the end of the soft reset completion. However, if the soft reset is initiated by the firmware asynchronously, then the driver will never restart the watchdog and never re-initialize the controller after the asynchronous soft reset completion. Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20230331122317.11391-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 86eb94bf8006a85738f0ccf49e3ce894e03922a6 Author: Adrien Thierry Date: Wed Mar 29 16:54:25 2023 -0400 scsi: Revert "scsi: ufs: core: Initialize devfreq synchronously" This reverts commit 7dafc3e007918384c8693ff8d70381b5c1e9c247. This patch introduced a regression [1] where hba->pwr_info is used before being initialized, which could create issues in ufshcd_scale_gear(). Revert it until a better solution is found. [1] https://lore.kernel.org/all/CAGaU9a_PMZhqv+YJ0r3w-hJMsR922oxW6Kg59vw+oen-NZ6Otw@mail.gmail.com Signed-off-by: Adrien Thierry Link: https://lore.kernel.org/r/20230329205426.46393-1-athierry@redhat.com Reviewed-by: Stanley Chu Signed-off-by: Martin K. Petersen commit 347dca97f75d461ac2ac256b68e495dfc6f14d61 Author: Eric Van Hensbergen Date: Wed Mar 29 00:07:30 2023 +0000 Update email address and mailing list for v9fs We've recently moved the mailing list to lists.linux.dev to move away from the sourceforge infrastructure. This also updates the website from the (no longer v9fs relevant?) swik.net address to the github group which contains pointers to test cases, the protocol, servers, etc. This also changes my email from my gmail to my kernel.org address. Signed-off-by: Eric Van Hensbergen Acked-by: Dominique Martinet Acked-by: Christian Schoenebeck commit 7e364e56293bb98cae1b55fd835f5991c4e96e7d Author: Linus Torvalds Date: Sun Apr 2 14:29:29 2023 -0700 Linux 6.3-rc5 commit 6ab608fe852b50fe809b22cdf7db6cbe006d7cb3 Merge: f95b8ea79c47c 2280d425ba359 Author: Linus Torvalds Date: Sun Apr 2 10:57:12 2023 -0700 Merge tag 'for-6.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - scan block devices in non-exclusive mode to avoid temporary mkfs failures - fix race between quota disable and quota assign ioctls - fix deadlock when aborting transaction during relocation with scrub - ignore fiemap path cache when there are multiple paths for a node * tag 'for-6.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: ignore fiemap path cache when there are multiple paths for a node btrfs: fix deadlock when aborting transaction during relocation with scrub btrfs: scan device in non-exclusive mode btrfs: fix race between quota disable and quota assign ioctls commit f95b8ea79c47c0ad3d18f45ad538f9970e414d1f Author: Javier Martinez Canillas Date: Tue Feb 7 11:22:54 2023 +0100 Revert "venus: firmware: Correct non-pix start and end addresses" This reverts commit a837e5161cff, which broke probing of the venus driver, at least on the SC7180 SoC HP X2 Chromebook: qcom-venus aa00000.video-codec: Adding to iommu group 11 qcom-venus aa00000.video-codec: non legacy binding qcom-venus aa00000.video-codec: failed to reset venus core qcom-venus: probe of aa00000.video-codec failed with error -110 Matthias Kaehlcke also reported that the same change caused a regression in SC7180 and sc7280, that prevents AOSS from entering sleep mode during system suspend. So let's revert this commit for now to fix both issues. Fixes: a837e5161cff ("venus: firmware: Correct non-pix start and end addresses") Reported-by: Matthias Kaehlcke Signed-off-by: Javier Martinez Canillas Signed-off-by: Linus Torvalds commit a10ca0950afe36fa5a20e8fc3e843beef8808fc1 Merge: 95d0b9d89d78e 5c2712387d485 Author: Linus Torvalds Date: Sun Apr 2 10:10:16 2023 -0700 Merge tag 'driver-core-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are three small changes for 6.3-rc5 semi-related to driver core stuff: - documentation update where we move the security_bugs file to a more relevant location. - mdt/spi-nor debugfs memory leak fix that's been floating around for a long time and acked by the maintainer - cacheinfo bugfix for a regression in 6.3-rc1 All have been in linux-next with no reported problems" * tag 'driver-core-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: cacheinfo: Fix LLC is not exported through sysfs Documentation/security-bugs: move from admin-guide/ to process/ mtd: spi-nor: fix memory leak when using debugfs_lookup() commit 95d0b9d89d78e0983d4feb012b0f12d13d1ae19a Merge: f7772da66255a eca9f6e6f83b6 Author: Linus Torvalds Date: Sun Apr 2 10:01:56 2023 -0700 Merge tag 'powerpc-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix a false positive warning in __pte_needs_flush() (with DEBUG_VM=y) - Fix oops when a PF_IO_WORKER thread tries to core dump - Don't try to reconfigure VAS when it's disabled Thanks to Benjamin Gray, Haren Myneni, Jens Axboe, Nathan Lynch, and Russell Currey. * tag 'powerpc-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc/64s: Fix __pte_needs_flush() false positive warning commit 2584024b23552c00d95b50255e47bd18d306d31a Author: Xin Long Date: Sat Apr 1 19:09:57 2023 -0400 sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts a connection, if its out stream count is set to N while the in stream count in the server is set to N - 2, another thread in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing INIT_ACK. However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake and sends the msg in a non-existing stream(N - 1), the call trace is as below: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] Call Trace: sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163 sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745 The fix is to add an unlikely check for the send stream number after the thread wakes up from the wait_for_sndbuf. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: syzbot+47c24ca20a2fa01f082e@syzkaller.appspotmail.com Signed-off-by: Xin Long Signed-off-by: David S. Miller commit e669ce46740a9815953bb4452a6bc5a7fdc21a50 Author: Felix Fietkau Date: Fri Mar 31 14:49:59 2023 +0200 net: ethernet: mtk_eth_soc: fix remaining throughput regression Based on further tests, it seems that the QDMA shaper is not able to perform shaping close to the MAC link rate without throughput loss. This cannot be compensated by increasing the shaping rate, so it seems to be an internal limit. Fix the remaining throughput regression by detecting that condition and limiting shaping to ports with lower link speed. This patch intentionally ignores link speed gain from TRGMII, because even on such links, shaping to 1000 Mbit/s incurs some throughput degradation. Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues") Tested-By: Frank Wunderlich Reported-by: Frank Wunderlich Signed-off-by: Felix Fietkau Signed-off-by: David S. Miller commit 089b91a0155c4de1209a07ff2a7dd299ff3ece47 Author: Gustav Ekelund Date: Fri Mar 31 10:40:13 2023 +0200 net: dsa: mv88e6xxx: Reset mv88e6393x force WD event bit The force watchdog event bit is not cleared during SW reset in the mv88e6393x switch. This is a different behavior compared to mv886390 which clears the force WD event bit as advertised. This causes a force WD event to be handled over and over again as the SW reset following the event never clears the force WD event bit. Explicitly clear the watchdog event register to 0 in irq_action when handling an event to prevent the switch from sending continuous interrupts. Marvell aren't aware of any other stuck bits apart from the force WD bit. Fixes: de776d0d316f ("net: dsa: mv88e6xxx: add support for mv88e6393x family" Signed-off-by: Gustav Ekelund Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 275b471e3d2daf1472ae8fa70dc1b50c9e0b9e75 Author: Jakub Kicinski Date: Thu Mar 30 19:21:44 2023 -0700 net: don't let netpoll invoke NAPI if in xmit context Commit 0db3dc73f7a3 ("[NETPOLL]: tx lock deadlock fix") narrowed down the region under netif_tx_trylock() inside netpoll_send_skb(). (At that point in time netif_tx_trylock() would lock all queues of the device.) Taking the tx lock was problematic because driver's cleanup method may take the same lock. So the change made us hold the xmit lock only around xmit, and expected the driver to take care of locking within ->ndo_poll_controller(). Unfortunately this only works if netpoll isn't itself called with the xmit lock already held. Netpoll code is careful and uses trylock(). The drivers, however, may be using plain lock(). Printing while holding the xmit lock is going to result in rare deadlocks. Luckily we record the xmit lock owners, so we can scan all the queues, the same way we scan NAPI owners. If any of the xmit locks is held by the local CPU we better not attempt any polling. It would be nice if we could narrow down the check to only the NAPIs and the queue we're trying to use. I don't see a way to do that now. Reported-by: Roman Gushchin Fixes: 0db3dc73f7a3 ("[NETPOLL]: tx lock deadlock fix") Signed-off-by: Jakub Kicinski Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit ea4f1009408efb4989a0f139b70fb338e7f687d0 Author: Zheng Wang Date: Mon Mar 13 22:43:25 2023 +0800 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring to init priv->rings and bound &ring->work with p9_xen_response. When it calls xen_9pfs_front_event_handler to handle IRQ requests, it will finally call schedule_work to start the work. When we call xen_9pfs_front_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in xen_9pfs_front_free. Note that, this bug is found by static analysis, which might be false positive. CPU0 CPU1 |p9_xen_response xen_9pfs_front_remove| xen_9pfs_front_free| kfree(priv) | //free priv | |p9_tag_lookup |//use priv->client Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Zheng Wang Reviewed-by: Michal Swiatkowski Signed-off-by: Eric Van Hensbergen commit b4a72c0589fdea6259720375426179888969d6a2 Author: Wojciech Lukowicz Date: Sat Apr 1 20:50:39 2023 +0100 io_uring: fix memory leak when removing provided buffers When removing provided buffers, io_buffer structs are not being disposed of, leading to a memory leak. They can't be freed individually, because they are allocated in page-sized groups. They need to be added to some free list instead, such as io_buffers_cache. All callers already hold the lock protecting it, apart from when destroying buffers, so had to extend the lock there. Fixes: cc3cec8367cb ("io_uring: speedup provided buffer handling") Signed-off-by: Wojciech Lukowicz Link: https://lore.kernel.org/r/20230401195039.404909-2-wlukowicz01@gmail.com Signed-off-by: Jens Axboe commit c0921e51dab767ef5adf6175c4a0ba3c6e1074a3 Author: Wojciech Lukowicz Date: Sat Apr 1 20:50:38 2023 +0100 io_uring: fix return value when removing provided buffers When a request to remove buffers is submitted, and the given number to be removed is larger than available in the specified buffer group, the resulting CQE result will be the number of removed buffers + 1, which is 1 more than it should be. Previously, the head was part of the list and it got removed after the loop, so the increment was needed. Now, the head is not an element of the list, so the increment shouldn't be there anymore. Fixes: dbc7d452e7cf ("io_uring: manage provided buffers strictly ordered") Signed-off-by: Wojciech Lukowicz Link: https://lore.kernel.org/r/20230401195039.404909-2-wlukowicz01@gmail.com Signed-off-by: Jens Axboe commit f7772da66255ab2b478a33df404a335fab55cc25 Merge: 00c7b5f4ddc5b e03677100707f Author: Linus Torvalds Date: Sat Apr 1 14:50:22 2023 -0700 Merge tag '6.3-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Four cifs/smb3 client (reconnect and DFS related) fixes, including two for stable: - DFS oops fix - DFS reconnect recursion fix - An SMB1 parallel reconnect fix - Trivial dead code removal in smb2_reconnect" * tag '6.3-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: get rid of dead check in smb2_reconnect() cifs: prevent infinite recursion in CIFSGetDFSRefer() cifs: avoid races in parallel reconnects in smb1 cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL commit 00c7b5f4ddc5b346df62b757ec73f9357bb452af Merge: 93e2b01740863 cbedf1a33970c Author: Linus Torvalds Date: Sat Apr 1 14:09:51 2023 -0700 Merge tag 'input-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - fixes to ALPS and Focaltech PS/2 drivers dealing with the breakage of switching to -funsigned-char - quirks to i8042 to better handle Lifebook A574/H and TUXEDO devices - a quirk to Goodix touchscreen driver to handle Yoga Book X90F - a fix for incorrectly merged patch to xpad game controller driver * tag 'input-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix Input: alps - fix compatibility with -funsigned-char Input: focaltech - use explicitly signed char type Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table Input: i8042 - add quirk for Fujitsu Lifebook A574/H commit 93e2b01740863cf2f4a58887ac1384e6324b50a2 Merge: ce0c2375ff567 e4056e38ec87b Author: Linus Torvalds Date: Sat Apr 1 09:47:08 2023 -0700 Merge tag 'pinctrl-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some pin control fixes for the v6.3 series. The most notable and urgent one is probably the AMD fix which affects AMD laptops, found by the Chromium people. Summary: - Fix up the Kconfig options for MediaTek MT7981 - Fix the irq domain name in the AT91-PIO4 driver - Fix some alternative muxing modes in the Ocelot driver - Allocate the GPIO numbers dynamically in the STM32 driver - Disable and mask interrupts on resume in the AMD driver - Fix a typo in the Qualcomm SM8550 pin control device tree bindings" * tag 'pinctrl-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: dt-bindings: pinctrl: qcom,sm8550-lpass-lpi: allow input-enabled and bias-bus-hold pinctrl: amd: Disable and mask interrupts on resume pinctrl: stm32: use dynamic allocation of GPIO base pinctrl: ocelot: Fix alt mode for ocelot pinctrl: at91-pio4: fix domain name assignment pinctrl: mediatek: fix naming inconsistency pinctrl: mediatek: add missing options to PINCTRL_MT7981 commit ce0c2375ff56781ee26d9ad6b4cb40d85e0a9ebd Merge: 92367fdf3b699 fb27e70f6e408 Author: Linus Torvalds Date: Sat Apr 1 09:25:17 2023 -0700 Merge tag 'kbuild-fixes-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix linux-headers debian package - Fix a merge_config.sh error due to a misspelled variable - Fix modversion for 32-bit build machines * tag 'kbuild-fixes-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: modpost: Fix processing of CRCs on 32-bit build machines scripts: merge_config: Fix typo in variable name. kbuild: deb-pkg: set version for linux-headers paths commit 92367fdf3b699e97acb4d5fbf7159f5c458b2b30 Merge: 7b50567bdcad8 16812c96550c3 Author: Linus Torvalds Date: Sat Apr 1 09:17:33 2023 -0700 Merge tag 'iommu-fixes-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Maintainer update for S390 IOMMU driver - A fix for the set_platform_dma_ops() call-back in the Exynos IOMMU driver - Intel VT-d fixes from Lu Baolu: - Fix a lockdep splat - Fix a supplement of the specification - Fix a warning in perfmon code * tag 'iommu-fixes-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Fix an IOMMU perfmon warning when CPU hotplug iommu/vt-d: Allow zero SAGAW if second-stage not supported iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() iommu/exynos: Fix set_platform_dma_ops() callback MAINTAINERS: Update s390-iommu driver maintainer information commit f785f5ee968f7045268b8be6b0abc850c4a4277c Author: Takashi Iwai Date: Fri Mar 31 16:22:17 2023 +0200 ALSA: hda/hdmi: Preserve the previous PCM device upon re-enablement When a DRM driver turns on or off the screen with the audio capability, it notifies the ELD to HD-audio HDMI codec driver via component ops. HDMI codec driver, in turn, attaches or detaches the PCM stream for the given port on the fly. The problem is that, since the recent code change, the HDMI driver always treats the PCM stream assignment dynamically; this ended up the confusion of the PCM device appearance. e.g. when a screen goes once off and on again, it may appear on a different PCM device before the screen-off. Although the application should treat such a change, it doesn't seem working gracefully with the current pipewire (maybe PulseAudio, too). As a workaround, this patch changes the HDMI codec driver behavior slightly to be more consistent. Now it remembers the previous PCM slot for the given port and try to assign to it. That is, if a port is re-enabled, the driver tries to use the same PCM slot that was assigned to that port previously. If it conflicts, a new slot is searched and used like before, instead. Note that multiple monitor connections are the only typical case where the PCM slot preservation is effective. As long as only a single monitor is connected, the behavior isn't changed, and the first PCM slot is still assigned always. Fixes: ef6f5494faf6 ("ALSA: hda/hdmi: Use only dynamic PCM device allocation") Reviewed-by: Jaroslav Kysela Link: https://bugzilla.kernel.org/show_bug.cgi?id=217259 Link: https://lore.kernel.org/r/20230331142217.19791-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit ffef73791574b8da872cfbf881d8e3e9955fc130 Author: Liang He Date: Wed Mar 22 11:56:27 2023 +0800 iio: dac: ad5755: Add missing fwnode_handle_put() In ad5755_parse_fw(), we should add fwnode_handle_put() when break out of the iteration device_for_each_child_node() as it will automatically increase and decrease the refcounter. Fixes: 3ac27afefd5d ("iio:dac:ad5755: Switch to generic firmware properties and drop pdata") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20230322035627.1856421-1-windhl@126.com Cc: Signed-off-by: Jonathan Cameron commit 73a428b37b9b538f8f8fe61caa45e7f243bab87c Author: Dan Carpenter Date: Wed Mar 29 07:35:32 2023 +0300 iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger() The at91_adc_allocate_trigger() function is supposed to return error pointers. Returning a NULL will cause an Oops. Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/5d728f9d-31d1-410d-a0b3-df6a63a2c8ba@kili.mountain Signed-off-by: Jonathan Cameron commit 7d63b67125382ff0ffdfca434acbc94a38bd092b Author: Eric Dumazet Date: Thu Mar 30 17:45:02 2023 +0000 icmp: guard against too small mtu syzbot was able to trigger a panic [1] in icmp_glue_bits(), or more exactly in skb_copy_and_csum_bits() There is no repro yet, but I think the issue is that syzbot manages to lower device mtu to a small value, fooling __icmp_send() __icmp_send() must make sure there is enough room for the packet to include at least the headers. We might in the future refactor skb_copy_and_csum_bits() and its callers to no longer crash when something bad happens. [1] kernel BUG at net/core/skbuff.c:3343 ! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 15766 Comm: syz-executor.0 Not tainted 6.3.0-rc4-syzkaller-00039-gffe78bbd5121 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:skb_copy_and_csum_bits+0x798/0x860 net/core/skbuff.c:3343 Code: f0 c1 c8 08 41 89 c6 e9 73 ff ff ff e8 61 48 d4 f9 e9 41 fd ff ff 48 8b 7c 24 48 e8 52 48 d4 f9 e9 c3 fc ff ff e8 c8 27 84 f9 <0f> 0b 48 89 44 24 28 e8 3c 48 d4 f9 48 8b 44 24 28 e9 9d fb ff ff RSP: 0018:ffffc90000007620 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000001e8 RCX: 0000000000000100 RDX: ffff8880276f6280 RSI: ffffffff87fdd138 RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000000001e8 R11: 0000000000000001 R12: 000000000000003c R13: 0000000000000000 R14: ffff888028244868 R15: 0000000000000b0e FS: 00007fbc81f1c700(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2df43000 CR3: 00000000744db000 CR4: 0000000000150ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: icmp_glue_bits+0x7b/0x210 net/ipv4/icmp.c:353 __ip_append_data+0x1d1b/0x39f0 net/ipv4/ip_output.c:1161 ip_append_data net/ipv4/ip_output.c:1343 [inline] ip_append_data+0x115/0x1a0 net/ipv4/ip_output.c:1322 icmp_push_reply+0xa8/0x440 net/ipv4/icmp.c:370 __icmp_send+0xb80/0x1430 net/ipv4/icmp.c:765 ipv4_send_dest_unreach net/ipv4/route.c:1239 [inline] ipv4_link_failure+0x5a9/0x9e0 net/ipv4/route.c:1246 dst_link_failure include/net/dst.h:423 [inline] arp_error_report+0xcb/0x1c0 net/ipv4/arp.c:296 neigh_invalidate+0x20d/0x560 net/core/neighbour.c:1079 neigh_timer_handler+0xc77/0xff0 net/core/neighbour.c:1166 call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700 expire_timers+0x29b/0x4b0 kernel/time/timer.c:1751 __run_timers kernel/time/timer.c:2022 [inline] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+d373d60fddbdc915e666@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230330174502.1915328-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit adef41b03b35839e5677aace628d02597f04a616 Author: Jakub Kicinski Date: Fri Mar 31 21:16:22 2023 -0700 Revert "net: netcp: MAX_SKB_FRAGS is now 'int'" This reverts commit c5b959eeb7f9e40673b97c08c71cbfff5f5923f2. Reverted change is required after commit 3948b05950fd ("net: introduce a config option to tweak MAX_SKB_FRAGS") which does not exist in this tree, yet. It's only present in -next trees at the time of writing. Reported-by: Nathan Chancellor Link: https://lore.kernel.org/all/20230331214444.GA1426512@dev-arch.thelio-3990X/ Signed-off-by: Jakub Kicinski commit 7f67aa097e875c87fba024e850cf405342300059 Author: Karol Herbst Date: Fri Mar 31 00:39:38 2023 +0200 drm/nouveau/disp: Support more modes by checking with lower bpc This allows us to advertise more modes especially on HDR displays. Fixes using 4K@60 modes on my TV and main display both using a HDMI to DP adapter. Also fixes similar issues for users running into this. Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Karol Herbst Reviewed-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230330223938.4025569-1-kherbst@redhat.com commit 7b50567bdcad8925ca1e075feb7171c12015afd1 Author: Arnd Bergmann Date: Tue Feb 7 17:13:12 2023 +0100 media: i2c: imx290: fix conditional function defintions The runtime suspend/resume functions are only referenced from the dev_pm_ops, but they use the old SET_RUNTIME_PM_OPS() helper that requires a __maybe_unused annotation to avoid a warning: drivers/media/i2c/imx290.c:1082:12: error: unused function 'imx290_runtime_resume' [-Werror,-Wunused-function] static int imx290_runtime_resume(struct device *dev) ^ drivers/media/i2c/imx290.c:1090:12: error: unused function 'imx290_runtime_suspend' [-Werror,-Wunused-function] static int imx290_runtime_suspend(struct device *dev) ^ Convert this to the new RUNTIME_PM_OPS() helper that so this is not required. To improve this further, also use the pm_ptr() helper that lets the dev_pm_ops get dropped entirely when CONFIG_PM is disabled. A related mistake happened in the of_match_ptr() macro here, which like SET_RUNTIME_PM_OPS() requires the match table to be marked as __maybe_unused, though I could not reproduce building this without CONFIG_OF. Remove the of_match_ptr() here as there is no point in dropping the match table in configurations without CONFIG_OF. Fixes: 02852c01f654 ("media: i2c: imx290: Initialize runtime PM before subdev") Signed-off-by: Arnd Bergmann Reported-by: Guenter Roeck Reported-by: Sudip Mukherjee Reviewed-by: Manivannan Sadhasivam Reviewed-by: Laurent Pinchart Signed-off-by: Linus Torvalds commit 15a8b55dbb1ba154d82627547c5761cac884d810 Author: Jeff Layton Date: Mon Mar 27 06:21:37 2023 -0400 nfsd: call op_release, even when op_func returns an error For ops with "trivial" replies, nfsd4_encode_operation will shortcut most of the encoding work and skip to just marshalling up the status. One of the things it skips is calling op_release. This could cause a memory leak in the layoutget codepath if there is an error at an inopportune time. Have the compound processing engine always call op_release, even when op_func sets an error in op->status. With this change, we also need nfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL on error to avoid a double free. Reported-by: Zhi Li Link: https://bugzilla.redhat.com/show_bug.cgi?id=2181403 Fixes: 34b1744c91cc ("nfsd4: define ->op_release for compound ops") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 804d8e0a6e54427268790472781e03bc243f4ee3 Author: Chuck Lever Date: Fri Mar 31 16:31:19 2023 -0400 NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL OPDESC() simply indexes into nfsd4_ops[] by the op's operation number, without range checking that value. It assumes callers are careful to avoid calling it with an out-of-bounds opnum value. nfsd4_decode_compound() is not so careful, and can invoke OPDESC() with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end of nfsd4_ops[]. Reported-by: Jeff Layton Fixes: f4f9ef4a1b0a ("nfsd4: opdesc will be useful outside nfs4proc.c") Signed-off-by: Chuck Lever commit a0264d198aad19429df0ca2e320caf8b1f98ec64 Merge: 5a57b48fdfcb1 943d045a6d796 Author: Linus Torvalds Date: Fri Mar 31 13:22:14 2023 -0700 Merge tag 'nfs-for-6.3-3' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Fix shutdown of NFS TCP client sockets - Fix hangs when recovering open state after a server reboot * tag 'nfs-for-6.3-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: SUNRPC: fix shutdown of NFS TCP client socket NFSv4: Fix hangs when recovering open state after a server reboot commit 5a57b48fdfcb1e196292665d87fac46180344f8a Merge: 916fc60988545 e3271a5917d15 Author: Linus Torvalds Date: Fri Mar 31 13:11:06 2023 -0700 Merge tag 'platform-drivers-x86-v6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: - Fix a regression in ideapad-laptop which caused the touchpad to stop working after a suspend/resume on some models - One other small fix and three hw-id additions * tag 'platform-drivers-x86-v6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE platform/x86: asus-nb-wmi: Add quirk_asus_tablet_mode to other ROG Flow X13 models platform/x86: gigabyte-wmi: add support for X570S AORUS ELITE platform/x86: gigabyte-wmi: add support for B650 AORUS ELITE AX platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix commit 916fc60988545499530104342a01df6357fd3647 Merge: 3df82e4201f54 cdce67099117e Author: Linus Torvalds Date: Fri Mar 31 13:07:01 2023 -0700 Merge tag 'pci-v6.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Fix DesignWare PORT_LINK_CONTROL setup, which was corrupted when the DT "snps,enable-cdm-check" property was present (Yoshihiro Shimoda) * tag 'pci-v6.3-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled commit 3df82e4201f5415f4773d4ca8f0ee5a71d5b88fa Merge: 81409e5e483cb 02bcba0b9f9da Author: Linus Torvalds Date: Fri Mar 31 13:02:34 2023 -0700 Merge tag 'regulator-fix-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "Deferred probe fix for v6.3. This fixes a rarely triggered issue where we would treat probe deferral for clocks as a fatal error in the fixed regulator, causing it to fail to retry when it should" * tag 'regulator-fix-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: Handle deferred clk commit 36d4d213c6d4fffae2645a601e8ae996de4c3645 Author: Jeremy Soller Date: Fri Mar 31 10:23:17 2023 -0600 ALSA: hda/realtek: Add quirk for Clevo X370SNW Fixes speaker output and headset detection on Clevo X370SNW. Signed-off-by: Jeremy Soller Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20230331162317.14992-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit f43359501e2d70ba8a68f2302c1009d9194fc60d Merge: 9fdc1605c5042 e3720f92e0237 Author: Takashi Iwai Date: Fri Mar 31 21:37:02 2023 +0200 Merge tag 'asoc-fix-v6.3-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.3 More fixes for v6.3, plus a few new trivial device ID additions. Almost all of this is for the Intel drivers, though there is one core fix from Shengjiu which ensures that format constraints are correctly applied in some cases where they were missed. commit 81409e5e483cbdf6930e24c8556a289266fea39f Merge: f3fa7f026e5fa 24ab70d83784a Author: Linus Torvalds Date: Fri Mar 31 12:35:03 2023 -0700 Merge tag 'block-6.3-2023-03-30' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - Mark Lexar NM760 as IGNORE_DEV_SUBNQN (Juraj Pecigos) - Fix a possible UAF when failing to allocate an TCP io queue (Sagi Grimberg) - MD pull request via Song: - Fix a null pointer deference in 6.3-rc (Yu Kuai) - uevent partition fix (Alyssa) * tag 'block-6.3-2023-03-30' of git://git.kernel.dk/linux: nvme-tcp: fix a possible UAF when failing to allocate an io queue md: fix regression for null-ptr-deference in __md_stop() nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN loop: LOOP_CONFIGURE: send uevents for partitions commit f3fa7f026e5faf10f730b0655b2f96f86d3c7dd8 Merge: 2bac7dc169af3 fd30d1cdcc4ff Author: Linus Torvalds Date: Fri Mar 31 12:30:13 2023 -0700 Merge tag 'io_uring-6.3-2023-03-30' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix a regression with the poll retry, introduced in this merge window (me) - Fix a regression with the alloc cache not decrementing the member count on removal. Also a regression from this merge window (Pavel) - Fix race around rsrc node grabbing (Pavel) * tag 'io_uring-6.3-2023-03-30' of git://git.kernel.dk/linux: io_uring: fix poll/netmsg alloc caches io_uring/rsrc: fix rogue rsrc node grabbing io_uring/poll: clear single/double poll flags on poll arming commit e3271a5917d1501089b1a224d702aa053e2877f4 Author: Hans de Goede Date: Thu Mar 30 21:46:44 2023 +0200 platform/x86: ideapad-laptop: Stop sending KEY_TOUCHPAD_TOGGLE Commit 5829f8a897e4 ("platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some models") made ideapad-laptop send KEY_TOUCHPAD_TOGGLE when we receive an ACPI notify with VPC event bit 5 set and the touchpad-state has not been changed by the EC itself already. This was done under the assumption that this would be good to do to make the touchpad-toggle hotkey work on newer models where the EC does not toggle the touchpad on/off itself (because it is not routed through the PS/2 controller, but uses I2C). But it turns out that at least some models, e.g. the Yoga 7-15ITL5 the EC triggers an ACPI notify with VPC event bit 5 set on resume, which would now cause a spurious KEY_TOUCHPAD_TOGGLE on resume to which the desktop environment responds by disabling the touchpad in software, breaking the touchpad (until manually re-enabled) on resume. It was never confirmed that sending KEY_TOUCHPAD_TOGGLE actually improves things on new models and at least some new models like the Yoga 7-15ITL5 don't have a touchpad on/off toggle hotkey at all, while still sending ACPI notify events with VPC event bit 5 set. So it seems best to revert the change to send KEY_TOUCHPAD_TOGGLE when receiving an ACPI notify events with VPC event bit 5 and the touchpad state as reported by the EC has not changed. Note this is not a full revert the code to cache the last EC touchpad state is kept to avoid sending spurious KEY_TOUCHPAD_ON / _OFF events on resume. Fixes: 5829f8a897e4 ("platform/x86: ideapad-laptop: Send KEY_TOUCHPAD_TOGGLE on some models") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217234 Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230330194644.64628-1-hdegoede@redhat.com commit e352d685fde427a8fc9beb2ba30888f5d6f2e5e6 Author: weiliang1503 Date: Thu Mar 30 19:49:43 2023 +0800 platform/x86: asus-nb-wmi: Add quirk_asus_tablet_mode to other ROG Flow X13 models Make quirk_asus_tablet_mode apply on other ROG Flow X13 devices, which only affects the GV301Q model before. Signed-off-by: weiliang1503 Link: https://lore.kernel.org/r/20230330114943.15057-1-weiliang1503@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 52f91e51944808d83dfe2d5582601b5e84e472cc Author: Hans de Goede Date: Fri Mar 31 19:31:48 2023 +0200 platform/x86: gigabyte-wmi: add support for X570S AORUS ELITE Add "X570S AORUS ELITE" to known working boards Reported-by: Brandon Nielsen Link: https://lore.kernel.org/r/20230331014902.7864-1-nielsenb@jetfuse.net Signed-off-by: Hans de Goede commit 2bac7dc169af3cd4a0cb5200aa1f7b89affa042a Merge: f964333194b87 896c5150edfd5 Author: Linus Torvalds Date: Fri Mar 31 10:23:27 2023 -0700 Merge tag 'thermal-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "These remove two recently added excessive lockdep assertions from the sysfs-related thermal code and fix two issues in Intel thermal drivers. Specifics: - Drop two lockdep assertions producing false positive warnings from the sysfs-related thermal core code (Rafael Wysocki) - Fix handling of two recently added module parameters in the Intel powerclamp thermal driver (David Arcari) - Fix one more deadlock in the int340x thermal driver (Srinivas Pandruvada)" * tag 'thermal-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: powerclamp: Fix cpumask and max_idle module parameters thermal: intel: int340x: processor_thermal: Fix additional deadlock thermal: core: Drop excessive lockdep_assert_held() calls commit f964333194b877effae897314d89818347ed90d7 Merge: 39f692125c388 c56610a869bce Author: Linus Torvalds Date: Fri Mar 31 10:18:56 2023 -0700 Merge tag 'acpi-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix a recent regression related to the handling of ACPI notifications that made it more likely for ACPI driver callbacks to be invoked in an unexpected order and NULL pointers can be dereferenced as a result or similar. The fix is to modify the global ACPI notification handler so it does not invoke driver callbacks at all and allow the device-level notification handlers to receive "system" notifications (for the drivers that want to receive them)" * tag 'acpi-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: bus: Rework system-level device notification handling commit 39f692125c388aa657e77e5ae07ea72be02d99a5 Merge: 52f1959502dec 4622f159098e0 Author: Linus Torvalds Date: Fri Mar 31 10:15:17 2023 -0700 Merge tag 'riscv-for-linus-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix for FPU probing in XIP kernels - Always enable the alternative framework for non-XIP kernels * tag 'riscv-for-linus-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: always select RISCV_ALTERNATIVE for non-xip kernels RISC-V: add non-alternative fallback for riscv_has_extension_[un]likely() commit 52f1959502dec5069dcd247ce0462cdc608494b1 Merge: 62bad54b26db8 ab327f8acdf8d Author: Linus Torvalds Date: Fri Mar 31 10:12:07 2023 -0700 Merge tag 'mips-fixes_6.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fix from Thomas Bogendoerfer: "Fix to avoid crash on BCM6358 platforms" * tag 'mips-fixes_6.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: bmips: BCM6358: disable RAC flush for TP1 commit 52882b9c7a761b2b4e44717d6fbd1ed94c601b7f Author: Alexey Kardashevskiy Date: Wed May 4 17:48:07 2022 +1000 KVM: PPC: Make KVM_CAP_IRQFD_RESAMPLE platform dependent When introduced, IRQFD resampling worked on POWER8 with XICS. However KVM on POWER9 has never implemented it - the compatibility mode code ("XICS-on-XIVE") misses the kvm_notify_acked_irq() call and the native XIVE mode does not handle INTx in KVM at all. This moved the capability support advertising to platforms and stops advertising it on XIVE, i.e. POWER9 and later. Signed-off-by: Alexey Kardashevskiy Acked-by: Anup Patel Acked-by: Nicholas Piggin Message-Id: <20220504074807.3616813-1-aik@ozlabs.ru> Signed-off-by: Paolo Bonzini commit f1594bc676579133a3cd906d7d27733289edfb86 Author: Anh Tuan Phan Date: Fri Mar 24 09:14:15 2023 +0700 selftests mount: Fix mount_setattr_test builds failed When compiling selftests with target mount_setattr I encountered some errors with the below messages: mount_setattr_test.c: In function ‘mount_setattr_thread’: mount_setattr_test.c:343:16: error: variable ‘attr’ has initializer but incomplete type 343 | struct mount_attr attr = { | ^~~~~~~~~~ These errors might be because of linux/mount.h is not included. This patch resolves that issue. Signed-off-by: Anh Tuan Phan Acked-by: Christian Brauner Signed-off-by: Shuah Khan commit 85b475a4502d45380c1b9223c01954daa228eeb0 Merge: 80962ec912db5 21f27df854008 Author: Paolo Bonzini Date: Fri Mar 31 11:15:09 2023 -0400 Merge tag 'kvm-s390-master-6.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD A small fix that repairs the external loop detection code for PV guests. commit eb85df0a5643612285f61f38122564498d0c49f7 Author: Lorenzo Bianconi Date: Tue Mar 28 12:01:17 2023 +0200 wifi: mt76: mt7921: fix fw used for offload check for mt7922 Fix the firmware version used for offload capability check used by 0x0616 devices. This path enables offload capabilities for 0x0616 devices. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217245 Fixes: 034ae28b56f1 ("wifi: mt76: mt7921: introduce remain_on_channel support") Cc: stable@vger.kernel.org Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/632d8f0c9781c9902d7160e2c080aa7e9232d50d.1679997487.git.lorenzo@kernel.org commit 2ceb76f734e37833824b7fab6af17c999eb48d2b Author: Ben Greear Date: Wed Mar 22 17:37:17 2023 +0100 wifi: mt76: mt7921: Fix use-after-free in fw features query. Stop referencing 'features' memory after release_firmware is called. Fixes this crash: RIP: 0010:mt7921_check_offload_capability+0x17d mt7921_pci_probe+0xca/0x4b0 ... Signed-off-by: Ben Greear Signed-off-by: Lorenzo Bianconi Acked-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/51fd8f76494348aa9ecbf0abc471ebe47a983dfd.1679502607.git.lorenzo@kernel.org commit e4efa515d58f1363d8a27e548f9c5769d3121e03 Author: Hans de Goede Date: Mon Mar 20 13:22:52 2023 +0100 wifi: brcmfmac: Fix SDIO suspend/resume regression After commit 92cadedd9d5f ("brcmfmac: Avoid keeping power to SDIO card unless WOWL is used"), the wifi adapter by default is turned off on suspend and then re-probed on resume. In at least 2 model x86/acpi tablets with brcmfmac43430a1 wifi adapters, the newly added re-probe on resume fails like this: brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout ieee80211 phy1: brcmf_bus_started: failed: -110 ieee80211 phy1: brcmf_attach: dongle is not responding: err=-110 brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed It seems this specific brcmfmac model does not like being reprobed without it actually being turned off first. And the adapter is not being turned off during suspend because of commit f0992ace680c ("brcmfmac: prohibit ACPI power management for brcmfmac driver"). Now that the driver is being reprobed on resume, the disabling of ACPI pm is no longer necessary, except when WOWL is used (in which case there is no-reprobe). Move the dis-/en-abling of ACPI pm to brcmf_sdio_wowl_config(), this fixes the brcmfmac43430a1 suspend/resume regression and should help save some power when suspended. This change means that the code now also may re-enable ACPI pm when WOWL gets disabled. ACPI pm should only be re-enabled if it was enabled by the ACPI core originally. Add a brcmf_sdiod_acpi_save_power_manageable() to save the original state for this. This has been tested on the following devices: Asus T100TA brcmfmac43241b4-sdio Acer Iconia One 7 B1-750 brcmfmac43340-sdio Chuwi Hi8 brcmfmac43430a0-sdio Chuwi Hi8 brcmfmac43430a1-sdio (the Asus T100TA is the device for which the prohibiting of ACPI pm was originally added) Fixes: 92cadedd9d5f ("brcmfmac: Avoid keeping power to SDIO card unless WOWL is used") Cc: Ulf Hansson Signed-off-by: Hans de Goede Reviewed-by: Ulf Hansson Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230320122252.240070-1-hdegoede@redhat.com commit 9fdc1605c504204e0fdec7892b29c916579e06f3 Author: Andy Chi Date: Fri Mar 31 16:32:41 2023 +0800 ALSA: hda/realtek: fix mute/micmute LEDs for a HP ProBook There is a HP ProBook which using ALC236 codec and need the ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk to make mute LED and micmute LED work. Signed-off-by: Andy Chi Cc: Link: https://lore.kernel.org/r/20230331083242.58416-1-andy.chi@canonical.com Signed-off-by: Takashi Iwai commit d9503be5a100c553731c0e8a82c7b4201e8a970c Author: Martin Povišer Date: Fri Feb 24 16:22:21 2023 +0100 dmaengine: apple-admac: Fix 'current_tx' not getting freed In terminate_all we should queue up all submitted descriptors to be freed. We do that for the content of the 'issued' and 'submitted' lists, but the 'current_tx' descriptor falls through the cracks as it's removed from the 'issued' list once it gets assigned to be the current descriptor. Explicitly queue up freeing of the 'current_tx' descriptor to address a memory leak that is otherwise present. Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20230224152222.26732-2-povik+lin@cutebit.org Signed-off-by: Vinod Koul commit 6e96adcaa7a29827ac8ee8df290a44957a4823ec Author: Martin Povišer Date: Fri Feb 24 16:22:22 2023 +0100 dmaengine: apple-admac: Set src_addr_widths capability Add missing setting of 'src_addr_widths', which is the same as for the other direction. Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20230224152222.26732-3-povik+lin@cutebit.org Signed-off-by: Vinod Koul commit a288fd158fbf85c06a9ac01cecabf97ac5d962e7 Author: Martin Povišer Date: Fri Feb 24 16:22:20 2023 +0100 dmaengine: apple-admac: Handle 'global' interrupt flags In addition to TX channel and RX channel interrupt flags there's another class of 'global' interrupt flags with unknown semantics. Those weren't being handled up to now, and they are the suspected cause of stuck IRQ states that have been sporadically occurring. Check the global flags and clear them if raised. Fixes: b127315d9a78 ("dmaengine: apple-admac: Add Apple ADMAC driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20230224152222.26732-1-povik+lin@cutebit.org Signed-off-by: Vinod Koul commit cb2239c198ad9fbd5aced22cf93e45562da781eb Author: Christian Brauner Date: Thu Mar 30 09:13:16 2023 +0200 fs: drop peer group ids under namespace lock When cleaning up peer group ids in the failure path we need to make sure to hold on to the namespace lock. Otherwise another thread might just turn the mount from a shared into a non-shared mount concurrently. Link: https://lore.kernel.org/lkml/00000000000088694505f8132d77@google.com Fixes: 2a1867219c7b ("fs: add mount_setattr()") Reported-by: syzbot+8ac3859139c685c4f597@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # 5.12+ Message-Id: <20230330-vfs-mount_setattr-propagation-fix-v1-1-37548d91533b@kernel.org> Signed-off-by: Christian Brauner commit 896c5150edfd5c01ed7abfcf02612f4aac6296b3 Merge: b57841fb0b564 ae817e618d4b5 Author: Rafael J. Wysocki Date: Fri Mar 31 12:02:46 2023 +0200 Merge branch 'thermal-intel-fixes' Merge Intel thermal driver fixes for 6.3-rc5: - Fix handling of two recently added module parameters in the Intel powerclamp thermal driver (David Arcari). - Fix one more deadlock in the int340x thermal driver (Srinivas Pandruvada). * thermal-intel-fixes: thermal: intel: powerclamp: Fix cpumask and max_idle module parameters thermal: intel: int340x: processor_thermal: Fix additional deadlock commit ffa5395a7901e83a68d88207c4592962906641bd Author: Arseniy Krasnov Date: Fri Mar 31 10:56:41 2023 +0300 vsock/vmci: convert VMCI error code to -ENOMEM on send This adds conversion of VMCI specific error code to general -ENOMEM. It is needed, because af_vsock.c passes error value returned from transport to the user, which does not expect to get VMCI_ERROR_* values. Fixes: c43170b7e157 ("vsock: return errors other than -ENOMEM to socket") Signed-off-by: Arseniy Krasnov Reviewed-by: Vishnu Dasa Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller commit 362f0b6678ad1377c322a7dd237ea6785efc7342 Author: Jiri Slaby (SUSE) Date: Fri Mar 31 08:35:15 2023 +0200 net: wwan: t7xx: do not compile with -Werror When playing with various compilers or their versions, some choke on the t7xx code. For example (with gcc 13): In file included from ./arch/s390/include/generated/asm/rwonce.h:1, from ../include/linux/compiler.h:247, from ../include/linux/build_bug.h:5, from ../include/linux/bits.h:22, from ../drivers/net/wwan/t7xx/t7xx_state_monitor.c:17: In function 'preempt_count', inlined from 't7xx_fsm_append_event' at ../drivers/net/wwan/t7xx/t7xx_state_monitor.c:439:43: ../include/asm-generic/rwonce.h:44:26: error: array subscript 0 is outside array bounds of 'const volatile int[0]' [-Werror=array-bounds=] There is no reason for any code in the kernel to be built with -Werror by default. Note that we have generic CONFIG_WERROR. So if anyone wants -Werror, they can enable that. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/all/20230330232717.1f8bf5ea@kernel.org/ Cc: Chandrashekar Devegowda Cc: Intel Corporation Cc: Chiranjeevi Rapolu Cc: Liu Haijun Cc: M Chetan Kumar Cc: Ricardo Martinez Cc: Loic Poulain Cc: Sergey Ryazanov Cc: Johannes Berg Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit c5b959eeb7f9e40673b97c08c71cbfff5f5923f2 Author: Arnd Bergmann Date: Fri Mar 31 09:48:56 2023 +0200 net: netcp: MAX_SKB_FRAGS is now 'int' The type of MAX_SKB_FRAGS has changed recently, so the debug printk needs to be updated: drivers/net/ethernet/ti/netcp_core.c: In function 'netcp_create_interface': drivers/net/ethernet/ti/netcp_core.c:2084:30: error: format '%ld' expects argument of type 'long int', but argument 3 has type 'int' [-Werror=format=] 2084 | dev_err(dev, "tx-pool size too small, must be at least %ld\n", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 3948b05950fd ("net: introduce a config option to tweak MAX_SKB_FRAGS") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller commit 154e07c164859fc90bf4e8143f2f6c1af9f3a35e Author: Andrea Righi Date: Thu Mar 30 11:54:42 2023 +0200 l2tp: generate correct module alias strings Commit 65b32f801bfb ("uapi: move IPPROTO_L2TP to in.h") moved the definition of IPPROTO_L2TP from a define to an enum, but since __stringify doesn't work properly with enums, we ended up breaking the modalias strings for the l2tp modules: $ modinfo l2tp_ip l2tp_ip6 | grep alias alias: net-pf-2-proto-IPPROTO_L2TP alias: net-pf-2-proto-2-type-IPPROTO_L2TP alias: net-pf-10-proto-IPPROTO_L2TP alias: net-pf-10-proto-2-type-IPPROTO_L2TP Use the resolved number directly in MODULE_ALIAS_*() macros (as we already do with SOCK_DGRAM) to fix the alias strings: $ modinfo l2tp_ip l2tp_ip6 | grep alias alias: net-pf-2-proto-115 alias: net-pf-2-proto-115-type-2 alias: net-pf-10-proto-115 alias: net-pf-10-proto-115-type-2 Moreover, fix the ordering of the parameters passed to MODULE_ALIAS_NET_PF_PROTO_TYPE() by switching proto and type. Fixes: 65b32f801bfb ("uapi: move IPPROTO_L2TP to in.h") Link: https://lore.kernel.org/lkml/ZCQt7hmodtUaBlCP@righiandr-XPS-13-7390 Signed-off-by: Guillaume Nault Signed-off-by: Andrea Righi Reviewed-by: Wojciech Drewek Tested-by: Wojciech Drewek Signed-off-by: David S. Miller commit 279d8ff5ec00b06a5dc9b90f3d00a5a5253aa95d Merge: 44d807320000d 6fc21a6ed5953 Author: David S. Miller Date: Fri Mar 31 09:23:41 2023 +0100 Merge branch 'phy-handle-fixes' Michael Sit Wei Hong says: ==================== Fix PHY handle no longer parsing After the fixed link support was introduced, it is observed that PHY no longer attach to the MAC properly. So we introduce a helper function to determine if the MAC should expect to connect to a PHY and proceed accordingly. ==================== Signed-off-by: David S. Miller commit 6fc21a6ed5953b1dd3a41ce7be1ea57f5ef8c081 Author: Michael Sit Wei Hong Date: Thu Mar 30 17:14:04 2023 +0800 net: stmmac: remove redundant fixup to support fixed-link mode Currently, intel_speed_mode_2500() will fix-up xpcs_an_inband to 1 if the underlying controller has a max speed of 1000Mbps. The value has been initialized and modified if it is a fixed-linked setup earlier. This patch removes the fix-up to allow for fixed-linked setup support. In stmmac_phy_setup(), ovr_an_inband is set based on the value of xpcs_an_inband. Which in turn will return an error in phylink_parse_mode() where MLO_AN_FIXED and ovr_an_inband are both set. Fixes: c82386310d95 ("stmmac: intel: prepare to support 1000BASE-X phy interface setting") Signed-off-by: Michael Sit Wei Hong Signed-off-by: David S. Miller commit fe2cfbc9680356a3d9f8adde8a38e715831e32f5 Author: Michael Sit Wei Hong Date: Thu Mar 30 17:14:03 2023 +0800 net: stmmac: check if MAC needs to attach to a PHY After the introduction of the fixed-link support, the MAC driver no longer attempt to scan for a PHY to attach to. This causes the non fixed-link setups to stop working. Using the phylink_expects_phy() to check and determine if the MAC should expect and attach a PHY. Fixes: ab21cf920928 ("net: stmmac: make mdio register skips PHY scanning for fixed-link") Signed-off-by: Michael Sit Wei Hong Signed-off-by: Lai Peter Jun Ann Signed-off-by: David S. Miller commit 653a180957a85c3fc30320cc7e84f5dc913a64f8 Author: Michael Sit Wei Hong Date: Thu Mar 30 17:14:02 2023 +0800 net: phylink: add phylink_expects_phy() method Provide phylink_expects_phy() to allow MAC drivers to check if it is expecting a PHY to attach to. Since fixed-linked setups do not need to attach to a PHY. Provides a boolean value as to if the MAC should expect a PHY. Returns true if a PHY is expected. Reviewed-by: Russell King (Oracle) Signed-off-by: Michael Sit Wei Hong Signed-off-by: David S. Miller commit 44d807320000db0d0013372ad39b53e12d52f758 Author: Ziyang Xuan Date: Thu Mar 30 09:25:32 2023 +0800 net: qrtr: Fix a refcount bug in qrtr_recvmsg() Syzbot reported a bug as following: refcount_t: addition on 0; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 ... Call Trace: __refcount_add include/linux/refcount.h:199 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] kref_get include/linux/kref.h:45 [inline] qrtr_node_acquire net/qrtr/af_qrtr.c:202 [inline] qrtr_node_lookup net/qrtr/af_qrtr.c:398 [inline] qrtr_send_resume_tx net/qrtr/af_qrtr.c:1003 [inline] qrtr_recvmsg+0x85f/0x990 net/qrtr/af_qrtr.c:1070 sock_recvmsg_nosec net/socket.c:1017 [inline] sock_recvmsg+0xe2/0x160 net/socket.c:1038 qrtr_ns_worker+0x170/0x1700 net/qrtr/ns.c:688 process_one_work+0x991/0x15c0 kernel/workqueue.c:2390 worker_thread+0x669/0x1090 kernel/workqueue.c:2537 It occurs in the concurrent scenario of qrtr_recvmsg() and qrtr_endpoint_unregister() as following: cpu0 cpu1 qrtr_recvmsg qrtr_endpoint_unregister qrtr_send_resume_tx qrtr_node_release qrtr_node_lookup mutex_lock(&qrtr_node_lock) spin_lock_irqsave(&qrtr_nodes_lock, ) refcount_dec_and_test(&node->ref) [node->ref == 0] radix_tree_lookup [node != NULL] __qrtr_node_release qrtr_node_acquire spin_lock_irqsave(&qrtr_nodes_lock, ) kref_get(&node->ref) [WARNING] ... mutex_unlock(&qrtr_node_lock) Use qrtr_node_lock to protect qrtr_node_lookup() implementation, this is actually improving the protection of node reference. Fixes: 0a7e0d0ef054 ("net: qrtr: Migrate node lookup tree to spinlock") Reported-by: syzbot+a7492efaa5d61b51db23@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a7492efaa5d61b51db23 Signed-off-by: Ziyang Xuan Signed-off-by: David S. Miller commit 16812c96550c30a8d5743167ef4e462d6fbe7472 Author: Kan Liang Date: Wed Mar 29 21:47:21 2023 +0800 iommu/vt-d: Fix an IOMMU perfmon warning when CPU hotplug A warning can be triggered when hotplug CPU 0. $ echo 0 > /sys/devices/system/cpu/cpu0/online ------------[ cut here ]------------ Voluntary context switch within RCU read-side critical section! WARNING: CPU: 0 PID: 19 at kernel/rcu/tree_plugin.h:318 rcu_note_context_switch+0x4f4/0x580 RIP: 0010:rcu_note_context_switch+0x4f4/0x580 Call Trace: ? perf_event_update_userpage+0x104/0x150 __schedule+0x8d/0x960 ? perf_event_set_state.part.82+0x11/0x50 schedule+0x44/0xb0 schedule_timeout+0x226/0x310 ? __perf_event_disable+0x64/0x1a0 ? _raw_spin_unlock+0x14/0x30 wait_for_completion+0x94/0x130 __wait_rcu_gp+0x108/0x130 synchronize_rcu+0x67/0x70 ? invoke_rcu_core+0xb0/0xb0 ? __bpf_trace_rcu_stall_warning+0x10/0x10 perf_pmu_migrate_context+0x121/0x370 iommu_pmu_cpu_offline+0x6a/0xa0 ? iommu_pmu_del+0x1e0/0x1e0 cpuhp_invoke_callback+0x129/0x510 cpuhp_thread_fun+0x94/0x150 smpboot_thread_fn+0x183/0x220 ? sort_range+0x20/0x20 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 ---[ end trace 0000000000000000 ]--- The synchronize_rcu() will be invoked in the perf_pmu_migrate_context(), when migrating a PMU to a new CPU. However, the current for_each_iommu() is within RCU read-side critical section. Two methods were considered to fix the issue. - Use the dmar_global_lock to replace the RCU read lock when going through the drhd list. But it triggers a lockdep warning. - Use the cpuhp_setup_state_multi() to set up a dedicated state for each IOMMU PMU. The lock can be avoided. The latter method is implemented in this patch. Since each IOMMU PMU has a dedicated state, add cpuhp_node and cpu in struct iommu_pmu to track the state. The state can be dynamically allocated now. Remove the CPUHP_AP_PERF_X86_IOMMU_PERF_ONLINE. Fixes: 46284c6ceb5e ("iommu/vt-d: Support cpumask for IOMMU perfmon") Reported-by: Ammy Yi Signed-off-by: Kan Liang Link: https://lore.kernel.org/r/20230328182028.1366416-1-kan.liang@linux.intel.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20230329134721.469447-4-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit bfd3c6b9fa4a1dc78139dd1621d5bea321ffa69d Author: Lu Baolu Date: Wed Mar 29 21:47:20 2023 +0800 iommu/vt-d: Allow zero SAGAW if second-stage not supported The VT-d spec states (in section 11.4.2) that hardware implementations reporting second-stage translation support (SSTS) field as Clear also report the SAGAW field as 0. Fix an inappropriate check in alloc_iommu(). Fixes: 792fb43ce2c9 ("iommu/vt-d: Enable Intel IOMMU scalable mode by default") Suggested-by: Raghunathan Srinivasan Reviewed-by: Kevin Tian Signed-off-by: Jacob Pan Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20230318024824.124542-1-baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/20230329134721.469447-3-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit c7d624520c1bd4e42d8ceb8283d6505fc90acccb Author: Lu Baolu Date: Wed Mar 29 21:47:19 2023 +0800 iommu/vt-d: Remove unnecessary locking in intel_irq_remapping_alloc() The global rwsem dmar_global_lock was introduced by commit 3a5670e8ac932 ("iommu/vt-d: Introduce a rwsem to protect global data structures"). It is used to protect DMAR related global data from DMAR hotplug operations. Using dmar_global_lock in intel_irq_remapping_alloc() is unnecessary as the DMAR global data structures are not touched there. Remove it to avoid below lockdep warning. ====================================================== WARNING: possible circular locking dependency detected 6.3.0-rc2 #468 Not tainted ------------------------------------------------------ swapper/0/1 is trying to acquire lock: ff1db4cb40178698 (&domain->mutex){+.+.}-{3:3}, at: __irq_domain_alloc_irqs+0x3b/0xa0 but task is already holding lock: ffffffffa0c1cdf0 (dmar_global_lock){++++}-{3:3}, at: intel_iommu_init+0x58e/0x880 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (dmar_global_lock){++++}-{3:3}: lock_acquire+0xd6/0x320 down_read+0x42/0x180 intel_irq_remapping_alloc+0xad/0x750 mp_irqdomain_alloc+0xb8/0x2b0 irq_domain_alloc_irqs_locked+0x12f/0x2d0 __irq_domain_alloc_irqs+0x56/0xa0 alloc_isa_irq_from_domain.isra.7+0xa0/0xe0 mp_map_pin_to_irq+0x1dc/0x330 setup_IO_APIC+0x128/0x210 apic_intr_mode_init+0x67/0x110 x86_late_time_init+0x24/0x40 start_kernel+0x41e/0x7e0 secondary_startup_64_no_verify+0xe0/0xeb -> #0 (&domain->mutex){+.+.}-{3:3}: check_prevs_add+0x160/0xef0 __lock_acquire+0x147d/0x1950 lock_acquire+0xd6/0x320 __mutex_lock+0x9c/0xfc0 __irq_domain_alloc_irqs+0x3b/0xa0 dmar_alloc_hwirq+0x9e/0x120 iommu_pmu_register+0x11d/0x200 intel_iommu_init+0x5de/0x880 pci_iommu_init+0x12/0x40 do_one_initcall+0x65/0x350 kernel_init_freeable+0x3ca/0x610 kernel_init+0x1a/0x140 ret_from_fork+0x29/0x50 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(dmar_global_lock); lock(&domain->mutex); lock(dmar_global_lock); lock(&domain->mutex); *** DEADLOCK *** Fixes: 9dbb8e3452ab ("irqdomain: Switch to per-domain locking") Reviewed-by: Jacob Pan Tested-by: Jason Gunthorpe Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20230314051836.23817-1-baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/20230329134721.469447-2-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit f9d2b1e146e0f82f3d04629afd92698522058361 Author: Bobby Eshleman Date: Wed Mar 29 16:51:58 2023 +0000 virtio/vsock: fix leaks due to missing skb owner This patch sets the skb owner in the recv and send path for virtio. For the send path, this solves the leak caused when virtio_transport_purge_skbs() finds skb->sk is always NULL and therefore never matches it with the current socket. Setting the owner upon allocation fixes this. For the recv path, this ensures correctness of accounting and also correct transfer of ownership in vsock_loopback (when skbs are sent from one socket and received by another). Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Signed-off-by: Bobby Eshleman Reported-by: Cong Wang Link: https://lore.kernel.org/all/ZCCbATwov4U+GBUv@pop-os.localdomain/ Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller commit 5d1a70f77dcf7b93f955d40691ac729fc7b3d151 Merge: f6caea4855553 7708a3858e69d Author: Greg Kroah-Hartman Date: Fri Mar 31 09:28:03 2023 +0200 Merge tag 'usb-serial-6.3-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 6.3-rc5 Here are some new device ids for 6.3. All have been in linux-next with no reported issues. * tag 'usb-serial-6.3-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Quectel RM500U-CN modem USB: serial: option: add Telit FE990 compositions USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs commit 6b36d68cc9bb1fc85bbe54ebe2eb6b2c3beec73d Merge: b2bc47e9b2011 12b220a6171fa Author: Jakub Kicinski Date: Thu Mar 30 23:44:45 2023 -0700 Merge tag 'wireless-2023-03-30' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just a few fixes: * fix size calculation for EHT element to put into SKBs * remove erroneous pre-RCU calls for drivers not using sta_state calls * fix mesh forwarding and non-forwarding RX * fix mesh flow dissection * fix a potential NULL dereference on A-MSDU RX w/o station * make two variable non-static that really shouldn't be static * tag 'wireless-2023-03-30' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta wifi: mac80211: fix flow dissection for forwarded packets wifi: mac80211: fix mesh forwarding wifi: mac80211: fix receiving mesh packets in forwarding=0 networks wifi: mac80211: fix the size calculation of ieee80211_ie_len_eht_cap() wifi: mac80211: fix potential null pointer dereference wifi: mac80211: drop bogus static keywords in A-MSDU rx ==================== Link: https://lore.kernel.org/r/20230330203313.919164-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 24ab70d83784a807c9ddff939ea762ef19bd4ffd Merge: 1a06ed2d4289e 433279beba1d4 Author: Jens Axboe Date: Thu Mar 30 20:29:47 2023 -0600 Merge tag 'md-fixes-2023-03-29' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.3 Pull MD fix from Song. * tag 'md-fixes-2023-03-29' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: fix regression for null-ptr-deference in __md_stop() commit 3adf89324a2b2a9dbc2c12d8895021e7e34e3346 Author: Javier Martinez Canillas Date: Fri Mar 31 01:19:23 2023 +0200 arm64: dts: rockchip: Remove non-existing pwm-delay-us property There is neither a driver that parses this nor a DT binding schema that documents it, so let's remove from the DTS files that make use of this. The properties that exist are post-pwm-on-delay-ms and pwm-off-delay-ms, defined in the pwm-backlight DT binding. If the delays are really needed then those properties should be used instead. Brian Norris mentioned though that looking at the first downstream usage of the pwm-delay-us property for RK3399 Gru systems in ChromiumOS tree, he couldn't find a spec reference that said that this was really needed. So perhaps it was unnecessary added and a simple removal would be enough. Signed-off-by: Javier Martinez Canillas Reviewed-by: Brian Norris Link: https://lore.kernel.org/r/20230330231924.2404747-1-javierm@redhat.com Signed-off-by: Heiko Stuebner commit 62bad54b26db8bc98e28749cd76b2d890edb4258 Merge: 10f76dc3abb4d 0eee5ae102569 Author: Linus Torvalds Date: Thu Mar 30 16:09:37 2023 -0700 Merge tag 'dma-mapping-6.3-2023-03-31' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - fix for swiotlb deadlock due to wrong alignment checks (GuoRui.Yu, Petr Tesarik) * tag 'dma-mapping-6.3-2023-03-31' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: fix slot alignment checks swiotlb: use wrap_area_index() instead of open-coding it swiotlb: fix the deadlock in swiotlb_do_find_slots commit e03677100707f849f01d8faf07ee58b4e56cdbf1 Author: Paulo Alcantara Date: Wed Mar 29 17:14:23 2023 -0300 cifs: get rid of dead check in smb2_reconnect() The SMB2_IOCTL check in the switch statement will never be true as we return earlier from smb2_reconnect() if @smb2_command == SMB2_IOCTL. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 09ba47b44d26b475bbdf9c80db9e0193d2b58956 Author: Paulo Alcantara Date: Wed Mar 29 17:14:22 2023 -0300 cifs: prevent infinite recursion in CIFSGetDFSRefer() We can't call smb_init() in CIFSGetDFSRefer() as cifs_reconnect_tcon() may end up calling CIFSGetDFSRefer() again to get new DFS referrals and thus causing an infinite recursion. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Steve French commit 6cc041e90c178955219dcee4030bd5423f800f10 Author: Paulo Alcantara Date: Wed Mar 29 17:14:21 2023 -0300 cifs: avoid races in parallel reconnects in smb1 Prevent multiple threads of doing negotiate, session setup and tree connect by holding @ses->session_mutex in cifs_reconnect_tcon() while reconnecting session and tcon. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 10f76dc3abb4d8fbc2cee7a63fda22e8b08628b2 Merge: b2bc47e9b2011 d684a7a26f7d2 Author: Linus Torvalds Date: Thu Mar 30 15:52:45 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes, three in drivers. The core fix is yet another attempt to insulate us from UFS devices' weird behaviour for VPD pages" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: mpt3sas: Don't print sense pool info twice scsi: core: Improve scsi_vpd_inquiry() checks scsi: megaraid_sas: Fix crash after a double completion scsi: megaraid_sas: Fix fw_crash_buffer_show() commit 1a06ed2d4289e392c38feb9dc0ef223b1c4efb34 Merge: bb430b6942264 88eaba80328b3 Author: Jens Axboe Date: Thu Mar 30 16:39:04 2023 -0600 Merge tag 'nvme-6.3-2023-03-31' of git://git.infradead.org/nvme into block-6.3 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.3 - mark Lexar NM760 as IGNORE_DEV_SUBNQN (Juraj Pecigos) - fix a possible UAF when failing to allocate an TCP io queue (Sagi Grimberg)" * tag 'nvme-6.3-2023-03-31' of git://git.infradead.org/nvme: nvme-tcp: fix a possible UAF when failing to allocate an io queue nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN commit 179a88a8558bbf42991d361595281f3e45d7edfc Author: David Disseldorp Date: Wed Mar 29 22:24:06 2023 +0200 cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to S_AUTOMOUNT and corresponding dentry flags is retained regardless of CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in VFS follow_automount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: __traverse_mounts+0xb5/0x220 ? cifs_revalidate_mapping+0x65/0xc0 [cifs] step_into+0x195/0x610 ? lookup_fast+0xe2/0xf0 path_lookupat+0x64/0x140 filename_lookup+0xc2/0x140 ? __create_object+0x299/0x380 ? kmem_cache_alloc+0x119/0x220 ? user_path_at_empty+0x31/0x50 user_path_at_empty+0x31/0x50 __x64_sys_chdir+0x2a/0xd0 ? exit_to_user_mode_prepare+0xca/0x100 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This approach was chosen as it provides more control over the error path. Signed-off-by: David Disseldorp Cc: stable@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit b2bc47e9b2011a183f9d3d3454a294a938082fb9 Merge: b527ac44eb178 924531326e2dd Author: Linus Torvalds Date: Thu Mar 30 14:05:21 2023 -0700 Merge tag 'net-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from CAN and WPAN. Still quite a few bugs from this release. This pull is a bit smaller because major subtrees went into the previous one. Or maybe people took spring break off? Current release - regressions: - phy: micrel: correct KSZ9131RNX EEE capabilities and advertisement Current release - new code bugs: - eth: wangxun: fix vector length of interrupt cause - vsock/loopback: consistently protect the packet queue with sk_buff_head.lock - virtio/vsock: fix header length on skb merging - wpan: ca8210: fix unsigned mac_len comparison with zero Previous releases - regressions: - eth: stmmac: don't reject VLANs when IFF_PROMISC is set - eth: smsc911x: avoid PHY being resumed when interface is not up - eth: mtk_eth_soc: fix tx throughput regression with direct 1G links - eth: bnx2x: use the right build_skb() helper after core rework - wwan: iosm: fix 7560 modem crash on use on unsupported channel Previous releases - always broken: - eth: sfc: don't overwrite offload features at NIC reset - eth: r8169: fix RTL8168H and RTL8107E rx crc error - can: j1939: prevent deadlock by moving j1939_sk_errqueue() - virt: vmxnet3: use GRO callback when UPT is enabled - virt: xen: don't do grant copy across page boundary - phy: dp83869: fix default value for tx-/rx-internal-delay - dsa: ksz8: fix multiple issues with ksz8_fdb_dump - eth: mvpp2: fix classification/RSS of VLAN and fragmented packets - eth: mtk_eth_soc: fix flow block refcounting logic Misc: - constify fwnode pointers in SFP handling" * tag 'net-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits) net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting a flow net: ethernet: mtk_eth_soc: fix L2 offloading with DSA untag offload net: ethernet: mtk_eth_soc: fix flow block refcounting logic net: mvneta: fix potential double-frees in mvneta_txq_sw_deinit() net: dsa: sync unicast and multicast addresses for VLAN filters too net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only xen/netback: use same error messages for same errors test/vsock: new skbuff appending test virtio/vsock: WARN_ONCE() for invalid state of socket virtio/vsock: fix header length on skb merging bnxt_en: Add missing 200G link speed reporting bnxt_en: Fix typo in PCI id to device description string mapping bnxt_en: Fix reporting of test result in ethtool selftest i40e: fix registers dump after run ethtool adapter self test bnx2x: use the right build_skb() helper net: ipa: compute DMA pool size properly net: wwan: iosm: fixes 7560 modem crash net: ethernet: mtk_eth_soc: fix tx throughput regression with direct 1G links ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() ice: add profile conflict check for AVF FDIR ... commit b527ac44eb1782cf179d4e08ceda7d2a9643aff5 Merge: 0d3ff8087b2c1 666eed46769d9 Author: Linus Torvalds Date: Thu Mar 30 13:58:12 2023 -0700 Merge tag 'for-6.3/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix two DM core bugs in the code that handles splitting "abnormal" IO (discards, write same and secure erase) and issuing that IO to the correct underlying devices (and offsets within those devices). * tag 'for-6.3/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: fix __send_duplicate_bios() to always allow for splitting IO dm: fix improper splitting for abnormal bios commit 0d3ff8087b2c12ee012c547f3bde46a3f60d6f6f Merge: 8bb95a1662f8b 7af63e079a7d6 Author: Linus Torvalds Date: Thu Mar 30 13:38:27 2023 -0700 Merge tag 'drm-fixes-2023-03-30' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: "Two regression fixes in here, otherwise just the usual stuff: - i915 fixes for color mgmt, psr, lmem flush, hibernate oops, and more - amdgpu: dp mst and hibernate regression fix - etnaviv: revert fdinfo support (incl drm/sched revert), leak fix - misc ivpu fixes, nouveau backlight, drm buddy allocator 32bit fixes" * tag 'drm-fixes-2023-03-30' of git://anongit.freedesktop.org/drm/drm: (27 commits) Revert "drm/scheduler: track GPU active time per entity" Revert "drm/etnaviv: export client GPU usage statistics via fdinfo" drm/etnaviv: fix reference leak when mmaping imported buffer drm/amdgpu: allow more APUs to do mode2 reset when go to S4 drm/amd/display: Take FEC Overhead into Timeslot Calculation drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub drm: test: Fix 32-bit issue in drm_buddy_test drm: buddy_allocator: Fix buddy allocator init on 32-bit systems drm/nouveau/kms: Fix backlight registration drm/i915/perf: Drop wakeref on GuC RC error drm/i915/dpt: Treat the DPT BO as a framebuffer drm/i915/gem: Flush lmem contents after construction drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state drm/i915: Disable DC states for all commits drm/i915: Workaround ICL CSC_MODE sticky arming drm/i915: Add a .color_post_update() hook drm/i915: Move CSC load back into .color_commit_arm() when PSR is enabled on skl/glk drm/i915: Split icl_color_commit_noarm() from skl_color_commit_noarm() drm/i915/pmu: Use functions common with sysfs to read actual freq accel/ivpu: Fix IPC buffer header status field value ... commit 666eed46769d929c3e13636134ecfc67d75ef548 Author: Mike Snitzer Date: Thu Mar 30 15:09:29 2023 -0400 dm: fix __send_duplicate_bios() to always allow for splitting IO Commit 7dd76d1feec70 ("dm: improve bio splitting and associated IO accounting") only called setup_split_accounting() from __send_duplicate_bios() if a single bio were being issued. But the case where duplicate bios are issued must call it too. Otherwise the bio won't be split and resubmitted (via recursion through block core back to DM) to submit the later portions of a bio (which may map to an entirely different target). For example, when discarding an entire DM striped device with the following DM table: vg-lvol0: 0 159744 striped 2 128 7:0 2048 7:1 2048 vg-lvol0: 159744 45056 striped 2 128 7:2 2048 7:3 2048 Before (broken, discards the first striped target's devices twice): device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 device-mapper: striped: target_stripe=0, bdev=7:0, start=2049 len=22528 device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=22528 After (works as expected): device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 device-mapper: striped: target_stripe=0, bdev=7:2, start=2048 len=22528 device-mapper: striped: target_stripe=1, bdev=7:3, start=2048 len=22528 Fixes: 7dd76d1feec70 ("dm: improve bio splitting and associated IO accounting") Cc: stable@vger.kernel.org Reported-by: Orange Kao Signed-off-by: Mike Snitzer commit f7b58a69fad9d2c4c90cab0247811155dd0d48e7 Author: Mike Snitzer Date: Thu Mar 30 14:56:38 2023 -0400 dm: fix improper splitting for abnormal bios "Abnormal" bios include discards, write zeroes and secure erase. By no longer passing the calculated 'len' pointer, commit 7dd06a2548b2 ("dm: allow dm_accept_partial_bio() for dm_io without duplicate bios") took a senseless approach to disallowing dm_accept_partial_bio() from working for duplicate bios processed using __send_duplicate_bios(). It inadvertently and incorrectly stopped the use of 'len' when initializing a target's io (in alloc_tio). As such the resulting tio could address more area of a device than it should. For example, when discarding an entire DM striped device with the following DM table: vg-lvol0: 0 159744 striped 2 128 7:0 2048 7:1 2048 vg-lvol0: 159744 45056 striped 2 128 7:2 2048 7:3 2048 Before this fix: device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=102400 blkdiscard: attempt to access beyond end of device loop0: rw=2051, sector=2048, nr_sectors = 102400 limit=81920 device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=102400 blkdiscard: attempt to access beyond end of device loop1: rw=2051, sector=2048, nr_sectors = 102400 limit=81920 After this fix; device-mapper: striped: target_stripe=0, bdev=7:0, start=2048 len=79872 device-mapper: striped: target_stripe=1, bdev=7:1, start=2048 len=79872 Fixes: 7dd06a2548b2 ("dm: allow dm_accept_partial_bio() for dm_io without duplicate bios") Cc: stable@vger.kernel.org Reported-by: Orange Kao Signed-off-by: Mike Snitzer commit 924531326e2dd4ceabe7240f2b55a88e7d894ec2 Author: Felix Fietkau Date: Thu Mar 30 14:08:40 2023 +0200 net: ethernet: mtk_eth_soc: add missing ppe cache flush when deleting a flow The cache needs to be flushed to ensure that the hardware stops offloading the flow immediately. Fixes: 33fc42de3327 ("net: ethernet: mtk_eth_soc: support creating mac address based offload entries") Reviewed-by: Simon Horman Signed-off-by: Felix Fietkau Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230330120840.52079-3-nbd@nbd.name Signed-off-by: Jakub Kicinski commit 5f36ca1b841fb17a20249fd9fedafc7dc7fdd940 Author: Felix Fietkau Date: Thu Mar 30 14:08:39 2023 +0200 net: ethernet: mtk_eth_soc: fix L2 offloading with DSA untag offload Check for skb metadata in order to detect the case where the DSA header is not present. Fixes: 2d7605a72906 ("net: ethernet: mtk_eth_soc: enable hardware DSA untagging") Reviewed-by: Simon Horman Signed-off-by: Felix Fietkau Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230330120840.52079-2-nbd@nbd.name Signed-off-by: Jakub Kicinski commit 8c1cb87c2a5c29da416848451a687473f379611c Author: Felix Fietkau Date: Thu Mar 30 14:08:38 2023 +0200 net: ethernet: mtk_eth_soc: fix flow block refcounting logic Since we call flow_block_cb_decref on FLOW_BLOCK_UNBIND, we also need to call flow_block_cb_incref for a newly allocated cb. Also fix the accidentally inverted refcount check on unbind. Fixes: 502e84e2382d ("net: ethernet: mtk_eth_soc: add flow offloading support") Reviewed-by: Simon Horman Signed-off-by: Felix Fietkau Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230330120840.52079-1-nbd@nbd.name Signed-off-by: Jakub Kicinski commit 2960a2d33b02345c6d710251206053678f92246b Author: Russell King (Oracle) Date: Wed Mar 29 13:11:17 2023 +0100 net: mvneta: fix potential double-frees in mvneta_txq_sw_deinit() Reported on the Turris forum, mvneta provokes kernel warnings in the architecture DMA mapping code when mvneta_setup_txqs() fails to allocate memory. This happens because when mvneta_cleanup_txqs() is called in the mvneta_stop() path, we leave pointers in the structure that have been freed. Then on mvneta_open(), we call mvneta_setup_txqs(), which starts allocating memory. On memory allocation failure, mvneta_cleanup_txqs() will walk all the queues freeing any non-NULL pointers - which includes pointers that were previously freed in mvneta_stop(). Fix this by setting these pointers to NULL to prevent double-freeing of the same memory. Fixes: 2adb719d74f6 ("net: mvneta: Implement software TSO") Link: https://forum.turris.cz/t/random-kernel-exceptions-on-hbl-tos-7-0/18865/8 Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1phUe5-00EieL-7q@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 64fdc5f341db01200e33105265d4b8450122a82e Author: Vladimir Oltean Date: Wed Mar 29 18:18:21 2023 +0300 net: dsa: sync unicast and multicast addresses for VLAN filters too If certain conditions are met, DSA can install all necessary MAC addresses on the CPU ports as FDB entries and disable flooding towards the CPU (we call this RX filtering). There is one corner case where this does not work. ip link add br0 type bridge vlan_filtering 1 && ip link set br0 up ip link set swp0 master br0 && ip link set swp0 up ip link add link swp0 name swp0.100 type vlan id 100 ip link set swp0.100 up && ip addr add 192.168.100.1/24 dev swp0.100 Traffic through swp0.100 is broken, because the bridge turns on VLAN filtering in the swp0 port (causing RX packets to be classified to the FDB database corresponding to the VID from their 802.1Q header), and although the 8021q module does call dev_uc_add() towards the real device, that API is VLAN-unaware, so it only contains the MAC address, not the VID; and DSA's current implementation of ndo_set_rx_mode() is only for VID 0 (corresponding to FDB entries which are installed in an FDB database which is only hit when the port is VLAN-unaware). It's interesting to understand why the bridge does not turn on IFF_PROMISC for its swp0 bridge port, and it may appear at first glance that this is a regression caused by the logic in commit 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode."). After all, a bridge port needs to have IFF_PROMISC by its very nature - it needs to receive and forward frames with a MAC DA different from the bridge ports' MAC addresses. While that may be true, when the bridge is VLAN-aware *and* it has a single port, there is no real reason to enable promiscuity even if that is an automatic port, with flooding and learning (there is nowhere for packets to go except to the BR_FDB_LOCAL entries), and this is how the corner case appears. Adding a second automatic interface to the bridge would make swp0 promisc as well, and would mask the corner case. Given the dev_uc_add() / ndo_set_rx_mode() API is what it is (it doesn't pass a VLAN ID), the only way to address that problem is to install host FDB entries for the cartesian product of RX filtering MAC addresses and VLAN RX filters. Fixes: 7569459a52c9 ("net: dsa: manage flooding on the CPU ports") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230329151821.745752-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 Author: Steffen Bätz Date: Wed Mar 29 12:01:40 2023 -0300 net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports. This allows the host CPU port to be a regular IGMP listener by sending out IGMP Membership Reports, which would otherwise not be forwarded by the mv88exxx chip, but directly looped back to the CPU port itself. Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.") Signed-off-by: Steffen Bätz Signed-off-by: Fabio Estevam Reviewed-by: Andrew Lunn Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230329150140.701559-1-festevam@gmail.com Signed-off-by: Jakub Kicinski commit 7af63e079a7d6d45a3796a7ba625e2ec131f62be Merge: e8d6d6f0aaa9e baad10973fdb4 Author: Daniel Vetter Date: Thu Mar 30 20:15:06 2023 +0200 Merge branch 'etnaviv/fixes' of https://git.pengutronix.de/git/lst/linux into drm-fixes - revert gpu time fdinfo support - reference leak fix on imported buffers Signed-off-by: Daniel Vetter From: Lucas Stach Link: https://patchwork.freedesktop.org/patch/msgid/de8e08c2599ec0e22456ae36e9757b9ff14c2124.camel@pengutronix.de commit ae817e618d4b5d221daae34d32a39476e4bdcb36 Author: David Arcari Date: Thu Mar 30 09:42:18 2023 -0400 thermal: intel: powerclamp: Fix cpumask and max_idle module parameters When cpumask is specified as a module parameter the value is overwritten by the module init routine. This can easily be fixed by checking to see if the mask has already been allocated in the init routine. When max_idle is specified as a module parameter a panic will occur. The problem is that the idle_injection_cpu_mask is not allocated until the module init routine executes. This can easily be fixed by allocating the cpumask if it's not already allocated. Fixes: ebf519710218 ("thermal: intel: powerclamp: Add two module parameters") Signed-off-by: David Arcari Reviewed-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki commit e8d6d6f0aaa9e1640ad94fb3b11e26c0edec753f Merge: 69620d5c03055 2fec9dc8e0acc Author: Daniel Vetter Date: Thu Mar 30 19:59:06 2023 +0200 Merge tag 'amd-drm-fixes-6.3-2023-03-30' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.3-2023-03-30: amdgpu: - Hibernation regression fix Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230330153859.18332-1-alexander.deucher@amd.com commit 69620d5c030553e81562f6f6f490c1fdd7f798fd Merge: 493fd8b87a84a 25bbe844ef5c4 Author: Daniel Vetter Date: Thu Mar 30 18:56:52 2023 +0200 Merge tag 'drm-misc-fixes-2023-03-30' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * various ivpu fixes * fix nouveau backlight registration * fix buddy allocator in 32-bit systems Signed-off-by: Daniel Vetter From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230330141006.GA22908@linux-uq9g commit 493fd8b87a84a67bae1237edde7affaf61bcbdba Merge: ce7a3d2e70719 68dc1846c3a44 Author: Daniel Vetter Date: Thu Mar 30 18:26:05 2023 +0200 Merge tag 'amd-drm-fixes-6.3-2023-03-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.3-2023-03-29: amdgpu: - Two DP MST fixes Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230329220059.7622-1-alexander.deucher@amd.com commit ce7a3d2e707193eefebcb9d2fc47e62ee83dc3bf Merge: 197b6b60ae7bc 5c95b2d5d44fa Author: Daniel Vetter Date: Thu Mar 30 18:07:12 2023 +0200 Merge tag 'drm-intel-fixes-2023-03-30' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.3-rc5: - Fix PMU support by reusing functions with sysfs - Fix a number of issues related to color, PSR and arm/noarm - Fix state check related to ICL PHY ownership check in TC-cold state - Flush lmem contents after construction - Fix hibernate oops related to DPT BO - Fix perf stream error path wakeref balance Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87355m4gtm.fsf@intel.com commit 8bb95a1662f8b97c443984550a7aefbe5a1a064e Merge: 4ee772243af1a 52aad39385e1b Author: Linus Torvalds Date: Thu Mar 30 09:04:04 2023 -0700 Merge tag 'sound-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes: - A potential deadlock fix for USB-audio, involving some change in PCM core side - A regression fix for probes of USB-audio devices with the vendor-specific PCM format bits - Two regression fixes for the old YMFPCI driver - A few HD-audio quirks as usual" * tag 'sound-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z ALSA: ymfpci: Fix BUG_ON in probe function ALSA: ymfpci: Create card with device-managed snd_devm_card_new() ALSA: usb-audio: Fix regression on detection of Roland VS-100 ALSA: hda/realtek: Fix support for Dell Precision 3260 ALSA: usb-audio: Fix recursive locking at XRUN during syncing ALSA: hda/conexant: Partial revert of a quirk for Lenovo ALSA: hda/realtek: Add quirks for some Clevo laptops commit 4ee772243af1a6f5955413a64c5b36e8daed49bb Merge: ffe78bbd51216 77af13ba3c7f9 Author: Linus Torvalds Date: Thu Mar 30 09:00:17 2023 -0700 Merge tag 'zonefs-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fixes from Damien Le Moal: - Make sure to always invalidate the last page of an inode straddling inode->i_size to avoid data inconsistencies with appended data when the device zone write granularity does not match the page size. - Do not propagate iomap -ENOBLK error to userspace and use -EBUSY instead. * tag 'zonefs-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space zonefs: Always invalidate last cached page on append write commit baad10973fdb442912af676de3348e80bd8fe602 Author: Lucas Stach Date: Thu Mar 30 17:35:13 2023 +0200 Revert "drm/scheduler: track GPU active time per entity" This reverts commit df622729ddbf as it introduces a use-after-free, which isn't easy to fix without going back to the design drawing board. Reported-by: Danilo Krummrich Signed-off-by: Lucas Stach commit 2658d0d0355a3470a96d0e4268cbad174fadf0ed Author: Lucas Stach Date: Thu Mar 30 17:33:27 2023 +0200 Revert "drm/etnaviv: export client GPU usage statistics via fdinfo" This reverts commit 97804a133c68, as it builds on top of df622729ddbf ("drm/scheduler: track GPU active time per entity") which needs to be reverted, as it introduces a use-after-free. Signed-off-by: Lucas Stach commit 963b2e8c428f79489ceeb058e8314554ec9cbe6f Author: Lucas Stach Date: Fri Feb 24 18:21:54 2023 +0100 drm/etnaviv: fix reference leak when mmaping imported buffer drm_gem_prime_mmap() takes a reference on the GEM object, but before that drm_gem_mmap_obj() already takes a reference, which will be leaked as only one reference is dropped when the mapping is closed. Drop the extra reference when dma_buf_mmap() succeeds. Cc: stable@vger.kernel.org Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner commit 2fec9dc8e0acc3dfb56d1389151bcf405f087b10 Author: Tim Huang Date: Thu Mar 30 10:33:02 2023 +0800 drm/amdgpu: allow more APUs to do mode2 reset when go to S4 Skip mode2 reset only for IMU enabled APUs when do S4. This patch is to fix the regression issue https://gitlab.freedesktop.org/drm/amd/-/issues/2483 It is generated by commit b589626674de ("drm/amdgpu: skip ASIC reset for APUs when go to S4"). Fixes: b589626674de ("drm/amdgpu: skip ASIC reset for APUs when go to S4") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2483 Tested-by: Yuan Perry Signed-off-by: Tim Huang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit f6caea4855553a8b99ba3ec23ecdb5ed8262f26c Author: Mathias Nyman Date: Thu Mar 30 17:30:56 2023 +0300 xhci: Free the command allocated for setting LPM if we return early The command allocated to set exit latency LPM values need to be freed in case the command is never queued. This would be the case if there is no change in exit latency values, or device is missing. Reported-by: Mirsad Goran Todorovac Link: https://lore.kernel.org/linux-usb/24263902-c9b3-ce29-237b-1c3d6918f4fe@alu.unizg.hr Tested-by: Mirsad Goran Todorovac Fixes: 5c2a380a5aa8 ("xhci: Allocate separate command structures for each LPM command") Cc: Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230330143056.1390020-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8e77d3d59d7b5da13deda1d832c51b8bbdbe2037 Author: Mathias Nyman Date: Thu Mar 30 17:30:55 2023 +0300 Revert "usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS" This reverts commit 4c2604a9a6899bab195edbee35fc8d64ce1444aa. Asynch probe caused regression in a setup with both Renesas and Intel xHC controllers. Devices connected to the Renesas disconnected shortly after boot. With Asynch probe the busnumbers got interleaved. xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 1 xhci_hcd 0000:04:00.0: new USB bus registered, assigned bus number 2 xhci_hcd 0000:00:14.0: new USB bus registered, assigned bus number 3 xhci_hcd 0000:04:00.0: new USB bus registered, assigned bus number 4 Reason why this commit causes regression is still unknown, but revert it while debugging the issue. Fixes: 4c2604a9a689 ("usb: xhci-pci: Set PROBE_PREFER_ASYNCHRONOUS") Cc: stable Link: https://lore.kernel.org/linux-usb/20230307132120.5897c5af@deangelis.fenrir.org.uk Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230330143056.1390020-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ecaa4902439298f6b0e29f47424a86b310a9ff4f Author: D Scott Phillips Date: Thu Mar 30 17:30:54 2023 +0300 xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu Previously the quirk was skipped when no iommu was present. The same rationale for skipping the quirk also applies in the iommu.passthrough=1 case. Skip applying the XHCI_ZERO_64B_REGS quirk if the device's iommu domain is passthrough. Fixes: 12de0a35c996 ("xhci: Add quirk to zero 64bit registers on Renesas PCIe controllers") Cc: stable Signed-off-by: D Scott Phillips Acked-by: Marc Zyngier Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20230330143056.1390020-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2eca98e5b24d01c02b46c67be05a5f98cc9789b1 Author: Juergen Gross Date: Wed Mar 29 10:02:59 2023 +0200 xen/netback: use same error messages for same errors Issue the same error message in case an illegal page boundary crossing has been detected in both cases where this is tested. Suggested-by: Jan Beulich Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Link: https://lore.kernel.org/r/20230329080259.14823-1-jgross@suse.com Signed-off-by: Paolo Abeni commit fd30d1cdcc4ff405fc54765edf2e11b03f2ed4f3 Author: Pavel Begunkov Date: Thu Mar 30 06:52:38 2023 -0600 io_uring: fix poll/netmsg alloc caches We increase cache->nr_cached when we free into the cache but don't decrease when we take from it, so in some time we'll get an empty cache with cache->nr_cached larger than IO_ALLOC_CACHE_MAX, that fails io_alloc_cache_put() and effectively disables caching. Fixes: 9b797a37c4bd8 ("io_uring: add abstraction around apoll cache") Cc: stable@vger.kernel.org Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 77af13ba3c7f91d91c377c7e2d122849bbc17128 Author: Damien Le Moal Date: Thu Mar 30 09:47:58 2023 +0900 zonefs: Do not propagate iomap_dio_rw() ENOTBLK error to user space The call to invalidate_inode_pages2_range() in __iomap_dio_rw() may fail, in which case -ENOTBLK is returned and this error code is propagated back to user space trhough iomap_dio_rw() -> zonefs_file_dio_write() return chain. This error code is fairly obscure and may confuse the user. Avoid this and be consistent with the behavior of zonefs_file_dio_append() for similar invalidate_inode_pages2_range() errors by returning -EBUSY to user space when iomap_dio_rw() returns -ENOTBLK. Suggested-by: Christoph Hellwig Fixes: 8dcc1a9d90c1 ("fs: New zonefs file system") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Tested-by: Hans Holmberg commit c1976bd8f23016d8706973908f2bb0ac0d852a8f Author: Damien Le Moal Date: Wed Mar 29 13:16:01 2023 +0900 zonefs: Always invalidate last cached page on append write When a direct append write is executed, the append offset may correspond to the last page of a sequential file inode which might have been cached already by buffered reads, page faults with mmap-read or non-direct readahead. To ensure that the on-disk and cached data is consistant for such last cached page, make sure to always invalidate it in zonefs_file_dio_append(). If the invalidation fails, return -EBUSY to userspace to differentiate from IO errors. This invalidation will always be a no-op when the FS block size (device zone write granularity) is equal to the page size (e.g. 4K). Reported-by: Hans Holmberg Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Tested-by: Hans Holmberg commit 87891399d9883ed823ba58c2be3ac20cc499ad7d Author: Chris Morgan Date: Mon Mar 27 10:35:47 2023 -0500 arm64: dts: rockchip: Add clk_rtc_32k to Anbernic xx3 Devices For the Anbernic devices to display properly, we need to specify the clock frequency of the PLL_VPLL. Adding the parent clock in the rk356x.dtsi requires us to update our clock definitions to accomplish this. Fixes: 64b69474edf3 ("arm64: dts: rockchip: assign rate to clk_rtc_32k on rk356x") Signed-off-by: Chris Morgan Link: https://lore.kernel.org/r/20230327153547.821822-1-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 12b220a6171faf10638ab683a975cadcf1a352d6 Author: Felix Fietkau Date: Fri Mar 24 13:09:24 2023 +0100 wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta Avoid potential data corruption issues caused by uninitialized driver private data structures. Reported-by: Brian Coverstone Fixes: 6a9d1b91f34d ("mac80211: add pre-RCU-sync sta removal driver operation") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230324120924.38412-3-nbd@nbd.name Signed-off-by: Johannes Berg commit 899c2c11810cfe38cb01c847d0df98e181ea5728 Author: Felix Fietkau Date: Fri Mar 24 13:09:23 2023 +0100 wifi: mac80211: fix flow dissection for forwarded packets Adjust the network header to point at the correct payload offset Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230324120924.38412-2-nbd@nbd.name Signed-off-by: Johannes Berg commit 8f0149a8ac59c12cd47271ac625c27dac5621d3a Author: Felix Fietkau Date: Fri Mar 24 13:09:22 2023 +0100 wifi: mac80211: fix mesh forwarding Linearize packets (needed for forwarding A-MSDU subframes). Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230324120924.38412-1-nbd@nbd.name Signed-off-by: Johannes Berg commit e26c0946a5c1aa4d27f8dfe78f2a72b4550df91f Author: Felix Fietkau Date: Sun Mar 26 17:17:09 2023 +0200 wifi: mac80211: fix receiving mesh packets in forwarding=0 networks When forwarding is set to 0, frames are typically sent with ttl=1. Move the ttl decrement check below the check for local receive in order to fix packet drops. Reported-by: Thomas Hühn Reported-by: Nick Hainke Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230326151709.17743-1-nbd@nbd.name Signed-off-by: Johannes Berg commit dd01579e5ed922dcfcb8fec53fa03b81c7649a04 Author: Ryder Lee Date: Tue Mar 28 01:07:41 2023 +0800 wifi: mac80211: fix the size calculation of ieee80211_ie_len_eht_cap() Here should return the size of ieee80211_eht_cap_elem_fixed, so fix it. Fixes: 820acc810fb6 ("mac80211: Add EHT capabilities to association/probe request") Signed-off-by: Ryder Lee Link: https://lore.kernel.org/r/06c13635fc03bcff58a647b8e03e9f01a74294bd.1679935259.git.ryder.lee@mediatek.com Signed-off-by: Johannes Berg commit a16fc38315f2c69c520ee769976ecb9c706b8560 Author: Felix Fietkau Date: Thu Mar 30 11:00:01 2023 +0200 wifi: mac80211: fix potential null pointer dereference rx->sta->amsdu_mesh_control is being passed to ieee80211_amsdu_to_8023s without checking rx->sta. Since it doesn't make sense to accept A-MSDU packets without a sta, simply add a check earlier. Fixes: 6e4c0d0460bd ("wifi: mac80211: add a workaround for receiving non-standard mesh A-MSDU") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230330090001.60750-2-nbd@nbd.name Signed-off-by: Johannes Berg commit 4d78e032fee5d532e189cdb2c3c76112094e9751 Author: Felix Fietkau Date: Thu Mar 30 11:00:00 2023 +0200 wifi: mac80211: drop bogus static keywords in A-MSDU rx These were unintentional copy&paste mistakes. Cc: stable@vger.kernel.org Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230330090001.60750-1-nbd@nbd.name Signed-off-by: Johannes Berg commit fed8d8773b8ea68ad99d9eee8c8343bef9da2c2c Author: Eric DeVolder Date: Mon Mar 27 15:10:26 2023 -0400 x86/acpi/boot: Correct acpi_is_processor_usable() check The logic in acpi_is_processor_usable() requires the online capable bit be set for hotpluggable CPUs. The online capable bit has been introduced in ACPI 6.3. However, for ACPI revisions < 6.3 which do not support that bit, CPUs should be reported as usable, not the other way around. Reverse the check. [ bp: Rewrite commit message. ] Fixes: e2869bd7af60 ("x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC") Suggested-by: Miguel Luis Suggested-by: Boris Ostrovsky Signed-off-by: Eric DeVolder Signed-off-by: Borislav Petkov (AMD) Tested-by: David R Cc: Link: https://lore.kernel.org/r/20230327191026.3454-2-eric.devolder@oracle.com commit a74fabfbd1b7013045afc8cc541e6cab3360ccb5 Author: Mario Limonciello Date: Wed Mar 29 12:45:35 2023 -0500 x86/ACPI/boot: Use FADT version to check support for online capable ACPI 6.3 introduced the online capable bit, and also introduced MADT version 5. Latter was used to distinguish whether the offset storing online capable could be used. However ACPI 6.2b has MADT version "45" which is for an errata version of the ACPI 6.2 spec. This means that the Linux code for detecting availability of MADT will mistakenly flag ACPI 6.2b as supporting online capable which is inaccurate as it's an ACPI 6.3 feature. Instead use the FADT major and minor revision fields to distinguish this. [ bp: Massage. ] Fixes: aa06e20f1be6 ("x86/ACPI: Don't add CPUs that are not online capable") Reported-by: Eric DeVolder Reported-by: Borislav Petkov Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/943d2445-84df-d939-f578-5d8240d342cc@unsolicited.net commit 6f5d82806b50fa5f658796ef1c394577ba7b4a35 Merge: 209373537648d 25209a3209ecc Author: Paolo Abeni Date: Thu Mar 30 10:47:51 2023 +0200 Merge branch 'fix-header-length-on-skb-merging' Arseniy Krasnov says: ==================== fix header length on skb merging this patchset fixes appending newly arrived skbuff to the last skbuff of the socket's queue during rx path. Problem fires when we are trying to append data to skbuff which was already processed in dequeue callback at least once. Dequeue callback calls function 'skb_pull()' which changes 'skb->len'. In current implementation 'skb->len' is used to update length in header of last skbuff after new data was copied to it. This is bug, because value in header is used to calculate 'rx_bytes'/'fwd_cnt' and thus must be constant during skbuff lifetime. Here is example, we have two skbuffs: skb0 with length 10 and skb1 with length 4. 1) skb0 arrives, hdr->len == skb->len == 10, rx_bytes == 10 2) Read 3 bytes from skb0, skb->len == 7, hdr->len == 10, rx_bytes == 10 3) skb1 arrives, hdr->len == skb->len == 4, rx_bytes == 14 4) Append skb1 to skb0, skb0 now has skb->len == 11, hdr->len == 11. But value of 11 in header is invalid. 5) Read whole skb0, update rx_bytes by 11 from skb0's header. 6) At this moment rx_bytes == 3, but socket's queue is empty. This bug starts to fire since: commit 077706165717 ("virtio/vsock: don't use skbuff state to account credit") In fact, it presents before, but didn't triggered due to a little bit buggy implementation of credit calculation logic. So i'll use Fixes tag for it. I really forgot about this branch in rx path when implemented patch 077706165717. This patchset contains 3 patches: 1) Fix itself. 2) Patch with WARN_ONCE() to catch such problems in future. 3) Patch with test which triggers skb appending logic. It looks like simple test with several 'send()' and 'recv()', but it checks, that skbuff appending works ok. ==================== Link: https://lore.kernel.org/r/0683cc6e-5130-484c-1105-ef2eb792d355@sberdevices.ru Signed-off-by: Paolo Abeni commit 25209a3209ecc44f93300b7ee5287f451be1d6ff Author: Arseniy Krasnov Date: Tue Mar 28 14:33:07 2023 +0300 test/vsock: new skbuff appending test This adds test which checks case when data of newly received skbuff is appended to the last skbuff in the socket's queue. It looks like simple test with 'send()' and 'recv()', but internally it triggers logic which appends one received skbuff to another. Test checks that this feature works correctly. This test is actual only for virtio transport. Signed-off-by: Arseniy Krasnov Reviewed-by: Stefano Garzarella Signed-off-by: Paolo Abeni commit b8d2f61fdf2a566f7872158f35e65599aceb90fb Author: Arseniy Krasnov Date: Tue Mar 28 14:32:12 2023 +0300 virtio/vsock: WARN_ONCE() for invalid state of socket This adds WARN_ONCE() and return from stream dequeue callback when socket's queue is empty, but 'rx_bytes' still non-zero. This allows the detection of potential bugs due to packet merging (see previous patch). Signed-off-by: Arseniy Krasnov Reviewed-by: Stefano Garzarella Signed-off-by: Paolo Abeni commit f7154d967bc4ee25ea1572937550e711b2525474 Author: Arseniy Krasnov Date: Tue Mar 28 14:31:28 2023 +0300 virtio/vsock: fix header length on skb merging This fixes appending newly arrived skbuff to the last skbuff of the socket's queue. Problem fires when we are trying to append data to skbuff which was already processed in dequeue callback at least once. Dequeue callback calls function 'skb_pull()' which changes 'skb->len'. In current implementation 'skb->len' is used to update length in header of the last skbuff after new data was copied to it. This is bug, because value in header is used to calculate 'rx_bytes'/'fwd_cnt' and thus must be not be changed during skbuff's lifetime. Bug starts to fire since: commit 077706165717 ("virtio/vsock: don't use skbuff state to account credit") It presents before, but didn't triggered due to a little bit buggy implementation of credit calculation logic. So use Fixes tag for it. Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit") Signed-off-by: Arseniy Krasnov Reviewed-by: Stefano Garzarella Signed-off-by: Paolo Abeni commit 8671133082176d1388e20ac33d61cf7e3b05adf5 Author: Linus Walleij Date: Fri Mar 24 11:15:31 2023 +0100 tee: Pass a pointer to virt_to_page() Like the other calls in this function virt_to_page() expects a pointer, not an integer. However since many architectures implement virt_to_pfn() as a macro, this function becomes polymorphic and accepts both a (unsigned long) and a (void *). Fix this up with an explicit cast. Signed-off-by: Linus Walleij Signed-off-by: Jens Wiklander commit f9ea835e99bc8d049bf2a3ec8fa5a7cb4fcade23 Author: Reiji Watanabe Date: Tue Mar 28 19:39:44 2023 -0700 KVM: arm64: PMU: Restore the guest's EL0 event counting after migration Currently, with VHE, KVM enables the EL0 event counting for the guest on vcpu_load() or KVM enables it as a part of the PMU register emulation process, when needed. However, in the migration case (with VHE), the same handling is lacking, as vPMU register values that were restored by userspace haven't been propagated yet (the PMU events haven't been created) at the vcpu load-time on the first KVM_RUN (kvm_vcpu_pmu_restore_guest() called from vcpu_load() on the first KVM_RUN won't do anything as events_{guest,host} of kvm_pmu_events are still zero). So, with VHE, enable the guest's EL0 event counting on the first KVM_RUN (after the migration) when needed. More specifically, have kvm_pmu_handle_pmcr() call kvm_vcpu_pmu_restore_guest() so that kvm_pmu_handle_pmcr() on the first KVM_RUN can take care of it. Fixes: d0c94c49792c ("KVM: arm64: Restore PMU configuration on first run") Cc: stable@vger.kernel.org Reviewed-by: Marc Zyngier Signed-off-by: Reiji Watanabe Link: https://lore.kernel.org/r/20230329023944.2488484-1-reijiw@google.com Signed-off-by: Oliver Upton commit 209373537648d815a104c3af787663d7db06bd5d Merge: c5cff16f461a4 581bce7bcb7e7 Author: Jakub Kicinski Date: Wed Mar 29 21:48:18 2023 -0700 Merge branch 'bnxt_en-3-bug-fixes' Michael Chan says: ==================== bnxt_en: 3 Bug fixes This series contains 3 small bug fixes covering ethtool self test, PCI ID string typos, and some missing 200G link speed ethtool reporting logic. ==================== Link: https://lore.kernel.org/r/20230329013021.5205-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 581bce7bcb7e7f100908728e7b292e266c76895b Author: Michael Chan Date: Tue Mar 28 18:30:21 2023 -0700 bnxt_en: Add missing 200G link speed reporting bnxt_fw_to_ethtool_speed() is missing the case statement for 200G link speed reported by firmware. As a result, ethtool will report unknown speed when the firmware reports 200G link speed. Fixes: 532262ba3b84 ("bnxt_en: ethtool: support PAM4 link speeds up to 200G") Signed-off-by: Michael Chan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 62aad36ed31abc80f35db11e187e690448a79f7d Author: Kalesh AP Date: Tue Mar 28 18:30:20 2023 -0700 bnxt_en: Fix typo in PCI id to device description string mapping Fix 57502 and 57508 NPAR description string entries. The typos caused these devices to not match up with lspci output. Fixes: 49c98421e6ab ("bnxt_en: Add PCI IDs for 57500 series NPAR devices.") Reviewed-by: Pavan Chebbi Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 83714dc3db0e4a088673601bc8099b079bc1a077 Author: Kalesh AP Date: Tue Mar 28 18:30:19 2023 -0700 bnxt_en: Fix reporting of test result in ethtool selftest When the selftest command fails, driver is not reporting the failure by updating the "test->flags" when bnxt_close_nic() fails. Fixes: eb51365846bc ("bnxt_en: Add basic ethtool -t selftest support.") Reviewed-by: Pavan Chebbi Reviewed-by: Somnath Kotur Signed-off-by: Kalesh AP Signed-off-by: Michael Chan Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 Author: Radoslaw Tyl Date: Tue Mar 28 10:26:59 2023 -0700 i40e: fix registers dump after run ethtool adapter self test Fix invalid registers dump from ethtool -d ethX after adapter self test by ethtool -t ethY. It causes invalid data display. The problem was caused by overwriting i40e_reg_list[].elements which is common for ethtool self test and dump. Fixes: 22dd9ae8afcc ("i40e: Rework register diagnostic") Signed-off-by: Radoslaw Tyl Reviewed-by: Michal Swiatkowski Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230328172659.3906413-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 165d35159c5797ae900a8262ce2c44592216aa4e Merge: a4d7108c2efb5 e9a1cc2e4c4ee Author: Jakub Kicinski Date: Wed Mar 29 21:46:18 2023 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-28 (ice) This series contains updates to ice driver only. Jesse fixes mismatched header documentation reported when building with W=1. Brett restricts setting of VSI context to only applicable fields for the given ICE_AQ_VSI_PROP_Q_OPT_VALID bit. Junfeng adds check when adding Flow Director filters that conflict with existing filter rules. Jakob Koschel adds interim variable for iterating to prevent possible misuse after looping. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() ice: add profile conflict check for AVF FDIR ice: Fix ice_cfg_rdma_fltr() to only update relevant fields ice: fix W=1 headers mismatch ==================== Link: https://lore.kernel.org/r/20230328172035.3904953-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit a4d7108c2efb536e0f55c3d02d5b37dd0ec67601 Merge: 8c495270845d6 984cfd55e0c99 Author: Jakub Kicinski Date: Wed Mar 29 21:41:12 2023 -0700 Merge tag 'ieee802154-for-net-2023-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan Stefan Schmidt says: ==================== ieee802154 for net 2023-03-29 Two small fixes this time. Dongliang Mu removed an unnecessary null pointer check. Harshit Mogalapalli fixed an int comparison unsigned against signed from a recent other fix in the ca8210 driver. * tag 'ieee802154-for-net-2023-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan: net: ieee802154: remove an unnecessary null pointer check ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() ==================== Link: https://lore.kernel.org/r/20230329064541.2147400-1-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit 8c495270845d6b4854607e946baef3637a8259ed Author: Jakub Kicinski Date: Tue Mar 28 17:00:13 2023 -0700 bnx2x: use the right build_skb() helper build_skb() no longer accepts slab buffers. Since slab use is fairly uncommon we prefer the drivers to call a separate slab_build_skb() function appropriately. bnx2x uses the old semantics where size of 0 meant buffer from slab. It sets the fp->rx_frag_size to 0 for MTUs which don't fit in a page. It needs to call slab_build_skb(). This fixes the WARN_ONCE() of incorrect API use seen with bnx2x. Reported-by: Thomas Voegtle Link: https://lore.kernel.org/all/b8f295e4-ba57-8bfb-7d9c-9d62a498a727@lio96.de/ Fixes: ce098da1497c ("skbuff: Introduce slab_build_skb()") Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230329000013.2734957-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6c75dc94f2b27fff57b305af9236eea181a00b6c Author: Alex Elder Date: Tue Mar 28 11:27:51 2023 -0500 net: ipa: compute DMA pool size properly In gsi_trans_pool_init_dma(), the total size of a pool of memory used for DMA transactions is calculated. However the calculation is done incorrectly. For 4KB pages, this total size is currently always more than one page, and as a result, the calculation produces a positive (though incorrect) total size. The code still works in this case; we just end up with fewer DMA pool entries than we intended. Bjorn Andersson tested booting a kernel with 16KB pages, and hit a null pointer derereference in sg_alloc_append_table_from_pages(), descending from gsi_trans_pool_init_dma(). The cause of this was that a 16KB total size was going to be allocated, and with 16KB pages the order of that allocation is 0. The total_size calculation yielded 0, which eventually led to the crash. Correcting the total_size calculation fixes the problem. Reported-by: Bjorn Andersson Tested-by: Bjorn Andersson Fixes: 9dd441e4ed57 ("soc: qcom: ipa: GSI transactions") Reviewed-by: Mark Bloch Signed-off-by: Alex Elder Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230328162751.2861791-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit 88eaba80328b31ef81813a1207b4056efd7006a6 Author: Sagi Grimberg Date: Mon Mar 20 15:33:34 2023 +0200 nvme-tcp: fix a possible UAF when failing to allocate an io queue When we allocate a nvme-tcp queue, we set the data_ready callback before we actually need to use it. This creates the potential that if a stray controller sends us data on the socket before we connect, we can trigger the io_work and start consuming the socket. In this case reported: we failed to allocate one of the io queues, and as we start releasing the queues that we already allocated, we get a UAF [1] from the io_work which is running before it should really. Fix this by setting the socket ops callbacks only before we start the queue, so that we can't accidentally schedule the io_work in the initialization phase before the queue started. While we are at it, rename nvme_tcp_restore_sock_calls to pair with nvme_tcp_setup_sock_ops. [1]: [16802.107284] nvme nvme4: starting error recovery [16802.109166] nvme nvme4: Reconnecting in 10 seconds... [16812.173535] nvme nvme4: failed to connect socket: -111 [16812.173745] nvme nvme4: Failed reconnect attempt 1 [16812.173747] nvme nvme4: Reconnecting in 10 seconds... [16822.413555] nvme nvme4: failed to connect socket: -111 [16822.413762] nvme nvme4: Failed reconnect attempt 2 [16822.413765] nvme nvme4: Reconnecting in 10 seconds... [16832.661274] nvme nvme4: creating 32 I/O queues. [16833.919887] BUG: kernel NULL pointer dereference, address: 0000000000000088 [16833.920068] nvme nvme4: Failed reconnect attempt 3 [16833.920094] #PF: supervisor write access in kernel mode [16833.920261] nvme nvme4: Reconnecting in 10 seconds... [16833.920368] #PF: error_code(0x0002) - not-present page [16833.921086] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] [16833.921191] RIP: 0010:_raw_spin_lock_bh+0x17/0x30 ... [16833.923138] Call Trace: [16833.923271] [16833.923402] lock_sock_nested+0x1e/0x50 [16833.923545] nvme_tcp_try_recv+0x40/0xa0 [nvme_tcp] [16833.923685] nvme_tcp_io_work+0x68/0xa0 [nvme_tcp] [16833.923824] process_one_work+0x1e8/0x390 [16833.923969] worker_thread+0x53/0x3d0 [16833.924104] ? process_one_work+0x390/0x390 [16833.924240] kthread+0x124/0x150 [16833.924376] ? set_kthread_struct+0x50/0x50 [16833.924518] ret_from_fork+0x1f/0x30 [16833.924655] Reported-by: Yanjun Zhang Signed-off-by: Sagi Grimberg Tested-by: Yanjun Zhang Signed-off-by: Christoph Hellwig commit 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 Author: Zhihao Cheng Date: Mon Mar 6 09:33:08 2023 +0800 ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size Following process will make ubi attaching failed since commit 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size"): ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB modprobe nandsim id_bytes=$ID flash_eraseall /dev/mtd0 modprobe ubi mtd="0,2048" # set vid_hdr offset as 2048 (one page) (dmesg): ubi0 error: ubi_attach_mtd_dev [ubi]: VID header offset 2048 too large. UBI error: cannot attach mtd0 UBI error: cannot initialize UBI, error -22 Rework original solution, the key point is making sure 'vid_hdr_shift + UBI_VID_HDR_SIZE < ubi->vid_hdr_alsize', so we should check vid_hdr_shift rather not vid_hdr_offset. Then, ubi still support (sub)page aligined VID header offset. Fixes: 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size") Signed-off-by: Zhihao Cheng Tested-by: Nicolas Schichan Tested-by: Miquel Raynal # v5.10, v4.19 Signed-off-by: Richard Weinberger commit 68dc1846c3a44d5e633be145c169ce2fd5420695 Author: Fangzhi Zuo Date: Tue Feb 28 21:34:58 2023 -0500 drm/amd/display: Take FEC Overhead into Timeslot Calculation 8b/10b encoding needs to add 3% fec overhead into the pbn. In the Synapcis Cascaded MST hub, the first stage MST branch device needs the information to determine the timeslot count for the second stage MST branch device. Missing this overhead will leads to insufficient timeslot allocation. Cc: stable@vger.kernel.org Cc: Mario Limonciello Reviewed-by: Hersen Wu Acked-by: Qingqing Zhuo Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f4f3b7dedbe849e780c779ba67365bb1db0d8637 Author: Fangzhi Zuo Date: Fri Feb 24 13:45:21 2023 -0500 drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub Traditional synaptics hub has one MST branch device without virtual dpcd. Synaptics cascaded hub has two chained MST branch devices. DSC decoding is performed via root MST branch device, instead of the second MST branch device. Reviewed-by: Hersen Wu Acked-by: Qingqing Zhuo Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 4622f159098e098611f393cccf73d52b007e70bc Merge: e89c2e815e764 1ee7fc3f4d0a9 Author: Palmer Dabbelt Date: Wed Mar 29 11:48:41 2023 -0700 Merge patch series "RISC-V: Fixes for riscv_has_extension[un]likely()'s alternative dependency" Conor Dooley says: Here's my attempt at fixing both the use of an FPU on XIP kernels and the issue that Jason ran into where CONFIG_FPU, which needs the alternatives frame work for has_fpu() checks, could be enabled without the alternatives actually being present. For the former, a "slow" fallback that does not use alternatives is added to riscv_has_extension_[un]likely() that can be used with XIP. Obviously, we want to make use of Jisheng's alternatives based approach where possible, so any users of riscv_has_extension_[un]likely() will want to make sure that they select RISCV_ALTERNATIVE. If they don't however, they'll hit the fallback path which (should, sparing a silly mistake from me!) behave in the same way, thus succeeding silently. Sounds like a To prevent "depends on !XIP_KERNEL; select RISCV_ALTERNATIVE" spreading like the plague through the various places that want to check for the presence of extensions, and sidestep the potential silent "success" mentioned above, all users RISCV_ALTERNATIVE are converted from selects to dependencies, with the option being selected for all !XIP_KERNEL builds. I know that the VDSO was a key place that Jisheng wanted to use the new helper rather than static branches, and I think the fallback path should not cause issues there. See the thread at [1] for the prior discussion. 1 - https://lore.kernel.org/linux-riscv/20230128172856.3814-1-jszhang@kernel.org/T/#m21390d570997145d31dd8bb95002fd61f99c6573 [Palmer: merging in the fixes as a branch as there's some features that depend on it.] * b4-shazam-merge: RISC-V: always select RISCV_ALTERNATIVE for non-xip kernels RISC-V: add non-alternative fallback for riscv_has_extension_[un]likely() Link: https://lore.kernel.org/r/20230324100538.3514663-1-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit aa874cdfec07d4dd9c6f0c356d65c609ba31a26f Author: Tharun Kumar P Date: Mon Mar 20 19:52:37 2023 +0530 i2c: mchp-pci1xxxx: Update Timing registers Update I2C timing registers based on latest hardware design. This fix does not break functionality of chips with older design and existing users will not be affected. Fixes: 361693697249 ("i2c: microchip: pci1xxxx: Add driver for I2C host controller in multifunction endpoint of pci1xxxx switch") Signed-off-by: Tharun Kumar P Reviewed-by: Andy Shevchenko Signed-off-by: Wolfram Sang commit 1ee7fc3f4d0a93831a20d5566f203d5ad6d44de8 Author: Conor Dooley Date: Fri Mar 24 10:05:39 2023 +0000 RISC-V: always select RISCV_ALTERNATIVE for non-xip kernels When moving switch_to's has_fpu() over to using riscv_has_extension_likely() rather than static branches, the FPU code gained a dependency on the alternatives framework. That dependency has now been removed, as riscv_has_extension_ikely() now contains a fallback path, using __riscv_isa_extension_available(), but if CONFIG_RISCV_ALTERNATIVE isn't selected when CONFIG_FPU is, has_fpu() checks will not benefit from the "fast path" that the alternatives framework provides. We want to ensure that alternatives are available whenever riscv_has_extension_[un]likely() is used, rather than silently falling back to the slow path, but rather than rely on selecting RISCV_ALTERNATIVE in the myriad of locations that may use riscv_has_extension_[un]likely(), select it (almost) always instead by adding it to the main RISCV config entry. xip kernels cannot make use of the alternatives framework, so it is not enabled for those configurations, although this is the status quo. All current sites that select RISCV_ALTERNATIVE are converted to dependencies on the option instead. The explicit dependencies on !XIP_KERNEL can be dropped, as RISCV_ALTERNATIVE is not user selectable. Fixes: 702e64550b12 ("riscv: fpu: switch has_fpu() to riscv_has_extension_likely()") Link: https://lore.kernel.org/all/ZBruFRwt3rUVngPu@zx2c4.com/ Reported-by: Jason A. Donenfeld Signed-off-by: Conor Dooley Reviewed-by: Andrew Jones Reviewed-by: Jason A. Donenfeld Link: https://lore.kernel.org/r/20230324100538.3514663-3-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 1aa866931b8026a0dd636e9ef7b5c5dfb4cc5ce8 Author: Conor Dooley Date: Fri Mar 24 10:05:38 2023 +0000 RISC-V: add non-alternative fallback for riscv_has_extension_[un]likely() The has_fpu() check, which in turn calls riscv_has_extension_likely(), relies on alternatives to figure out whether the system has an FPU. As a result, it will malfunction on XIP kernels, as they do not support the alternatives mechanism. When alternatives support is not present, fall back to using __riscv_isa_extension_available() in riscv_has_extension_[un]likely() instead stead, which handily takes the same argument, so that kernels that do not support alternatives can accurately report the presence of FPU support. Fixes: 702e64550b12 ("riscv: fpu: switch has_fpu() to riscv_has_extension_likely()") Link: https://lore.kernel.org/all/ad445951-3d13-4644-94d9-e0989cda39c3@spud/ Signed-off-by: Conor Dooley Reviewed-by: Andrew Jones Reviewed-by: Jason A. Donenfeld Link: https://lore.kernel.org/r/20230324100538.3514663-2-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 292fd843de26c551856e66faf134512c52dd78b4 Author: Waiman Long Date: Fri Mar 17 11:15:05 2023 -0400 cgroup/cpuset: Fix partition root's cpuset.cpus update bug It was found that commit 7a2127e66a00 ("cpuset: Call set_cpus_allowed_ptr() with appropriate mask for task") introduced a bug that corrupted "cpuset.cpus" of a partition root when it was updated. It is because the tmp->new_cpus field of the passed tmp parameter of update_parent_subparts_cpumask() should not be used at all as it contains important cpumask data that should not be overwritten. Fix it by using tmp->addmask instead. Also update update_cpumask() to make sure that trialcs->cpu_allowed will not be corrupted until it is no longer needed. Fixes: 7a2127e66a00 ("cpuset: Call set_cpus_allowed_ptr() with appropriate mask for task") Signed-off-by: Waiman Long Cc: stable@vger.kernel.org # v6.2+ Signed-off-by: Tejun Heo commit a57cc2dbb3738930d9cb361b9b473f90c8ede0b8 Author: Srinivas Pandruvada Date: Wed Mar 29 08:22:07 2023 -0700 thermal: intel: int340x: processor_thermal: Fix additional deadlock Commit 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix deadlock") addressed deadlock issue during user space trip update. But it missed a case when thermal zone device is disabled when user writes 0. Call to thermal_zone_device_disable() also causes deadlock as it also tries to lock tz->lock, which is already claimed by trip_point_temp_store() in the thermal core code. Remove call to thermal_zone_device_disable() in the function sys_set_trip_temp(), which is called from trip_point_temp_store(). Fixes: 52f04f10b900 ("thermal: intel: int340x: processor_thermal: Fix deadlock") Signed-off-by: Srinivas Pandruvada Cc: 6.2+ # 6.2+ Signed-off-by: Rafael J. Wysocki commit 433279beba1d4872da10b7b60a539e0cb828b32b Author: Yu Kuai Date: Tue Mar 28 17:44:00 2023 +0800 md: fix regression for null-ptr-deference in __md_stop() Commit 3e453522593d ("md: Free resources in __md_stop") tried to fix null-ptr-deference for 'active_io' by moving percpu_ref_exit() to __md_stop(), however, the commit also moving 'writes_pending' to __md_stop(), and this will cause mdadm tests broken: BUG: kernel NULL pointer dereference, address: 0000000000000038 Oops: 0000 [#1] PREEMPT SMP CPU: 15 PID: 17830 Comm: mdadm Not tainted 6.3.0-rc3-next-20230324-00009-g520d37 RIP: 0010:free_percpu+0x465/0x670 Call Trace: __percpu_ref_exit+0x48/0x70 percpu_ref_exit+0x1a/0x90 __md_stop+0xe9/0x170 do_md_stop+0x1e1/0x7b0 md_ioctl+0x90c/0x1aa0 blkdev_ioctl+0x19b/0x400 vfs_ioctl+0x20/0x50 __x64_sys_ioctl+0xba/0xe0 do_syscall_64+0x6c/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0xcd And the problem can be reporduced 100% by following test: mdadm -CR /dev/md0 -l1 -n1 /dev/sda --force echo inactive > /sys/block/md0/md/array_state echo read-auto > /sys/block/md0/md/array_state echo inactive > /sys/block/md0/md/array_state Root cause: // start raid raid1_run mddev_init_writes_pending percpu_ref_init // inactive raid array_state_store do_md_stop __md_stop percpu_ref_exit // start raid again array_state_store do_md_run raid1_run mddev_init_writes_pending if (mddev->writes_pending.percpu_count_ptr) // won't reinit // inactive raid again ... percpu_ref_exit -> null-ptr-deference Before the commit, 'writes_pending' is exited when mddev is freed, and it's safe to restart raid because mddev_init_writes_pending() already make sure that 'writes_pending' will only be initialized once. Fix the prblem by moving 'writes_pending' back, it's a litter hard to find the relationship between alloc memory and free memory, however, code changes is much less and we lived with this for a long time already. Fixes: 3e453522593d ("md: Free resources in __md_stop") Signed-off-by: Yu Kuai Reviewed-by: Xiao Ni Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230328094400.1448955-1-yukuai1@huaweicloud.com commit ffe78bbd512166e0ef1cc4858010b128c510ed7d Merge: 3577a4d37f9e5 e313de5b5b041 Author: Linus Torvalds Date: Wed Mar 29 10:24:07 2023 -0700 Merge tag 'xtensa-20230327' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa fixes from Max Filippov: - fix KASAN report in show_stack - drop linux-xtensa mailing list from the MAINTAINERS file * tag 'xtensa-20230327' of https://github.com/jcmvbkbc/linux-xtensa: MAINTAINERS: xtensa: drop linux-xtensa@linux-xtensa.org mailing list xtensa: fix KASAN report for show_stack commit 3577a4d37f9e5caeb817e221482385151795ec6a Merge: fcd476ea6a888 0b04d4c0542e8 Author: Linus Torvalds Date: Wed Mar 29 10:13:37 2023 -0700 Merge tag 'f2fs-fix-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs fix from Jaegeuk Kim: "This fixes a tracepoint field size in f2fs in preparation for stricter rules for tracing fields" * tag 'f2fs-fix-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: f2fs: Fix f2fs_truncate_partial_nodes ftrace event commit 4ff0b50de8cabba055efe50bbcb7506c41a69835 Author: Pavel Begunkov Date: Wed Mar 29 15:03:43 2023 +0100 io_uring/rsrc: fix rogue rsrc node grabbing We should not be looking at ctx->rsrc_node and anyhow modifying the node without holding uring_lock, grabbing references in such a way is not safe either. Cc: stable@vger.kernel.org Fixes: 5106dd6e74ab6 ("io_uring: propagate issue_flags state down to file assignment") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1202ede2d7bb90136e3482b2b84aad9ed483e5d6.1680098433.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 25bbe844ef5c4fb4d7d8dcaa0080f922b7cd3a16 Author: David Gow Date: Wed Mar 29 14:55:34 2023 +0800 drm: test: Fix 32-bit issue in drm_buddy_test The drm_buddy_test KUnit tests verify that returned blocks have sizes which are powers of two using is_power_of_2(). However, is_power_of_2() operations on a 'long', but the block size is a u64. So on systems where long is 32-bit, this can sometimes fail even on correctly sized blocks. This only reproduces randomly, as the parameters passed to the buddy allocator in this test are random. The seed 0xb2e06022 reproduced it fine here. For now, just hardcode an is_power_of_2() implementation using x & (x - 1). Signed-off-by: David Gow Acked-by: Christian König Reviewed-by: Maíra Canal Reviewed-by: Arunpravin Paneer Selvam Link: https://patchwork.freedesktop.org/patch/msgid/20230329065532.2122295-2-davidgow@google.com Signed-off-by: Christian König commit 4453545b5b4c3eff941f69a5530f916d899db025 Author: David Gow Date: Wed Mar 29 14:55:32 2023 +0800 drm: buddy_allocator: Fix buddy allocator init on 32-bit systems The drm buddy allocator tests were broken on 32-bit systems, as rounddown_pow_of_two() takes a long, and the buddy allocator handles 64-bit sizes even on 32-bit systems. This can be reproduced with the drm_buddy_allocator KUnit tests on i386: ./tools/testing/kunit/kunit.py run --arch i386 \ --kunitconfig ./drivers/gpu/drm/tests drm_buddy (It results in kernel BUG_ON() when too many blocks are created, due to the block size being too small.) This was independently uncovered (and fixed) by Luís Mendes, whose patch added a new u64 variant of rounddown_pow_of_two(). This version instead recalculates the size based on the order. Reported-by: Luís Mendes Link: https://lore.kernel.org/lkml/CAEzXK1oghXAB_KpKpm=-CviDQbNaH0qfgYTSSjZgvvyj4U78AA@mail.gmail.com/T/ Signed-off-by: David Gow Acked-by: Christian König Reviewed-by: Arunpravin Paneer Selvam Link: https://patchwork.freedesktop.org/patch/msgid/20230329065532.2122295-1-davidgow@google.com Signed-off-by: Christian König commit e3720f92e0237921da537e47a0b24e27899203f8 Author: Guennadi Liakhovetski Date: Wed Mar 29 14:38:28 2023 +0300 ASoC: SOF: avoid a NULL dereference with unsupported widgets If an IPC4 topology contains an unsupported widget, its .module_info field won't be set, then sof_ipc4_route_setup() will cause a kernel Oops trying to dereference it. Add a check for such cases. Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Guennadi Liakhovetski Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230329113828.28562-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 52aad39385e1bfdb34a1b405f699a8ef302c58b0 Author: huangwenhui Date: Tue Mar 28 15:46:44 2023 +0800 ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z Fix headset microphone detection on Lenovo ZhaoYang CF4620Z. [ adjusted to be applicable to the latest tree -- tiwai ] Signed-off-by: huangwenhui Cc: Link: https://lore.kernel.org/r/20230328074644.30142-1-huangwenhuia@uniontech.com Signed-off-by: Takashi Iwai commit eca9f6e6f83b6725b84e1c76fdde19b003cff0eb Author: Haren Myneni Date: Mon Mar 20 19:50:08 2023 -0700 powerpc/pseries/vas: Ignore VAS update for DLPAR if copy/paste is not enabled The hypervisor supports user-mode NX from Power10. pseries_vas_dlpar_cpu() is called from lparcfg_write() to update VAS windows for DLPAR event in shared processor mode and the kernel gets -ENOTSUPP for HCALLs if the user-mode NX is not supported. The current VAS implementation also supports only with Radix page tables. Whereas in dedicated processor mode, pseries_vas_notifier() is registered only if the copy/paste feature is enabled. So instead of displaying HCALL error messages, update VAS capabilities if the copy/paste feature is available. This patch ignores updating VAS capabilities in pseries_vas_dlpar_cpu() and returns success if the copy/paste feature is not enabled. Then lparcfg_write() completes the processor DLPAR operations without any failures. Fixes: 2147783d6bf0 ("powerpc/pseries: Use lparcfg to reconfig VAS windows for DLPAR CPU") Cc: stable@vger.kernel.org # v6.1+ Signed-off-by: Haren Myneni Reviewed-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://msgid.link/1d0e727e7dbd9a28627ef08ca9df9c86a50175e2.camel@linux.ibm.com commit 5c2712387d4850e0b64121d5fd3e6c4e84ea3266 Author: Yicong Yang Date: Tue Mar 28 19:49:15 2023 +0800 cacheinfo: Fix LLC is not exported through sysfs After entering 6.3-rc1 the LLC cacheinfo is not exported on our ACPI based arm64 server. This is because the LLC cacheinfo is partly reset when secondary CPUs boot up. On arm64 the primary cpu will allocate and setup cacheinfo: init_cpu_topology() for_each_possible_cpu() fetch_cache_info() // Allocate cacheinfo and init levels detect_cache_attributes() cache_shared_cpu_map_setup() if (!last_level_cache_is_valid()) // not valid, setup LLC cache_setup_properties() // setup LLC On secondary CPU boot up: detect_cache_attributes() populate_cache_leaves() get_cache_type() // Get cache type from clidr_el1, // for LLC type=CACHE_TYPE_NOCACHE cache_shared_cpu_map_setup() if (!last_level_cache_is_valid()) // Valid and won't go to this branch, // leave LLC's type=CACHE_TYPE_NOCACHE The last_level_cache_is_valid() use cacheinfo->{attributes, fw_token} to test it's valid or not, but populate_cache_leaves() will only reset LLC's type, so we won't try to re-setup LLC's type and leave it CACHE_TYPE_NOCACHE and won't export it through sysfs. This patch tries to fix this by not re-populating the cache leaves if the LLC is valid. Fixes: 5944ce092b97 ("arch_topology: Build cacheinfo from primary CPU") Signed-off-by: Yicong Yang Reviewed-by: Pierre Gondois Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20230328114915.33340-1-yangyicong@huawei.com Signed-off-by: Greg Kroah-Hartman commit 30fb97ba4a8e082ba0a5432479d6995472edbd7b Author: Hans de Goede Date: Sun Mar 26 22:54:33 2023 +0200 drm/nouveau/kms: Fix backlight registration The nouveau code used to call drm_fb_helper_initial_config() from nouveau_fbcon_init() before calling drm_dev_register(). This would probe all connectors so that drm_connector->status could be used during backlight registration which runs from nouveau_connector_late_register(). After commit 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") the fbdev emulation code, which now is a drm-client, can only run after drm_dev_register(). So during backlight registration the connectors are not probed yet and the drm_connector->status == connected check in nv50_backlight_init() would now always fail. Replace the drm_connector->status == connected check with a drm_helper_probe_detect() == connected check to fix nv_backlight no longer getting registered because of this. Fixes: 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/202 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2181941 Signed-off-by: Hans de Goede Reviewed-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230326205433.36485-1-hdegoede@redhat.com commit 7708a3858e69db91a8b69487994f33b96d20192a Author: Bjørn Mork Date: Tue Mar 28 20:41:31 2023 +0200 USB: serial: option: add Quectel RM500U-CN modem This modem supports several modes with a class network function and a number of serial functions, all using ff/00/00 The device ID is the same in all modes. RNDIS mode ---------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0900 Rev= 4.04 S: Manufacturer=Quectel S: Product=RM500U-CN S: SerialNumber=0123456789ABCDEF C:* #Ifs= 7 Cfg#= 1 Atr=c0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms ECM mode -------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0900 Rev= 4.04 S: Manufacturer=Quectel S: Product=RM500U-CN S: SerialNumber=0123456789ABCDEF C:* #Ifs= 7 Cfg#= 1 Atr=c0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms NCM mode -------- T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0900 Rev= 4.04 S: Manufacturer=Quectel S: Product=RM500U-CN S: SerialNumber=0123456789ABCDEF C:* #Ifs= 7 Cfg#= 1 Atr=c0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncm E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Reported-by: Andrew Green Cc: stable@vger.kernel.org Signed-off-by: Bjørn Mork Signed-off-by: Johan Hovold commit f92ed0cd9328aed918ebb0ebb64d259eccbcc6e7 Author: Biju Das Date: Tue Mar 21 11:47:50 2023 +0000 tty: serial: sh-sci: Fix Rx on RZ/G2L SCI SCI IP on RZ/G2L alike SoCs do not need regshift compared to other SCI IPs on the SH platform. Currently, it does regshift and configuring Rx wrongly. Drop adding regshift for RZ/G2L alike SoCs. Fixes: dfc80387aefb ("serial: sh-sci: Compute the regshift value for SCI ports") Cc: stable@vger.kernel.org Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230321114753.75038-3-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 178e00f36f934a88682d96aa046c1f90cb6f83a7 Author: Sherry Sun Date: Thu Mar 23 19:09:23 2023 +0800 tty: serial: fsl_lpuart: fix crash in lpuart_uport_is_active For serdev framework, tty->dev is a NULL pointer, lpuart_uport_is_active calling device_may_wakeup() may cause kernel NULL pointer crash, so here add the NULL pointer check before using it. Fixes: 4f5cb8c5e915 ("tty: serial: fsl_lpuart: enable wakeup source for lpuart") Cc: stable Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20230323110923.24581-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 9425914f3de6febbd6250395f56c8279676d9c3c Author: Sherry Sun Date: Thu Mar 23 13:44:15 2023 +0800 tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty According to LPUART RM, Transmission Complete Flag becomes 0 if queuing a break character by writing 1 to CTRL[SBK], so here need to avoid checking for transmission complete when UARTCTRL_SBK is asserted, otherwise the lpuart32_tx_empty may never get TIOCSER_TEMT. Commit 2411fd94ceaa("tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted") only fix it in lpuart32_set_termios(), here also fix it in lpuart32_tx_empty(). Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") Cc: stable Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20230323054415.20363-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 90b8596ac46043e4a782d9111f5b285251b13756 Author: Ilpo Järvinen Date: Fri Mar 17 12:30:34 2023 +0200 serial: 8250: Prevent starting up DMA Rx on THRI interrupt Hans de Goede reported Bluetooth adapters (HCIs) connected over an UART connection failed due corrupted Rx payload. The problem was narrowed down to DMA Rx starting on UART_IIR_THRI interrupt. The problem occurs despite LSR having DR bit set, which is precondition for attempting to start DMA Rx in the first place. From a debug patch: [x.807834] 8250irq: iir=cc lsr+saved=60 received=0/15 ier=0f dma_t/rx/err=0/0/0 [x.808676] 8250irq: iir=c2 lsr+saved=61 received=0/0 ier=0f dma_t/rx/err=0/0/0 [x.808776] 8250irq: iir=cc lsr+saved=60 received=1/12 ier=0d dma_t/rx/err=0/1/0 [x.808870] Bluetooth: hci0: Frame reassembly failed (-84) In the debug snippet, received field indicates 1 byte was transferred over DMA and 12 bytes after that with the non-DMA Rx. The sole byte DMA handled was corrupted (gets zeroed) which leads to the HCI failure. This problem became apparent after commit e8ffbb71f783 ("serial: 8250: use THRE & __stop_tx also with DMA") changed Tx stop behavior. Tx stop is now triggered from a THRI interrupt. Despite that this problem looks like a HW bug, this fix is not adding UART_BUG_xx flag to the driver beucase it seems useful in general to avoid starting DMA when there are only a few bytes to transfer. Skipping DMA for small transfers avoids the extra overhead DMA incurs. Thus, don't setup DMA Rx on UART_IIR_THRI but leave it to a subsequent interrupt which has Rx a related IIR value. By returning false from handle_rx_dma(), the DMA vs non-DMA decision is postponed until either UART_IIR_RDI (FIFO threshold worth of bytes awaiting) or UART_IIR_TIMEOUT (inter-character timeout) triggers at a later time which allows better to discern whether the number of bytes warrants starting DMA or not. Reported-by: Hans de Goede Tested-by: Hans de Goede Fixes: e8ffbb71f783 ("serial: 8250: use THRE & __stop_tx also with DMA") Cc: stable@vger.kernel.org Signed-off-by: Ilpo Järvinen Acked-by: Hans de Goede Link: https://lore.kernel.org/r/20230317103034.12881-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 7b21f329ae0ab6361c0aebfc094db95821490cd1 Author: Geert Uytterhoeven Date: Fri Mar 17 10:46:57 2023 +0100 dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs The fourth interrupt on SCIF variants with four interrupts (RZ/A1) is the Break interrupt, not the Transmit End interrupt (like on SCI(g)). Update the description and interrupt name to fix this. Fixes: 384d00fae8e51f8f ("dt-bindings: serial: sh-sci: Convert to json-schema") Cc: stable Signed-off-by: Geert Uytterhoeven Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/719d1582e0ebbe3d674e3a48fc26295e1475a4c3.1679046394.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit b43a18647f03c87e77d50d6fe74904b61b96323e Author: Biju Das Date: Fri Mar 17 15:04:03 2023 +0000 tty: serial: sh-sci: Fix transmit end interrupt handler The fourth interrupt on SCI port is transmit end interrupt compared to the break interrupt on other port types. So, shuffle the interrupts to fix the transmit end interrupt handler. Fixes: e1d0be616186 ("sh-sci: Add h8300 SCI") Cc: stable Suggested-by: Geert Uytterhoeven Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230317150403.154094-1-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit e4056e38ec87b4c21eb34bb8e38b1b0ca1221744 Author: Krzysztof Kozlowski Date: Fri Mar 24 09:41:27 2023 +0100 dt-bindings: pinctrl: qcom,sm8550-lpass-lpi: allow input-enabled and bias-bus-hold Add missing common pin configuration properties: input-enabled and bias-bus-hold. Fixes: 268e97ccc311 ("dt-bindings: pinctrl: qcom,sm8550-lpass-lpi-pinctrl: add SM8550 LPASS") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230324084127.29362-1-krzysztof.kozlowski@linaro.org Signed-off-by: Linus Walleij commit 4c7f9d2e413dc06a157c4e5dccde84aaf4655eb3 Author: Wayne Chang Date: Mon Mar 27 17:55:48 2023 +0800 usb: xhci: tegra: fix sleep in atomic call When we set the dual-role port to Host mode, we observed the following splat: [ 167.057718] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:229 [ 167.057872] Workqueue: events tegra_xusb_usb_phy_work [ 167.057954] Call trace: [ 167.057962] dump_backtrace+0x0/0x210 [ 167.057996] show_stack+0x30/0x50 [ 167.058020] dump_stack_lvl+0x64/0x84 [ 167.058065] dump_stack+0x14/0x34 [ 167.058100] __might_resched+0x144/0x180 [ 167.058140] __might_sleep+0x64/0xd0 [ 167.058171] slab_pre_alloc_hook.constprop.0+0xa8/0x110 [ 167.058202] __kmalloc_track_caller+0x74/0x2b0 [ 167.058233] kvasprintf+0xa4/0x190 [ 167.058261] kasprintf+0x58/0x90 [ 167.058285] tegra_xusb_find_port_node.isra.0+0x58/0xd0 [ 167.058334] tegra_xusb_find_port+0x38/0xa0 [ 167.058380] tegra_xusb_padctl_get_usb3_companion+0x38/0xd0 [ 167.058430] tegra_xhci_id_notify+0x8c/0x1e0 [ 167.058473] notifier_call_chain+0x88/0x100 [ 167.058506] atomic_notifier_call_chain+0x44/0x70 [ 167.058537] tegra_xusb_usb_phy_work+0x60/0xd0 [ 167.058581] process_one_work+0x1dc/0x4c0 [ 167.058618] worker_thread+0x54/0x410 [ 167.058650] kthread+0x188/0x1b0 [ 167.058672] ret_from_fork+0x10/0x20 The function tegra_xusb_padctl_get_usb3_companion eventually calls tegra_xusb_find_port and this in turn calls kasprintf which might sleep and so cannot be called from an atomic context. Fix this by moving the call to tegra_xusb_padctl_get_usb3_companion to the tegra_xhci_id_work function where it is really needed. Fixes: f836e7843036 ("usb: xhci-tegra: Add OTG support") Cc: stable@vger.kernel.org Signed-off-by: Wayne Chang Signed-off-by: Haotien Hsu Link: https://lore.kernel.org/r/20230327095548.1599470-1-haotienh@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 5f70bcbca469a087b54ad2d934185ed69a098576 Author: M Chetan Kumar Date: Tue Mar 28 11:58:44 2023 +0530 net: wwan: iosm: fixes 7560 modem crash ModemManger/Apps probing the wwan0xmmrpc0 port for 7560 Modem results in modem crash. 7560 Modem FW uses the MBIM interface for control command communication whereas 7360 uses Intel RPC interface so disable wwan0xmmrpc0 port for 7560. Fixes: d08b0f8f46e4 ("net: wwan: iosm: add rpc interface for xmm modems") Reported-and-tested-by: Martin Link: https://bugzilla.kernel.org/show_bug.cgi?id=217200 Signed-off-by: M Chetan Kumar Signed-off-by: Shane Parslow Signed-off-by: David S. Miller commit 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 Author: Tasos Sahanidis Date: Wed Mar 29 06:28:08 2023 +0300 ALSA: ymfpci: Fix BUG_ON in probe function The snd_dma_buffer.bytes field now contains the aligned size, which this snd_BUG_ON() did not account for, resulting in the following: [ 9.625915] ------------[ cut here ]------------ [ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci] [ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy [ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da [ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014 [ 9.732204] Workqueue: events work_for_cpu_fn [ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci] [ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb [ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287 [ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8 [ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020 [ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00 [ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918 [ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200 [ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000 [ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0 [ 9.823301] Call Trace: [ 9.825747] [ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615] [ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0 [ 9.841918] local_pci_probe+0x45/0x80 [ 9.845680] work_for_cpu_fn+0x1a/0x30 [ 9.849431] process_one_work+0x1c7/0x380 [ 9.853464] worker_thread+0x1af/0x390 [ 9.857225] ? rescuer_thread+0x3b0/0x3b0 [ 9.861254] kthread+0xde/0x110 [ 9.864414] ? kthread_complete_and_exit+0x20/0x20 [ 9.869210] ret_from_fork+0x22/0x30 [ 9.872792] [ 9.874985] ---[ end trace 0000000000000000 ]--- Fixes: 5c1733e33c88 ("ALSA: memalloc: Align buffer allocations in page size") Signed-off-by: Tasos Sahanidis Link: https://lore.kernel.org/r/20230329032808.170403-1-tasos@tasossah.com Signed-off-by: Takashi Iwai commit f33fc1576757741479452255132d6e3aaf558ffe Author: Tasos Sahanidis Date: Wed Mar 29 06:24:22 2023 +0300 ALSA: ymfpci: Create card with device-managed snd_devm_card_new() snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 ("ALSA: ymfpci: Allocate resources with device-managed APIs"), but the call to snd_card_new() was not replaced with snd_devm_card_new(). Since there was no longer a call to snd_card_free, unloading the module would eventually result in Oops: [697561.532887] BUG: unable to handle page fault for address: ffffffffc0924480 [697561.532893] #PF: supervisor read access in kernel mode [697561.532896] #PF: error_code(0x0000) - not-present page [697561.532899] PGD ae1e15067 P4D ae1e15067 PUD ae1e17067 PMD 11a8f5067 PTE 0 [697561.532905] Oops: 0000 [#1] PREEMPT SMP NOPTI [697561.532909] CPU: 21 PID: 5080 Comm: wireplumber Tainted: G W OE 6.2.7 #1 [697561.532914] Hardware name: System manufacturer System Product Name/TUF GAMING X570-PLUS, BIOS 4408 10/28/2022 [697561.532916] RIP: 0010:try_module_get.part.0+0x1a/0xe0 [697561.532924] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc bf 01 00 00 00 e8 56 3c f8 ff <41> 83 3c 24 02 0f 84 96 00 00 00 41 8b 84 24 30 03 00 00 85 c0 0f [697561.532927] RSP: 0018:ffffbe9b858c3bd8 EFLAGS: 00010246 [697561.532930] RAX: ffff9815d14f1900 RBX: ffff9815c14e6000 RCX: 0000000000000000 [697561.532933] RDX: 0000000000000000 RSI: ffffffffc055092c RDI: ffffffffb3778c1a [697561.532935] RBP: ffffbe9b858c3be8 R08: 0000000000000040 R09: ffff981a1a741380 [697561.532937] R10: ffffbe9b858c3c80 R11: 00000009d56533a6 R12: ffffffffc0924480 [697561.532939] R13: ffff9823439d8500 R14: 0000000000000025 R15: ffff9815cd109f80 [697561.532942] FS: 00007f13084f1f80(0000) GS:ffff9824aef40000(0000) knlGS:0000000000000000 [697561.532945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [697561.532947] CR2: ffffffffc0924480 CR3: 0000000145344000 CR4: 0000000000350ee0 [697561.532949] Call Trace: [697561.532951] [697561.532955] try_module_get+0x13/0x30 [697561.532960] snd_ctl_open+0x61/0x1c0 [snd] [697561.532976] snd_open+0xb4/0x1e0 [snd] [697561.532989] chrdev_open+0xc7/0x240 [697561.532995] ? fsnotify_perm.part.0+0x6e/0x160 [697561.533000] ? __pfx_chrdev_open+0x10/0x10 [697561.533005] do_dentry_open+0x169/0x440 [697561.533009] vfs_open+0x2d/0x40 [697561.533012] path_openat+0xa9d/0x10d0 [697561.533017] ? debug_smp_processor_id+0x17/0x20 [697561.533022] ? trigger_load_balance+0x65/0x370 [697561.533026] do_filp_open+0xb2/0x160 [697561.533032] ? _raw_spin_unlock+0x19/0x40 [697561.533036] ? alloc_fd+0xa9/0x190 [697561.533040] do_sys_openat2+0x9f/0x160 [697561.533044] __x64_sys_openat+0x55/0x90 [697561.533048] do_syscall_64+0x3b/0x90 [697561.533052] entry_SYSCALL_64_after_hwframe+0x72/0xdc [697561.533056] RIP: 0033:0x7f1308a40db4 [697561.533059] Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 46 68 f8 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 32 44 89 c7 89 44 24 0c e8 78 68 f8 ff 8b 44 [697561.533062] RSP: 002b:00007ffcce664450 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [697561.533066] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f1308a40db4 [697561.533068] RDX: 0000000000080000 RSI: 00007ffcce664690 RDI: 00000000ffffff9c [697561.533070] RBP: 00007ffcce664690 R08: 0000000000000000 R09: 0000000000000012 [697561.533072] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000 [697561.533074] R13: 00007f13054b069b R14: 0000565209f83200 R15: 0000000000000000 [697561.533078] Fixes: c6e6bb5eab74 ("ALSA: ymfpci: Allocate resources with device-managed APIs") Signed-off-by: Tasos Sahanidis Link: https://lore.kernel.org/r/20230329032422.170024-1-tasos@tasossah.com Signed-off-by: Takashi Iwai commit 07b3af42d8d528374d4f42d688bae86eeb30831a Author: Felix Fietkau Date: Fri Mar 24 15:04:04 2023 +0100 net: ethernet: mtk_eth_soc: fix tx throughput regression with direct 1G links Using the QDMA tx scheduler to throttle tx to line speed works fine for switch ports, but apparently caused a regression on non-switch ports. Based on a number of tests, it seems that this throttling can be safely dropped without re-introducing the issues on switch ports that the tx scheduling changes resolved. Link: https://lore.kernel.org/netdev/trinity-92c3826f-c2c8-40af-8339-bc6d0d3ffea4-1678213958520@3c-app-gmx-bs16/ Fixes: f63959c7eec3 ("net: ethernet: mtk_eth_soc: implement multi-queue support for per-port queues") Reported-by: Frank Wunderlich Reported-by: Daniel Golle Tested-by: Daniel Golle Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230324140404.95745-1-nbd@nbd.name Signed-off-by: Jakub Kicinski commit 2280d425ba3599bdd85c41bd0ec8ba568f00c032 Author: Filipe Manana Date: Tue Mar 28 10:45:20 2023 +0100 btrfs: ignore fiemap path cache when there are multiple paths for a node During fiemap, when walking backreferences to determine if a b+tree node/leaf is shared, we may find a tree block (leaf or node) for which two parents were added to the references ulist. This happens if we get for example one direct ref (shared tree block ref) and one indirect ref (non-shared tree block ref) for the tree block at the current level, which can happen during relocation. In that case the fiemap path cache can not be used since it's meant for a single path, with one tree block at each possible level, so having multiple references for a tree block at any level may result in getting the level counter exceed BTRFS_MAX_LEVEL and eventually trigger the warning: WARN_ON_ONCE(level >= BTRFS_MAX_LEVEL) at lookup_backref_shared_cache() and at store_backref_shared_cache(). This is harmless since the code ignores any level >= BTRFS_MAX_LEVEL, the warning is there just to catch any unexpected case like the one described above. However if a user finds this it may be scary and get reported. So just ignore the path cache once we find a tree block for which there are more than one reference, which is the less common case, and update the cache with the sharedness check result for all levels below the level for which we found multiple references. Reported-by: Jarno Pelkonen Link: https://lore.kernel.org/linux-btrfs/CAKv8qLmDNAGJGCtsevxx_VZ_YOvvs1L83iEJkTgyA4joJertng@mail.gmail.com/ Fixes: 12a824dc67a6 ("btrfs: speedup checking for extent sharedness during fiemap") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit bdd034de3a28ffdacab528aebad17f1df968180c Author: Florian Fainelli Date: Fri Mar 24 06:07:36 2023 -0700 mailmap: add an entry for Leonard Crestez Link: https://lkml.kernel.org/r/20230324130737.3360169-1-f.fainelli@gmail.com Signed-off-by: Florian Fainelli Cc: Baolin Wang Cc: Colin Ian King Cc: Jakub Kicinski Cc: Kirill Tkhai Cc: Konrad Dybcio Cc: Leonard Crestez Cc: Qais Yousef Cc: Stephen Hemminger Cc: Vasily Averin Signed-off-by: Andrew Morton commit 1f2803b2660f4b04d48d065072c0ae0c9ca255fd Author: Muchun Song Date: Thu Mar 23 10:50:03 2023 +0800 mm: kfence: fix handling discontiguous page The struct pages could be discontiguous when the kfence pool is allocated via alloc_contig_pages() with CONFIG_SPARSEMEM and !CONFIG_SPARSEMEM_VMEMMAP. This may result in setting PG_slab and memcg_data to a arbitrary address (may be not used as a struct page), which in the worst case might corrupt the kernel. So the iteration should use nth_page(). Link: https://lkml.kernel.org/r/20230323025003.94447-1-songmuchun@bytedance.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Muchun Song Reviewed-by: Marco Elver Reviewed-by: Kefeng Wang Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Jann Horn Cc: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 3ee2d7471fa4963a2ced0a84f0653ce88b43c5b2 Author: Muchun Song Date: Mon Mar 20 11:00:59 2023 +0800 mm: kfence: fix PG_slab and memcg_data clearing It does not reset PG_slab and memcg_data when KFENCE fails to initialize kfence pool at runtime. It is reporting a "Bad page state" message when kfence pool is freed to buddy. The checking of whether it is a compound head page seems unnecessary since we already guarantee this when allocating kfence pool. Remove the check to simplify the code. Link: https://lkml.kernel.org/r/20230320030059.20189-1-songmuchun@bytedance.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Muchun Song Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Jann Horn Cc: Marco Elver Cc: Roman Gushchin Cc: SeongJae Park Cc: Signed-off-by: Andrew Morton commit e900ba10d15041a6236cc75778cc6e06c3590a58 Author: Shiyang Ruan Date: Wed Mar 22 07:25:58 2023 +0000 fsdax: dedupe should compare the min of two iters' length In an dedupe comparison iter loop, the length of iomap_iter decreases because it implies the remaining length after each iteration. The dedupe command will fail with -EIO if the range is larger than one page size and not aligned to the page size. Also report warning in dmesg: [ 4338.498374] ------------[ cut here ]------------ [ 4338.498689] WARNING: CPU: 3 PID: 1415645 at fs/iomap/iter.c:16 ... The compare function should use the min length of the current iters, not the total length. Link: https://lkml.kernel.org/r/1679469958-2-1-git-send-email-ruansy.fnst@fujitsu.com Fixes: 0e79e3736d54 ("fsdax: dedupe: iter two files at the same time") Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Cc: Dan Williams Cc: Jan Kara Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit 13dd4e04625f600e5affb1b3f0b6c35268ab839b Author: Shiyang Ruan Date: Wed Mar 22 11:11:09 2023 +0000 fsdax: unshare: zero destination if srcmap is HOLE or UNWRITTEN unshare copies data from source to destination. But if the source is HOLE or UNWRITTEN extents, we should zero the destination, otherwise the HOLE or UNWRITTEN part will be user-visible old data of the new allocated extent. Found by running generic/649 while mounting with -o dax=always on pmem. Link: https://lkml.kernel.org/r/1679483469-2-1-git-send-email-ruansy.fnst@fujitsu.com Fixes: d984648e428b ("fsdax,xfs: port unshare to fsdax") Signed-off-by: Shiyang Ruan Cc: Dan Williams Cc: Darrick J. Wong Cc: Jan Kara Cc: Matthew Wilcox (Oracle) Cc: Alistair Popple Cc: Jason Gunthorpe Cc: John Hubbard Cc: Signed-off-by: Andrew Morton commit f478b9987cc8236b412d9f2afc958d3e15a7cf85 Author: Tiezhu Yang Date: Tue Mar 21 14:35:08 2023 +0800 lib/Kconfig.debug: correct help info of LOCKDEP_STACK_TRACE_HASH_BITS We can see the following definition in kernel/locking/lockdep_internals.h: #define STACK_TRACE_HASH_SIZE (1 << CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS) CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS is related with STACK_TRACE_HASH_SIZE instead of MAX_STACK_TRACE_ENTRIES, fix it. Link: https://lkml.kernel.org/r/1679380508-20830-1-git-send-email-yangtiezhu@loongson.cn Fixes: 5dc33592e955 ("lockdep: Allow tuning tracing capacity constants.") Signed-off-by: Tiezhu Yang Cc: Dmitry Vyukov Cc: Tetsuo Handa Signed-off-by: Andrew Morton commit 35260cf545226c3b21d52a9d21083f7ff999969c Author: ye xingchen Date: Sun Jan 29 11:10:09 2023 +0800 Kconfig.debug: fix SCHED_DEBUG dependency The path for SCHED_DEBUG is /sys/kernel/debug/sched. So, SCHED_DEBUG should depend on DEBUG_FS, not PROC_FS. Link: https://lkml.kernel.org/r/202301291110098787982@zte.com.cn Signed-off-by: ye xingchen Cc: Dan Williams Cc: Geert Uytterhoeven Cc: Josh Poimboeuf Cc: Kees Cook Cc: Miguel Ojeda Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peter Zijlstra Cc: Randy Dunlap Cc: Rasmus Villemoes Cc: Vlastimil Babka Cc: Zhaoyang Huang Signed-off-by: Andrew Morton commit 1a4b52ce8548355f09170faa67070bc2b8e3ba53 Author: Leonard Göhrs Date: Tue Mar 21 15:55:25 2023 +0100 .mailmap: add entry for Leonard Göhrs My very first kernel commit: e4e1d47c7906 ("ALSA: ppc: remove redundant checks in PS3 driver probe") was sent with the umlaut in my last name transcribed (Göhrs -> Goehrs). Add a mailmap entry so all my commits use the same name. Link: https://lkml.kernel.org/r/20230321145525.1317230-1-l.goehrs@pengutronix.de Signed-off-by: Leonard Göhrs Acked-by: Uwe Kleine-König Signed-off-by: Andrew Morton commit fcd476ea6a888ef6e6627f4c21a2ea8cca3e9312 Merge: 756c1a0593e7d d18a04157fc17 Author: Linus Torvalds Date: Tue Mar 28 13:28:52 2023 -0700 Merge tag 'urgent-rcu.2023.03.28a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU fix from Paul McKenney: "This brings the rcu_torture_read event trace into line with the new trace tools by replacing this event trace's __field() with the corresponding __array(). Without this, the new trace tools will fail when presented wtih an rcu_torture_read event trace, which is a regression from the viewpoint of trace tools users" Link: https://lore.kernel.org/all/20230320133650.5388a05e@gandalf.local.home/ * tag 'urgent-rcu.2023.03.28a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: rcu: Fix rcu_torture_read ftrace event commit 756c1a0593e7d26bd7dc6332e9490607cd106c4f Merge: 05c24161f4d2a 05107edc91013 Author: Linus Torvalds Date: Tue Mar 28 13:14:47 2023 -0700 Merge tag 'linux-kselftest-fixes-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "One single fix for sigaltstack test -Wuninitialized warning found when building with clang" * tag 'linux-kselftest-fixes-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: sigaltstack: fix -Wuninitialized commit b57841fb0b564c61508222e885ac8f30a2811089 Author: Rafael J. Wysocki Date: Tue Mar 28 20:43:26 2023 +0200 thermal: core: Drop excessive lockdep_assert_held() calls The lockdep_assert_held() calls added to cooling_device_stats_setup() and cooling_device_stats_destroy() by commit 790930f44289 ("thermal: core: Introduce thermal_cooling_device_update()") trigger false-positive lockdep reports in code paths that are not subject to race conditions (before cooling device registration and after cooling device removal). For this reason, remove the lockdep_assert_held() calls from both cooling_device_stats_setup() and cooling_device_stats_destroy() and add one to thermal_cooling_device_stats_reinit() that has to be called under the cdev lock. Fixes: 790930f44289 ("thermal: core: Introduce thermal_cooling_device_update()") Link: https://lore.kernel.org/linux-acpi/ZCIDTLFt27Ei7+V6@ideak-desk.fi.intel.com Reported-by: Imre Deak Signed-off-by: Rafael J. Wysocki commit 05c24161f4d2adc0deb6f3f0f55d25e12fbbdcde Merge: 3a93e40326c8f f9bbf25e7b2b7 Author: Linus Torvalds Date: Tue Mar 28 10:43:04 2023 -0700 Merge tag 's390-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix an error handling issue with PTRACE_GET_LAST_BREAK request so that -EFAULT is returned if put_user() fails, instead of ignoring it - Fix a build race for the modules_prepare target when CONFIG_EXPOLINE_EXTERN is enabled by reintroducing the dependence on scripts - Fix a memory leak in vfio_ap device driver - Add missing earlyclobber annotations to __clear_user() inline assembly to prevent incorrect register allocation * tag 's390-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling s390: reintroduce expoline dependence to scripts s390/vfio-ap: fix memory leak in vfio_ap device driver s390/uaccess: add missing earlyclobber annotations to __clear_user() commit e9a1cc2e4c4ee7c7e60fb26345618c2522a2a10f Author: Jakob Koschel Date: Mon Mar 20 13:48:15 2023 +0100 ice: fix invalid check for empty list in ice_sched_assoc_vsi_to_agg() The code implicitly assumes that the list iterator finds a correct handle. If 'vsi_handle' is not found the 'old_agg_vsi_info' was pointing to an bogus memory location. For safety a separate list iterator variable should be used to make the != NULL check on 'old_agg_vsi_info' correct under any circumstances. Additionally Linus proposed to avoid any use of the list iterator variable after the loop, in the attempt to move the list iterator variable declaration into the macro to avoid any potential misuse after the loop. Using it in a pointer comparison after the loop is undefined behavior and should be omitted if possible [1]. Fixes: 37c592062b16 ("ice: remove the VSI info from previous agg") Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Signed-off-by: Jakob Koschel Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 29486b6df3e6a63b57d1ed1dce06051267282ff4 Author: Junfeng Guo Date: Tue Mar 14 10:03:15 2023 +0800 ice: add profile conflict check for AVF FDIR Add profile conflict check while adding some FDIR rules to avoid unexpected flow behavior, rules may have conflict including: IPv4 <---> {IPv4_UDP, IPv4_TCP, IPv4_SCTP} IPv6 <---> {IPv6_UDP, IPv6_TCP, IPv6_SCTP} For example, when we create an FDIR rule for IPv4, this rule will work on packets including IPv4, IPv4_UDP, IPv4_TCP and IPv4_SCTP. But if we then create an FDIR rule for IPv4_UDP and then destroy it, the first FDIR rule for IPv4 cannot work on pkt IPv4_UDP then. To prevent this unexpected behavior, we add restriction in software when creating FDIR rules by adding necessary profile conflict check. Fixes: 1f7ea1cd6a37 ("ice: Enable FDIR Configure for AVF") Signed-off-by: Junfeng Guo Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit d94dbdc4e0209b5e7d736ab696f8d635b034e3ee Author: Brett Creeley Date: Mon Mar 13 13:36:08 2023 -0700 ice: Fix ice_cfg_rdma_fltr() to only update relevant fields The current implementation causes ice_vsi_update() to update all VSI fields based on the cached VSI context. This also assumes that the ICE_AQ_VSI_PROP_Q_OPT_VALID bit is set. This can cause problems if the VSI context is not correctly synced by the driver. Fix this by only updating the fields that correspond to ICE_AQ_VSI_PROP_Q_OPT_VALID. Also, make sure to save the updated result in the cached VSI context on success. Fixes: 348048e724a0 ("ice: Implement iidc operations") Co-developed-by: Robert Malz Signed-off-by: Robert Malz Signed-off-by: Brett Creeley Signed-off-by: Jesse Brandeburg Reviewed-by: Piotr Raczynski Tested-by: Jakub Andrysiak Signed-off-by: Tony Nguyen commit 66ceaa4c4507f2b598d37b528796dd34158d31bf Author: Jesse Brandeburg Date: Mon Mar 13 13:36:07 2023 -0700 ice: fix W=1 headers mismatch make modules W=1 returns: .../ice/ice_txrx_lib.c:448: warning: Function parameter or member 'first_idx' not described in 'ice_finalize_xdp_rx' .../ice/ice_txrx.c:948: warning: Function parameter or member 'ntc' not described in 'ice_get_rx_buf' .../ice/ice_txrx.c:1038: warning: Excess function parameter 'rx_buf' description in 'ice_construct_skb' Fix these warnings by adding and deleting the deviant arguments. Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Fixes: d7956d81f150 ("ice: Pull out next_to_clean bump out of ice_put_rx_buf()") CC: Maciej Fijalkowski Signed-off-by: Jesse Brandeburg Reviewed-by: Piotr Raczynski Signed-off-by: Tony Nguyen commit f91bf3272a18356e8585f6bbba896d794632f2af Author: Marek Szyprowski Date: Thu Mar 16 00:25:14 2023 +0100 iommu/exynos: Fix set_platform_dma_ops() callback There are some subtle differences between release_device() and set_platform_dma_ops() callbacks, so separate those two callbacks. Device links should be removed only in release_device(), because they were created in probe_device() on purpose and they are needed for proper Exynos IOMMU driver operation. While fixing this, remove the conditional code as it is not really needed. Reported-by: Jason Gunthorpe Fixes: 189d496b48b1 ("iommu/exynos: Add missing set_platform_dma_ops callback") Signed-off-by: Marek Szyprowski Reviewed-by: Sam Protsenko Link: https://lore.kernel.org/r/20230315232514.1046589-1-m.szyprowski@samsung.com Signed-off-by: Joerg Roedel commit b26cd9325be4c1fcd331b77f10acb627c560d4d7 Author: Kornel Dulęba Date: Mon Mar 20 09:32:59 2023 +0000 pinctrl: amd: Disable and mask interrupts on resume This fixes a similar problem to the one observed in: commit 4e5a04be88fe ("pinctrl: amd: disable and mask interrupts on probe"). On some systems, during suspend/resume cycle firmware leaves an interrupt enabled on a pin that is not used by the kernel. This confuses the AMD pinctrl driver and causes spurious interrupts. The driver already has logic to detect if a pin is used by the kernel. Leverage it to re-initialize interrupt fields of a pin only if it's not used by us. Cc: stable@vger.kernel.org Fixes: dbad75dd1f25 ("pinctrl: add AMD GPIO driver support.") Signed-off-by: Kornel Dulęba Link: https://lore.kernel.org/r/20230320093259.845178-1-korneld@chromium.org Signed-off-by: Linus Walleij commit 005308f7bdacf5685ed1a431244a183dbbb9e0e8 Author: Jens Axboe Date: Mon Mar 27 19:56:18 2023 -0600 io_uring/poll: clear single/double poll flags on poll arming Unless we have at least one entry queued, then don't call into io_poll_remove_entries(). Normally this isn't possible, but if we retry poll then we can have ->nr_entries cleared again as we're setting it up. If this happens for a poll retry, then we'll still have at least REQ_F_SINGLE_POLL set. io_poll_remove_entries() then thinks it has entries to remove. Clear REQ_F_SINGLE_POLL and REQ_F_DOUBLE_POLL unconditionally when arming a poll request. Fixes: c16bda37594f ("io_uring/poll: allow some retries for poll triggering spuriously") Cc: stable@vger.kernel.org Reported-by: Pengfei Xu Signed-off-by: Jens Axboe commit 917fd7d6cdda179fdced2ebb060a9cda517d76e0 Merge: f22c993f31fa9 8fb8ebf948778 Author: Paolo Abeni Date: Tue Mar 28 14:16:42 2023 +0200 Merge branch 'xen-netback-fix-issue-introduced-recently' Juergen Gross says: ==================== xen/netback: fix issue introduced recently The fix for XSA-423 introduced a bug which resulted in loss of network connection in some configurations. The first patch is fixing the issue, while the second one is removing a test which isn't needed. ==================== Link: https://lore.kernel.org/r/20230327083646.18690-1-jgross@suse.com Signed-off-by: Paolo Abeni commit 8fb8ebf9487785184846d04e915bfe327bf4ccd5 Author: Juergen Gross Date: Mon Mar 27 10:36:46 2023 +0200 xen/netback: remove not needed test in xenvif_tx_build_gops() The tests for the number of grant mapping or copy operations reaching the array size of the operations buffer at the end of the main loop in xenvif_tx_build_gops() isn't needed. The loop can handle at maximum MAX_PENDING_REQS transfer requests, as XEN_RING_NR_UNCONSUMED_REQUESTS() is taking unsent responses into consideration, too. Remove the tests. Suggested-by: Jan Beulich Signed-off-by: Juergen Gross Reviewed-by: Paul Durrant Signed-off-by: Paolo Abeni commit 05310f31ca74673a96567fb14637b7d5d6c82ea5 Author: Juergen Gross Date: Mon Mar 27 10:36:45 2023 +0200 xen/netback: don't do grant copy across page boundary Fix xenvif_get_requests() not to do grant copy operations across local page boundaries. This requires to double the maximum number of copy operations per queue, as each copy could now be split into 2. Make sure that struct xenvif_tx_cb doesn't grow too large. Cc: stable@vger.kernel.org Fixes: ad7f402ae4f4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area") Signed-off-by: Juergen Gross Reviewed-by: Paul Durrant Signed-off-by: Paolo Abeni commit 38518593ec55e897abda4b4be77b2ec8ec4447d1 Author: Tanu Malhotra Date: Mon Mar 27 11:58:38 2023 -0700 HID: intel-ish-hid: Fix kernel panic during warm reset During warm reset device->fw_client is set to NULL. If a bus driver is registered after this NULL setting and before new firmware clients are enumerated by ISHTP, kernel panic will result in the function ishtp_cl_bus_match(). This is because of reference to device->fw_client->props.protocol_name. ISH firmware after getting successfully loaded, sends a warm reset notification to remove all clients from the bus and sets device->fw_client to NULL. Until kernel v5.15, all enabled ISHTP kernel module drivers were loaded right after any of the first ISHTP device was registered, regardless of whether it was a matched or an unmatched device. This resulted in all drivers getting registered much before the warm reset notification from ISH. Starting kernel v5.16, this issue got exposed after the change was introduced to load only bus drivers for the respective matching devices. In this scenario, cros_ec_ishtp device and cros_ec_ishtp driver are registered after the warm reset device fw_client NULL setting. cros_ec_ishtp driver_register() triggers the callback to ishtp_cl_bus_match() to match ISHTP driver to the device and causes kernel panic in guid_equal() when dereferencing fw_client NULL pointer to get protocol_name. Fixes: f155dfeaa4ee ("platform/x86: isthp_eclite: only load for matching devices") Fixes: facfe0a4fdce ("platform/chrome: chros_ec_ishtp: only load for matching devices") Fixes: 0d0cccc0fd83 ("HID: intel-ish-hid: hid-client: only load for matching devices") Fixes: 44e2a58cb880 ("HID: intel-ish-hid: fw-loader: only load for matching devices") Cc: # 5.16+ Signed-off-by: Tanu Malhotra Tested-by: Shaunak Saha Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit f22c993f31fa9615df46e49cd768b713d39a852f Author: Wolfram Sang Date: Mon Mar 27 10:31:38 2023 +0200 smsc911x: avoid PHY being resumed when interface is not up SMSC911x doesn't need mdiobus suspend/resume, that's why it sets 'mac_managed_pm'. However, setting it needs to be moved from init to probe, so mdiobus PM functions will really never be called (e.g. when the interface is not up yet during suspend/resume). Fixes: 3ce9f2bef755 ("net: smsc911x: Stop and start PHY during suspend and resume") Suggested-by: Heiner Kallweit Signed-off-by: Wolfram Sang Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230327083138.6044-1-wsa+renesas@sang-engineering.com Signed-off-by: Paolo Abeni commit 4bffd2c7a3fc165fc70bc69211b8e6436f41a5c3 Merge: 4dd52392b5d75 363c7dc72f79e Author: Greg Kroah-Hartman Date: Tue Mar 28 13:30:55 2023 +0200 Merge tag 'iio-fixes-for-6.3a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: 1st set of IIO fixes for 6.3 Usual mixed bag: - core - output buffers Fix return of bytes written when only some succeed. Fix O_NONBLOCK handling to not block. - adi,ad7791 Fix IRQ type. Not confirmed to have any impact but good to correct it anyway - adi,adis16400 Missing CONFIG_CRC32 - capella,cm32181 Unregister 2nd I2C client if one is used. - cio-dac Fix bitdepth for range check on write. - linear,ltc2497 Fix a wrong shift of the LSB introduced when switching to be24 handling. - maxim,max11410 Fix handling of return code in read_poll_timeout() - qcom,spmi-adc Fix an accidental change of channel name to include the reg value from OF. - ti,palmas Fix a null dereference on remove due to wrong function used to get the drvdata. - ti,ads7950 Mark GPIO as can sleep. * tag 'iio-fixes-for-6.3a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip iio: adc: palmas_gpadc: fix NULL dereference on rmmod iio: adc: max11410: fix read_poll_timeout() usage iio: dac: cio-dac: Fix max DAC write value check for 12-bit iio: light: cm32181: Unregister second I2C client if present iio: accel: kionix-kx022a: Get the timestamp from the driver's private data in the trigger_handler iio: adc: ad7791: fix IRQ flags iio: buffer: make sure O_NONBLOCK is respected iio: buffer: correctly return bytes written in output buffers iio: light: vcnl4000: Fix WARN_ON on uninitialized lock iio: adis16480: select CONFIG_CRC32 drivers: iio: adc: ltc2497: fix LSB shift iio: adc: qcom-spmi-adc5: Fix the channel name commit fd7276189450110ed835eb0a334e62d2f1c4e3be Author: Jens Axboe Date: Sun Mar 26 16:15:57 2023 -0600 powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which from my (arguably very short) checking is not commonly done for other archs. This is fine, except when PF_IO_WORKER's have been created and the task does something that causes a coredump to be generated. Then we get this crash: Kernel attempted to read user page (160) - exploit attempt? (uid: 1000) BUG: Kernel NULL pointer dereference on read at 0x00000160 Faulting instruction address: 0xc0000000000c3a60 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88 Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0 REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+) MSR: 800000000280b033 CR: 88082828 XER: 200400f8 ... NIP memcpy_power7+0x200/0x7d0 LR ppr_get+0x64/0xb0 Call Trace: ppr_get+0x40/0xb0 (unreliable) __regset_get+0x180/0x1f0 regset_get_alloc+0x64/0x90 elf_core_dump+0xb98/0x1b60 do_coredump+0x1c34/0x24a0 get_signal+0x71c/0x1410 do_notify_resume+0x140/0x6f0 interrupt_exit_user_prepare_main+0x29c/0x320 interrupt_exit_user_prepare+0x6c/0xa0 interrupt_return_srr_user+0x8/0x138 Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL pt_regs. Check for a valid pt_regs in both ppc_get/ppr_set, and return an error if not set. The actual error value doesn't seem to be important here, so just pick -EINVAL. Fixes: fa439810cc1b ("powerpc/ptrace: Enable support for NT_PPPC_TAR, NT_PPC_PPR, NT_PPC_DSCR") Cc: stable@vger.kernel.org # v4.8+ Signed-off-by: Jens Axboe [mpe: Trim oops in change log, add Fixes & Cc stable] Signed-off-by: Michael Ellerman Link: https://msgid.link/d9f63344-fe7c-56ae-b420-4a1a04a2ae4c@kernel.dk commit 1abce0580b89464546ae06abd5891ebec43c9470 Author: Benjamin Gray Date: Fri Mar 3 09:59:47 2023 +1100 powerpc/64s: Fix __pte_needs_flush() false positive warning Userspace PROT_NONE ptes set _PAGE_PRIVILEGED, triggering a false positive debug assertion that __pte_flags_need_flush() is not called on a kernel mapping. Detect when it is a userspace PROT_NONE page by checking the required bits of PAGE_NONE are set, and none of the RWX bits are set. pte_protnone() is insufficient here because it always returns 0 when CONFIG_NUMA_BALANCING=n. Fixes: b11931e9adc1 ("powerpc/64s: add pte_needs_flush and huge_pmd_needs_flush") Cc: stable@vger.kernel.org # v6.1+ Reported-by: Russell Currey Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230302225947.81083-1-bgray@linux.ibm.com commit b4c66d755e6d5620920168c15eb75f53394a952c Merge: ebd3b826343bb 031a416c21708 Author: Paolo Abeni Date: Tue Mar 28 11:34:11 2023 +0200 Merge branch 'net-mvpp2-rss-fixes' Sven Auhagen says: ==================== net: mvpp2: rss fixes This patch series fixes up some rss problems in the mvpp2 driver. The classifier is missing some fragmentation flags, the parser has the QinQ headers switched and the PPPoE Layer 4 detecion is not working correctly. This is leading to no or bad rss for the default settings. ==================== Link: https://lore.kernel.org/r/20230325163903.ofefgus43x66as7i@Svens-MacBookPro.local Signed-off-by: Paolo Abeni commit 031a416c2170866be5132ae42e14453d669b0cb1 Author: Sven Auhagen Date: Sat Mar 25 17:41:05 2023 +0100 net: mvpp2: parser fix PPPoE In PPPoE add all IPv4 header option length to the parser and adjust the L3 and L4 offset accordingly. Currently the L4 match does not work with PPPoE and all packets are matched as L3 IP4 OPT. Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") Signed-off-by: Sven Auhagen Signed-off-by: Paolo Abeni commit a587a84813b90372cb0a7565e201a4075da67919 Author: Sven Auhagen Date: Sat Mar 25 17:40:53 2023 +0100 net: mvpp2: parser fix QinQ The mvpp2 parser entry for QinQ has the inner and outer VLAN in the wrong order. Fix the problem by swapping them. Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit") Signed-off-by: Sven Auhagen Reviewed-by: Marcin Wojtas Signed-off-by: Paolo Abeni commit 9a251cae51d57289908222e6c322ca61fccc25fd Author: Sven Auhagen Date: Sat Mar 25 17:40:29 2023 +0100 net: mvpp2: classifier flow fix fragmentation flags Add missing IP Fragmentation Flag. Fixes: f9358e12a0af ("net: mvpp2: split ingress traffic into multiple flows") Signed-off-by: Sven Auhagen Reviewed-by: Marcin Wojtas Signed-off-by: Paolo Abeni commit a6f6a95f25803500079513780d11a911ce551d76 Author: George Guo Date: Tue Mar 28 15:13:35 2023 +0800 LoongArch, bpf: Fix jit to skip speculation barrier opcode Just skip the opcode(BPF_ST | BPF_NOSPEC) in the BPF JIT instead of failing to JIT the entire program, given LoongArch currently has no couterpart of a speculation barrier instruction. To verify the issue, use the ltp testcase as shown below. Also, Wang says: I can confirm there's currently no speculation barrier equivalent on LonogArch. (Loongson says there are builtin mitigations for Spectre-V1 and V2 on their chips, and AFAIK efforts to port the exploits to mips/LoongArch have all failed a few years ago.) Without this patch: $ ./bpf_prog02 [...] bpf_common.c:123: TBROK: Failed verification: ??? (524) [...] Summary: passed 0 failed 0 broken 1 skipped 0 warnings 0 With this patch: $ ./bpf_prog02 [...] Summary: passed 0 failed 0 broken 0 skipped 0 warnings 0 Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: George Guo Signed-off-by: Daniel Borkmann Acked-by: WANG Xuerui Cc: Tiezhu Yang Link: https://lore.kernel.org/bpf/20230328071335.2664966-1-guodongtai@kylinos.cn commit 580031ff9952b7dbf48dedba6b56a100ae002bef Author: Martin KaFai Lau Date: Mon Mar 27 17:42:32 2023 -0700 bpf: tcp: Use sock_gen_put instead of sock_put in bpf_iter_tcp While reviewing the udp-iter batching patches, noticed the bpf_iter_tcp calling sock_put() is incorrect. It should call sock_gen_put instead because bpf_iter_tcp is iterating the ehash table which has the req sk and tw sk. This patch replaces all sock_put with sock_gen_put in the bpf_iter_tcp codepath. Fixes: 04c7820b776f ("bpf: tcp: Bpf iter batching and lock_sock") Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230328004232.2134233-1-martin.lau@linux.dev commit 21f27df854008b86349a203bf97fef79bb11f53e Author: Nico Boehr Date: Mon Feb 13 09:55:20 2023 +0100 KVM: s390: pv: fix external interruption loop not always detected To determine whether the guest has caused an external interruption loop upon code 20 (external interrupt) intercepts, the ext_new_psw needs to be inspected to see whether external interrupts are enabled. Under non-PV, ext_new_psw can simply be taken from guest lowcore. Under PV, KVM can only access the encrypted guest lowcore and hence the ext_new_psw must not be taken from guest lowcore. handle_external_interrupt() incorrectly did that and hence was not able to reliably tell whether an external interruption loop is happening or not. False negatives cause spurious failures of my kvm-unit-test for extint loops[1] under PV. Since code 20 is only caused under PV if and only if the guest's ext_new_psw is enabled for external interrupts, false positive detection of a external interruption loop can not happen. Fix this issue by instead looking at the guest PSW in the state description. Since the PSW swap for external interrupt is done by the ultravisor before the intercept is caused, this reliably tells whether the guest is enabled for external interrupts in the ext_new_psw. Also update the comments to explain better what is happening. [1] https://lore.kernel.org/kvm/20220812062151.1980937-4-nrb@linux.ibm.com/ Signed-off-by: Nico Boehr Reviewed-by: Janosch Frank Reviewed-by: Christian Borntraeger Fixes: 201ae986ead7 ("KVM: s390: protvirt: Implement interrupt injection") Link: https://lore.kernel.org/r/20230213085520.100756-2-nrb@linux.ibm.com Message-Id: <20230213085520.100756-2-nrb@linux.ibm.com> Signed-off-by: Janosch Frank commit ebd3b826343bb4a7a280aad68a113bbf044add1d Merge: 4f7702ab6fc3c 2b4c99f7d9a57 Author: Jakub Kicinski Date: Mon Mar 27 19:47:42 2023 -0700 Merge tag 'linux-can-fixes-for-6.3-20230327' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2023-03-27 Oleksij Rempel and Hillf Danton contribute a patch for the CAN J1939 protocol that prevents a potential deadlock in j1939_sk_errqueue(). Ivan Orlov fixes an uninit-value in the CAN BCM protocol in the bcm_tx_setup() function. * tag 'linux-can-fixes-for-6.3-20230327' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write can: j1939: prevent deadlock by moving j1939_sk_errqueue() ==================== Link: https://lore.kernel.org/r/20230327124807.1157134-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 4f7702ab6fc3c03cc10b0cf0bdbd0433146483e0 Author: Lukas Bulwahn Date: Fri Mar 24 09:16:13 2023 +0100 MAINTAINERS: remove the linux-nfc@lists.01.org list Some MAINTAINERS sections mention to mail patches to the list linux-nfc@lists.01.org. Probably due to changes on Intel's 01.org website and servers, the list server lists.01.org/ml01.01.org is simply gone. Considering emails recorded on lore.kernel.org, only a handful of emails where sent to the linux-nfc@lists.01.org list, and they are usually also sent to the netdev mailing list as well, where they are then picked up. So, there is no big benefit in restoring the linux-nfc elsewhere. Remove all occurrences of the linux-nfc@lists.01.org list in MAINTAINERS. Suggested-by: Krzysztof Kozlowski Link: https://lore.kernel.org/all/CAKXUXMzggxQ43DUZZRkPMGdo5WkzgA=i14ySJUFw4kZfE5ZaZA@mail.gmail.com/ Signed-off-by: Lukas Bulwahn Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230324081613.32000-1-lukas.bulwahn@gmail.com Signed-off-by: Jakub Kicinski commit ac9bba3ff1ef18ef0038eb7a590f93529eb566de Author: Sean Anderson Date: Thu Mar 23 10:59:57 2023 -0400 net: fman: Add myself as a reviewer I've read through or reworked a good portion of this driver. Add myself as a reviewer. Signed-off-by: Sean Anderson Reviewed-by: Simon Horman Acked-by: Madalin Bucur Link: https://lore.kernel.org/r/20230323145957.2999211-1-sean.anderson@seco.com Signed-off-by: Jakub Kicinski commit 1231363aec86704a6b0467a12e3ca7bdf890e01d Author: Juraj Pecigos Date: Sun Mar 26 11:29:49 2023 +0200 nvme-pci: mark Lexar NM760 as IGNORE_DEV_SUBNQN A system with more than one of these SSDs will only have one usable. The kernel fails to detect more than one nvme device due to duplicate cntlids. before: [ 9.395229] nvme 0000:01:00.0: platform quirk: setting simple suspend [ 9.395262] nvme nvme0: pci function 0000:01:00.0 [ 9.395282] nvme 0000:03:00.0: platform quirk: setting simple suspend [ 9.395305] nvme nvme1: pci function 0000:03:00.0 [ 9.409873] nvme nvme0: Duplicate cntlid 1 with nvme1, subsys nqn.2022-07.com.siliconmotion:nvm-subsystem-sn- , rejecting [ 9.409982] nvme nvme0: Removing after probe failure status: -22 [ 9.427487] nvme nvme1: allocated 64 MiB host memory buffer. [ 9.445088] nvme nvme1: 16/0/0 default/read/poll queues [ 9.449898] nvme nvme1: Ignoring bogus Namespace Identifiers after: [ 1.161890] nvme 0000:01:00.0: platform quirk: setting simple suspend [ 1.162660] nvme nvme0: pci function 0000:01:00.0 [ 1.162684] nvme 0000:03:00.0: platform quirk: setting simple suspend [ 1.162707] nvme nvme1: pci function 0000:03:00.0 [ 1.191354] nvme nvme0: allocated 64 MiB host memory buffer. [ 1.193378] nvme nvme1: allocated 64 MiB host memory buffer. [ 1.211044] nvme nvme1: 16/0/0 default/read/poll queues [ 1.211080] nvme nvme0: 16/0/0 default/read/poll queues [ 1.216145] nvme nvme0: Ignoring bogus Namespace Identifiers [ 1.216261] nvme nvme1: Ignoring bogus Namespace Identifiers Adding the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk to resolves the issue. Signed-off-by: Juraj Pecigos Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 44378cd113e5f15bb0a89f5ac5a0e687b52feb90 Author: Duy Nguyen Date: Tue Mar 28 00:03:03 2023 +0000 ASoC: da7213.c: add missing pm_runtime_disable() da7213.c is missing pm_runtime_disable(), thus we will get below error when rmmod -> insmod. $ rmmod snd-soc-da7213.ko $ insmod snd-soc-da7213.ko da7213 0-001a: Unbalanced pm_runtime_enable!" [Kuninori adjusted to latest upstream] Signed-off-by: Duy Nguyen Signed-off-by: Kuninori Morimoto Tested-by: Khanh Le Link: https://lore.kernel.org/r/87mt3xg2tk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c Author: Filipe Manana Date: Wed Mar 22 09:46:34 2023 +0000 btrfs: fix deadlock when aborting transaction during relocation with scrub Before relocating a block group we pause scrub, then do the relocation and then unpause scrub. The relocation process requires starting and committing a transaction, and if we have a failure in the critical section of the transaction commit path (transaction state >= TRANS_STATE_COMMIT_START), we will deadlock if there is a paused scrub. That results in stack traces like the following: [42.479] BTRFS info (device sdc): relocating block group 53876686848 flags metadata|raid6 [42.936] BTRFS warning (device sdc): Skipping commit of aborted transaction. [42.936] ------------[ cut here ]------------ [42.936] BTRFS: Transaction aborted (error -28) [42.936] WARNING: CPU: 11 PID: 346822 at fs/btrfs/transaction.c:1977 btrfs_commit_transaction+0xcc8/0xeb0 [btrfs] [42.936] Modules linked in: dm_flakey dm_mod loop btrfs (...) [42.936] CPU: 11 PID: 346822 Comm: btrfs Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [42.936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [42.936] RIP: 0010:btrfs_commit_transaction+0xcc8/0xeb0 [btrfs] [42.936] Code: ff ff 45 8b (...) [42.936] RSP: 0018:ffffb58649633b48 EFLAGS: 00010282 [42.936] RAX: 0000000000000000 RBX: ffff8be6ef4d5bd8 RCX: 0000000000000000 [42.936] RDX: 0000000000000002 RSI: ffffffffb35e7782 RDI: 00000000ffffffff [42.936] RBP: ffff8be6ef4d5c98 R08: 0000000000000000 R09: ffffb586496339e8 [42.936] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8be6d38c7c00 [42.936] R13: 00000000ffffffe4 R14: ffff8be6c268c000 R15: ffff8be6ef4d5cf0 [42.936] FS: 00007f381a82b340(0000) GS:ffff8beddfcc0000(0000) knlGS:0000000000000000 [42.936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [42.936] CR2: 00007f1e35fb7638 CR3: 0000000117680006 CR4: 0000000000370ee0 [42.936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [42.936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [42.936] Call Trace: [42.936] [42.936] ? start_transaction+0xcb/0x610 [btrfs] [42.936] prepare_to_relocate+0x111/0x1a0 [btrfs] [42.936] relocate_block_group+0x57/0x5d0 [btrfs] [42.936] ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs] [42.936] btrfs_relocate_block_group+0x248/0x3c0 [btrfs] [42.936] ? __pfx_autoremove_wake_function+0x10/0x10 [42.936] btrfs_relocate_chunk+0x3b/0x150 [btrfs] [42.936] btrfs_balance+0x8ff/0x11d0 [btrfs] [42.936] ? __kmem_cache_alloc_node+0x14a/0x410 [42.936] btrfs_ioctl+0x2334/0x32c0 [btrfs] [42.937] ? mod_objcg_state+0xd2/0x360 [42.937] ? refill_obj_stock+0xb0/0x160 [42.937] ? seq_release+0x25/0x30 [42.937] ? __rseq_handle_notify_resume+0x3b5/0x4b0 [42.937] ? percpu_counter_add_batch+0x2e/0xa0 [42.937] ? __x64_sys_ioctl+0x88/0xc0 [42.937] __x64_sys_ioctl+0x88/0xc0 [42.937] do_syscall_64+0x38/0x90 [42.937] entry_SYSCALL_64_after_hwframe+0x72/0xdc [42.937] RIP: 0033:0x7f381a6ffe9b [42.937] Code: 00 48 89 44 24 (...) [42.937] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [42.937] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b [42.937] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003 [42.937] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000 [42.937] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423 [42.937] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148 [42.937] [42.937] ---[ end trace 0000000000000000 ]--- [42.937] BTRFS: error (device sdc: state A) in cleanup_transaction:1977: errno=-28 No space left [59.196] INFO: task btrfs:346772 blocked for more than 120 seconds. [59.196] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [59.196] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [59.196] task:btrfs state:D stack:0 pid:346772 ppid:1 flags:0x00004002 [59.196] Call Trace: [59.196] [59.196] __schedule+0x392/0xa70 [59.196] ? __pv_queued_spin_lock_slowpath+0x165/0x370 [59.196] schedule+0x5d/0xd0 [59.196] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] [59.197] ? __pfx_autoremove_wake_function+0x10/0x10 [59.197] scrub_pause_off+0x21/0x50 [btrfs] [59.197] scrub_simple_mirror+0x1c7/0x950 [btrfs] [59.197] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] [59.198] ? __pfx_autoremove_wake_function+0x10/0x10 [59.198] scrub_stripe+0x20d/0x740 [btrfs] [59.198] scrub_chunk+0xc4/0x130 [btrfs] [59.198] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] [59.198] ? __pfx_autoremove_wake_function+0x10/0x10 [59.198] btrfs_scrub_dev+0x236/0x6a0 [btrfs] [59.199] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] [59.199] ? _copy_from_user+0x7b/0x80 [59.199] btrfs_ioctl+0xde1/0x32c0 [btrfs] [59.199] ? refill_stock+0x33/0x50 [59.199] ? should_failslab+0xa/0x20 [59.199] ? kmem_cache_alloc_node+0x151/0x460 [59.199] ? alloc_io_context+0x1b/0x80 [59.199] ? preempt_count_add+0x70/0xa0 [59.199] ? __x64_sys_ioctl+0x88/0xc0 [59.199] __x64_sys_ioctl+0x88/0xc0 [59.199] do_syscall_64+0x38/0x90 [59.199] entry_SYSCALL_64_after_hwframe+0x72/0xdc [59.199] RIP: 0033:0x7f82ffaffe9b [59.199] RSP: 002b:00007f82ff9fcc50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [59.199] RAX: ffffffffffffffda RBX: 000055b191e36310 RCX: 00007f82ffaffe9b [59.199] RDX: 000055b191e36310 RSI: 00000000c400941b RDI: 0000000000000003 [59.199] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 [59.199] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82ff9fd640 [59.199] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 [59.199] [59.199] INFO: task btrfs:346773 blocked for more than 120 seconds. [59.200] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [59.200] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [59.201] task:btrfs state:D stack:0 pid:346773 ppid:1 flags:0x00004002 [59.201] Call Trace: [59.201] [59.201] __schedule+0x392/0xa70 [59.201] ? __pv_queued_spin_lock_slowpath+0x165/0x370 [59.201] schedule+0x5d/0xd0 [59.201] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] [59.201] ? __pfx_autoremove_wake_function+0x10/0x10 [59.201] scrub_pause_off+0x21/0x50 [btrfs] [59.202] scrub_simple_mirror+0x1c7/0x950 [btrfs] [59.202] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] [59.202] ? __pfx_autoremove_wake_function+0x10/0x10 [59.202] scrub_stripe+0x20d/0x740 [btrfs] [59.202] scrub_chunk+0xc4/0x130 [btrfs] [59.203] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] [59.203] ? __pfx_autoremove_wake_function+0x10/0x10 [59.203] btrfs_scrub_dev+0x236/0x6a0 [btrfs] [59.203] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] [59.203] ? _copy_from_user+0x7b/0x80 [59.203] btrfs_ioctl+0xde1/0x32c0 [btrfs] [59.204] ? should_failslab+0xa/0x20 [59.204] ? kmem_cache_alloc_node+0x151/0x460 [59.204] ? alloc_io_context+0x1b/0x80 [59.204] ? preempt_count_add+0x70/0xa0 [59.204] ? __x64_sys_ioctl+0x88/0xc0 [59.204] __x64_sys_ioctl+0x88/0xc0 [59.204] do_syscall_64+0x38/0x90 [59.204] entry_SYSCALL_64_after_hwframe+0x72/0xdc [59.204] RIP: 0033:0x7f82ffaffe9b [59.204] RSP: 002b:00007f82ff1fbc50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [59.204] RAX: ffffffffffffffda RBX: 000055b191e36790 RCX: 00007f82ffaffe9b [59.204] RDX: 000055b191e36790 RSI: 00000000c400941b RDI: 0000000000000003 [59.204] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 [59.204] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82ff1fc640 [59.204] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 [59.204] [59.204] INFO: task btrfs:346774 blocked for more than 120 seconds. [59.205] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [59.205] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [59.206] task:btrfs state:D stack:0 pid:346774 ppid:1 flags:0x00004002 [59.206] Call Trace: [59.206] [59.206] __schedule+0x392/0xa70 [59.206] schedule+0x5d/0xd0 [59.206] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] [59.206] ? __pfx_autoremove_wake_function+0x10/0x10 [59.206] scrub_pause_off+0x21/0x50 [btrfs] [59.207] scrub_simple_mirror+0x1c7/0x950 [btrfs] [59.207] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] [59.207] ? __pfx_autoremove_wake_function+0x10/0x10 [59.207] scrub_stripe+0x20d/0x740 [btrfs] [59.208] scrub_chunk+0xc4/0x130 [btrfs] [59.208] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] [59.208] ? __mutex_unlock_slowpath.isra.0+0x9a/0x120 [59.208] btrfs_scrub_dev+0x236/0x6a0 [btrfs] [59.208] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] [59.209] ? _copy_from_user+0x7b/0x80 [59.209] btrfs_ioctl+0xde1/0x32c0 [btrfs] [59.209] ? should_failslab+0xa/0x20 [59.209] ? kmem_cache_alloc_node+0x151/0x460 [59.209] ? alloc_io_context+0x1b/0x80 [59.209] ? preempt_count_add+0x70/0xa0 [59.209] ? __x64_sys_ioctl+0x88/0xc0 [59.209] __x64_sys_ioctl+0x88/0xc0 [59.209] do_syscall_64+0x38/0x90 [59.209] entry_SYSCALL_64_after_hwframe+0x72/0xdc [59.209] RIP: 0033:0x7f82ffaffe9b [59.209] RSP: 002b:00007f82fe9fac50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [59.209] RAX: ffffffffffffffda RBX: 000055b191e36c10 RCX: 00007f82ffaffe9b [59.209] RDX: 000055b191e36c10 RSI: 00000000c400941b RDI: 0000000000000003 [59.209] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 [59.209] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82fe9fb640 [59.209] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 [59.209] [59.209] INFO: task btrfs:346775 blocked for more than 120 seconds. [59.210] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [59.210] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [59.211] task:btrfs state:D stack:0 pid:346775 ppid:1 flags:0x00004002 [59.211] Call Trace: [59.211] [59.211] __schedule+0x392/0xa70 [59.211] schedule+0x5d/0xd0 [59.211] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] [59.211] ? __pfx_autoremove_wake_function+0x10/0x10 [59.211] scrub_pause_off+0x21/0x50 [btrfs] [59.212] scrub_simple_mirror+0x1c7/0x950 [btrfs] [59.212] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] [59.212] ? __pfx_autoremove_wake_function+0x10/0x10 [59.212] scrub_stripe+0x20d/0x740 [btrfs] [59.213] scrub_chunk+0xc4/0x130 [btrfs] [59.213] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] [59.213] ? __mutex_unlock_slowpath.isra.0+0x9a/0x120 [59.213] btrfs_scrub_dev+0x236/0x6a0 [btrfs] [59.213] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] [59.214] ? _copy_from_user+0x7b/0x80 [59.214] btrfs_ioctl+0xde1/0x32c0 [btrfs] [59.214] ? should_failslab+0xa/0x20 [59.214] ? kmem_cache_alloc_node+0x151/0x460 [59.214] ? alloc_io_context+0x1b/0x80 [59.214] ? preempt_count_add+0x70/0xa0 [59.214] ? __x64_sys_ioctl+0x88/0xc0 [59.214] __x64_sys_ioctl+0x88/0xc0 [59.214] do_syscall_64+0x38/0x90 [59.214] entry_SYSCALL_64_after_hwframe+0x72/0xdc [59.214] RIP: 0033:0x7f82ffaffe9b [59.214] RSP: 002b:00007f82fe1f9c50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [59.214] RAX: ffffffffffffffda RBX: 000055b191e37090 RCX: 00007f82ffaffe9b [59.214] RDX: 000055b191e37090 RSI: 00000000c400941b RDI: 0000000000000003 [59.214] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 [59.214] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82fe1fa640 [59.214] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 [59.214] [59.214] INFO: task btrfs:346776 blocked for more than 120 seconds. [59.215] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [59.216] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [59.217] task:btrfs state:D stack:0 pid:346776 ppid:1 flags:0x00004002 [59.217] Call Trace: [59.217] [59.217] __schedule+0x392/0xa70 [59.217] ? __pv_queued_spin_lock_slowpath+0x165/0x370 [59.217] schedule+0x5d/0xd0 [59.217] __scrub_blocked_if_needed+0x74/0xc0 [btrfs] [59.217] ? __pfx_autoremove_wake_function+0x10/0x10 [59.217] scrub_pause_off+0x21/0x50 [btrfs] [59.217] scrub_simple_mirror+0x1c7/0x950 [btrfs] [59.217] ? scrub_parity_put+0x1a5/0x1d0 [btrfs] [59.218] ? __pfx_autoremove_wake_function+0x10/0x10 [59.218] scrub_stripe+0x20d/0x740 [btrfs] [59.218] scrub_chunk+0xc4/0x130 [btrfs] [59.218] scrub_enumerate_chunks+0x3e4/0x7a0 [btrfs] [59.219] ? __pfx_autoremove_wake_function+0x10/0x10 [59.219] btrfs_scrub_dev+0x236/0x6a0 [btrfs] [59.219] ? btrfs_ioctl+0xd97/0x32c0 [btrfs] [59.219] ? _copy_from_user+0x7b/0x80 [59.219] btrfs_ioctl+0xde1/0x32c0 [btrfs] [59.219] ? should_failslab+0xa/0x20 [59.219] ? kmem_cache_alloc_node+0x151/0x460 [59.219] ? alloc_io_context+0x1b/0x80 [59.219] ? preempt_count_add+0x70/0xa0 [59.219] ? __x64_sys_ioctl+0x88/0xc0 [59.219] __x64_sys_ioctl+0x88/0xc0 [59.219] do_syscall_64+0x38/0x90 [59.219] entry_SYSCALL_64_after_hwframe+0x72/0xdc [59.219] RIP: 0033:0x7f82ffaffe9b [59.219] RSP: 002b:00007f82fd9f8c50 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [59.219] RAX: ffffffffffffffda RBX: 000055b191e37510 RCX: 00007f82ffaffe9b [59.219] RDX: 000055b191e37510 RSI: 00000000c400941b RDI: 0000000000000003 [59.219] RBP: 0000000000000000 R08: 00007fff1575016f R09: 0000000000000000 [59.219] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f82fd9f9640 [59.219] R13: 000000000000006b R14: 00007f82ffa87580 R15: 0000000000000000 [59.219] [59.219] INFO: task btrfs:346822 blocked for more than 120 seconds. [59.220] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1 [59.221] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [59.222] task:btrfs state:D stack:0 pid:346822 ppid:1 flags:0x00004002 [59.222] Call Trace: [59.222] [59.222] __schedule+0x392/0xa70 [59.222] schedule+0x5d/0xd0 [59.222] btrfs_scrub_cancel+0x91/0x100 [btrfs] [59.222] ? __pfx_autoremove_wake_function+0x10/0x10 [59.222] btrfs_commit_transaction+0x572/0xeb0 [btrfs] [59.223] ? start_transaction+0xcb/0x610 [btrfs] [59.223] prepare_to_relocate+0x111/0x1a0 [btrfs] [59.223] relocate_block_group+0x57/0x5d0 [btrfs] [59.223] ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs] [59.223] btrfs_relocate_block_group+0x248/0x3c0 [btrfs] [59.224] ? __pfx_autoremove_wake_function+0x10/0x10 [59.224] btrfs_relocate_chunk+0x3b/0x150 [btrfs] [59.224] btrfs_balance+0x8ff/0x11d0 [btrfs] [59.224] ? __kmem_cache_alloc_node+0x14a/0x410 [59.224] btrfs_ioctl+0x2334/0x32c0 [btrfs] [59.225] ? mod_objcg_state+0xd2/0x360 [59.225] ? refill_obj_stock+0xb0/0x160 [59.225] ? seq_release+0x25/0x30 [59.225] ? __rseq_handle_notify_resume+0x3b5/0x4b0 [59.225] ? percpu_counter_add_batch+0x2e/0xa0 [59.225] ? __x64_sys_ioctl+0x88/0xc0 [59.225] __x64_sys_ioctl+0x88/0xc0 [59.225] do_syscall_64+0x38/0x90 [59.225] entry_SYSCALL_64_after_hwframe+0x72/0xdc [59.225] RIP: 0033:0x7f381a6ffe9b [59.225] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [59.225] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b [59.225] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003 [59.225] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000 [59.225] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423 [59.225] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148 [59.225] What happens is the following: 1) A scrub is running, so fs_info->scrubs_running is 1; 2) Task A starts block group relocation, and at btrfs_relocate_chunk() it pauses scrub by calling btrfs_scrub_pause(). That increments fs_info->scrub_pause_req from 0 to 1 and waits for the scrub task to pause (for fs_info->scrubs_paused to be == to fs_info->scrubs_running); 3) The scrub task pauses at scrub_pause_off(), waiting for fs_info->scrub_pause_req to decrease to 0; 4) Task A then enters btrfs_relocate_block_group(), and down that call chain we start a transaction and then attempt to commit it; 5) When task A calls btrfs_commit_transaction(), it either will do the commit itself or wait for some other task that already started the commit of the transaction - it doesn't matter which case; 6) The transaction commit enters state TRANS_STATE_COMMIT_START; 7) An error happens during the transaction commit, like -ENOSPC when running delayed refs or delayed items for example; 8) This results in calling transaction.c:cleanup_transaction(), where we call btrfs_scrub_cancel(), incrementing fs_info->scrub_cancel_req from 0 to 1, and blocking this task waiting for fs_info->scrubs_running to decrease to 0; 9) From this point on, both the transaction commit and the scrub task hang forever: 1) The transaction commit is waiting for fs_info->scrubs_running to be decreased to 0; 2) The scrub task is at scrub_pause_off() waiting for fs_info->scrub_pause_req to decrease to 0 - so it can not proceed to stop the scrub and decrement fs_info->scrubs_running from 0 to 1. Therefore resulting in a deadlock. Fix this by having cleanup_transaction(), called if a transaction commit fails, not call btrfs_scrub_cancel() if relocation is in progress, and having btrfs_relocate_block_group() call btrfs_scrub_cancel() instead if the relocation failed and a transaction abort happened. This was triggered with btrfs/061 from fstests. Fixes: 55e3a601c81c ("btrfs: Fix data checksum error cause by replace with io-load.") CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 50d281fc434cb8e2497f5e70a309ccca6b1a09f0 Author: Anand Jain Date: Thu Mar 23 15:56:48 2023 +0800 btrfs: scan device in non-exclusive mode This fixes mkfs/mount/check failures due to race with systemd-udevd scan. During the device scan initiated by systemd-udevd, other user space EXCL operations such as mkfs, mount, or check may get blocked and result in a "Device or resource busy" error. This is because the device scan process opens the device with the EXCL flag in the kernel. Two reports were received: - btrfs/179 test case, where the fsck command failed with the -EBUSY error - LTP pwritev03 test case, where mkfs.vfs failed with the -EBUSY error, when mkfs.vfs tried to overwrite old btrfs filesystem on the device. In both cases, fsck and mkfs (respectively) were racing with a systemd-udevd device scan, and systemd-udevd won, resulting in the -EBUSY error for fsck and mkfs. Reproducing the problem has been difficult because there is a very small window during which these userspace threads can race to acquire the exclusive device open. Even on the system where the problem was observed, the problem occurrences were anywhere between 10 to 400 iterations and chances of reproducing decreases with debug printk()s. However, an exclusive device open is unnecessary for the scan process, as there are no write operations on the device during scan. Furthermore, during the mount process, the superblock is re-read in the below function call chain: btrfs_mount_root btrfs_open_devices open_fs_devices btrfs_open_one_device btrfs_get_bdev_and_sb So, to fix this issue, removes the FMODE_EXCL flag from the scan operation, and add a comment. The case where mkfs may still write to the device and a scan is running, the btrfs signature is not written at that time so scan will not recognize such device. Reported-by: Sherry Yang Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202303170839.fdf23068-oliver.sang@intel.com CC: stable@vger.kernel.org # 5.4+ Signed-off-by: Anand Jain Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2f1a6be12ab6c8470d5776e68644726c94257c54 Author: Filipe Manana Date: Wed Mar 22 10:33:28 2023 +0000 btrfs: fix race between quota disable and quota assign ioctls The quota assign ioctl can currently run in parallel with a quota disable ioctl call. The assign ioctl uses the quota root, while the disable ioctl frees that root, and therefore we can have a use-after-free triggered in the assign ioctl, leading to a trace like the following when KASAN is enabled: [672.723][T736] BUG: KASAN: slab-use-after-free in btrfs_search_slot+0x2962/0x2db0 [672.723][T736] Read of size 8 at addr ffff888022ec0208 by task btrfs_search_sl/27736 [672.724][T736] [672.725][T736] CPU: 1 PID: 27736 Comm: btrfs_search_sl Not tainted 6.3.0-rc3 #37 [672.723][T736] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [672.727][T736] Call Trace: [672.728][T736] [672.728][T736] dump_stack_lvl+0xd9/0x150 [672.725][T736] print_report+0xc1/0x5e0 [672.720][T736] ? __virt_addr_valid+0x61/0x2e0 [672.727][T736] ? __phys_addr+0xc9/0x150 [672.725][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.722][T736] kasan_report+0xc0/0xf0 [672.729][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.724][T736] btrfs_search_slot+0x2962/0x2db0 [672.723][T736] ? fs_reclaim_acquire+0xba/0x160 [672.722][T736] ? split_leaf+0x13d0/0x13d0 [672.726][T736] ? rcu_is_watching+0x12/0xb0 [672.723][T736] ? kmem_cache_alloc+0x338/0x3c0 [672.722][T736] update_qgroup_status_item+0xf7/0x320 [672.724][T736] ? add_qgroup_rb+0x3d0/0x3d0 [672.739][T736] ? do_raw_spin_lock+0x12d/0x2b0 [672.730][T736] ? spin_bug+0x1d0/0x1d0 [672.737][T736] btrfs_run_qgroups+0x5de/0x840 [672.730][T736] ? btrfs_qgroup_rescan_worker+0xa70/0xa70 [672.738][T736] ? __del_qgroup_relation+0x4ba/0xe00 [672.738][T736] btrfs_ioctl+0x3d58/0x5d80 [672.735][T736] ? tomoyo_path_number_perm+0x16a/0x550 [672.737][T736] ? tomoyo_execute_permission+0x4a0/0x4a0 [672.731][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.737][T736] ? __sanitizer_cov_trace_switch+0x54/0x90 [672.734][T736] ? do_vfs_ioctl+0x132/0x1660 [672.730][T736] ? vfs_fileattr_set+0xc40/0xc40 [672.730][T736] ? _raw_spin_unlock_irq+0x2e/0x50 [672.732][T736] ? sigprocmask+0xf2/0x340 [672.737][T736] ? __fget_files+0x26a/0x480 [672.732][T736] ? bpf_lsm_file_ioctl+0x9/0x10 [672.738][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.736][T736] __x64_sys_ioctl+0x198/0x210 [672.736][T736] do_syscall_64+0x39/0xb0 [672.731][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.739][T736] RIP: 0033:0x4556ad [672.742][T736] [672.743][T736] [672.748][T736] Allocated by task 27677: [672.743][T736] kasan_save_stack+0x22/0x40 [672.741][T736] kasan_set_track+0x25/0x30 [672.741][T736] __kasan_kmalloc+0xa4/0xb0 [672.749][T736] btrfs_alloc_root+0x48/0x90 [672.746][T736] btrfs_create_tree+0x146/0xa20 [672.744][T736] btrfs_quota_enable+0x461/0x1d20 [672.743][T736] btrfs_ioctl+0x4a1c/0x5d80 [672.747][T736] __x64_sys_ioctl+0x198/0x210 [672.749][T736] do_syscall_64+0x39/0xb0 [672.744][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.756][T736] [672.757][T736] Freed by task 27677: [672.759][T736] kasan_save_stack+0x22/0x40 [672.759][T736] kasan_set_track+0x25/0x30 [672.756][T736] kasan_save_free_info+0x2e/0x50 [672.751][T736] ____kasan_slab_free+0x162/0x1c0 [672.758][T736] slab_free_freelist_hook+0x89/0x1c0 [672.752][T736] __kmem_cache_free+0xaf/0x2e0 [672.752][T736] btrfs_put_root+0x1ff/0x2b0 [672.759][T736] btrfs_quota_disable+0x80a/0xbc0 [672.752][T736] btrfs_ioctl+0x3e5f/0x5d80 [672.756][T736] __x64_sys_ioctl+0x198/0x210 [672.753][T736] do_syscall_64+0x39/0xb0 [672.765][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.769][T736] [672.768][T736] The buggy address belongs to the object at ffff888022ec0000 [672.768][T736] which belongs to the cache kmalloc-4k of size 4096 [672.769][T736] The buggy address is located 520 bytes inside of [672.769][T736] freed 4096-byte region [ffff888022ec0000, ffff888022ec1000) [672.760][T736] [672.764][T736] The buggy address belongs to the physical page: [672.761][T736] page:ffffea00008bb000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22ec0 [672.766][T736] head:ffffea00008bb000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [672.779][T736] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [672.770][T736] raw: 00fff00000010200 ffff888012842140 ffffea000054ba00 dead000000000002 [672.770][T736] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [672.771][T736] page dumped because: kasan: bad access detected [672.778][T736] page_owner tracks the page as allocated [672.777][T736] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 88 [672.779][T736] get_page_from_freelist+0x119c/0x2d50 [672.779][T736] __alloc_pages+0x1cb/0x4a0 [672.776][T736] alloc_pages+0x1aa/0x270 [672.773][T736] allocate_slab+0x260/0x390 [672.771][T736] ___slab_alloc+0xa9a/0x13e0 [672.778][T736] __slab_alloc.constprop.0+0x56/0xb0 [672.771][T736] __kmem_cache_alloc_node+0x136/0x320 [672.789][T736] __kmalloc+0x4e/0x1a0 [672.783][T736] tomoyo_realpath_from_path+0xc3/0x600 [672.781][T736] tomoyo_path_perm+0x22f/0x420 [672.782][T736] tomoyo_path_unlink+0x92/0xd0 [672.780][T736] security_path_unlink+0xdb/0x150 [672.788][T736] do_unlinkat+0x377/0x680 [672.788][T736] __x64_sys_unlink+0xca/0x110 [672.789][T736] do_syscall_64+0x39/0xb0 [672.783][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.784][T736] page last free stack trace: [672.787][T736] free_pcp_prepare+0x4e5/0x920 [672.787][T736] free_unref_page+0x1d/0x4e0 [672.784][T736] __unfreeze_partials+0x17c/0x1a0 [672.797][T736] qlist_free_all+0x6a/0x180 [672.796][T736] kasan_quarantine_reduce+0x189/0x1d0 [672.797][T736] __kasan_slab_alloc+0x64/0x90 [672.793][T736] kmem_cache_alloc+0x17c/0x3c0 [672.799][T736] getname_flags.part.0+0x50/0x4e0 [672.799][T736] getname_flags+0x9e/0xe0 [672.792][T736] vfs_fstatat+0x77/0xb0 [672.791][T736] __do_sys_newlstat+0x84/0x100 [672.798][T736] do_syscall_64+0x39/0xb0 [672.796][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.790][T736] [672.791][T736] Memory state around the buggy address: [672.799][T736] ffff888022ec0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.805][T736] ffff888022ec0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.802][T736] >ffff888022ec0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ^ [672.809][T736] ffff888022ec0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ffff888022ec0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fix this by having the qgroup assign ioctl take the qgroup ioctl mutex before calling btrfs_run_qgroups(), which is what all qgroup ioctls should call. Reported-by: butt3rflyh4ck Link: https://lore.kernel.org/linux-btrfs/CAFcO6XN3VD8ogmHwqRk4kbiwtpUSNySu2VAxN8waEPciCHJvMA@mail.gmail.com/ CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit bb430b69422640891b0b8db762885730579a4145 Author: Alyssa Ross Date: Mon Mar 20 13:54:30 2023 +0100 loop: LOOP_CONFIGURE: send uevents for partitions LOOP_CONFIGURE is, as far as I understand it, supposed to be a way to combine LOOP_SET_FD and LOOP_SET_STATUS64 into a single syscall. When using LOOP_SET_FD+LOOP_SET_STATUS64, a single uevent would be sent for each partition found on the loop device after the second ioctl(), but when using LOOP_CONFIGURE, no such uevent was being sent. In the old setup, uevents are disabled for LOOP_SET_FD, but not for LOOP_SET_STATUS64. This makes sense, as it prevents uevents being sent for a partially configured device during LOOP_SET_FD - they're only sent at the end of LOOP_SET_STATUS64. But for LOOP_CONFIGURE, uevents were disabled for the entire operation, so that final notification was never issued. To fix this, reduce the critical section to exclude the loop_reread_partitions() call, which causes the uevents to be issued, to after uevents are re-enabled, matching the behaviour of the LOOP_SET_FD+LOOP_SET_STATUS64 combination. I noticed this because Busybox's losetup program recently changed from using LOOP_SET_FD+LOOP_SET_STATUS64 to LOOP_CONFIGURE, and this broke my setup, for which I want a notification from the kernel any time a new partition becomes available. Signed-off-by: Alyssa Ross [hch: reduced the critical section] Signed-off-by: Christoph Hellwig Fixes: 3448914e8cc5 ("loop: Add LOOP_CONFIGURE ioctl") Link: https://lore.kernel.org/r/20230320125430.55367-1-hch@lst.de Signed-off-by: Jens Axboe commit 3a93e40326c8f470e71d20b4c42d36767450f38f Merge: 91fe204578ba3 9e347ba03029e Author: Linus Torvalds Date: Mon Mar 27 12:22:45 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "RISC-V: - Fix VM hang in case of timer delta being zero ARM: - MMU fixes: - Read the MMU notifier seq before dropping the mmap lock to guard against reading a potentially stale VMA - Disable interrupts when walking user page tables to protect against the page table being freed - Read the MTE permissions for the VMA within the mmap lock critical section, avoiding the use of a potentally stale VMA pointer - vPMU fixes: - Return the sum of the current perf event value and PMC snapshot for reads from userspace - Don't save the value of guest writes to PMCR_EL0.{C,P}, which could otherwise lead to userspace erroneously resetting the vPMU during VM save/restore" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: riscv/kvm: Fix VM hang in case of timer delta being zero. KVM: arm64: Check for kvm_vma_mte_allowed in the critical section KVM: arm64: Disable interrupts while walking userspace PTs KVM: arm64: Retry fault if vma_lookup() results become invalid KVM: arm64: PMU: Don't save PMCR_EL0.{C,P} for the vCPU KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the current value commit c56610a869bce03490faf4f157076370c71b8ae3 Author: Rafael J. Wysocki Date: Fri Mar 24 14:33:42 2023 +0100 ACPI: bus: Rework system-level device notification handling For ACPI drivers that provide a ->notify() callback and set ACPI_DRIVER_ALL_NOTIFY_EVENTS in their flags, that callback can be invoked while either the ->add() or the ->remove() callback is running without any synchronization at the bus type level which is counter to the common-sense expectation that notification handling should only be enabled when the driver is actually bound to the device. As a result, if the driver is not careful enough, it's ->notify() callback may crash when it is invoked too early or too late [1]. This issue has been amplified by commit d6fb6ee1820c ("ACPI: bus: Drop driver member of struct acpi_device") that made acpi_bus_notify() check for the presence of the driver and its ->notify() callback directly instead of using an extra driver pointer that was only set and cleared by the bus type code, but it was present before that commit although it was harder to reproduce then. It can be addressed by using the observation that acpi_device_install_notify_handler() can be modified to install the handler for all types of events when ACPI_DRIVER_ALL_NOTIFY_EVENTS is set in the driver flags, in which case acpi_bus_notify() will not need to invoke the driver's ->notify() callback any more and that callback will only be invoked after acpi_device_install_notify_handler() has run and before acpi_device_remove_notify_handler() runs, which implies the correct ordering with respect to the other ACPI driver callbacks. Modify the code accordingly and while at it, drop two redundant local variables from acpi_bus_notify() and turn its description comment into a proper kerneldoc one. Fixes: d6fb6ee1820c ("ACPI: bus: Drop driver member of struct acpi_device") Link: https://lore.kernel.org/linux-acpi/9f6cba7a8a57e5a687c934e8e406e28c.squirrel@mail.panix.com # [1] Reported-by: Pierre Asselin Signed-off-by: Rafael J. Wysocki Tested-by: Pierre Asselin commit 91fe204578ba3183cc32984a613bd539b3670507 Merge: fc5d1a9233eef acd0acb802b90 Author: Linus Torvalds Date: Mon Mar 27 09:45:39 2023 -0700 Merge tag 'platform-drivers-x86-v6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: - Intel tpmi/vsec fixes - think-lmi fixes - two other small fixes / hw-id additions * tag 'platform-drivers-x86-v6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/surface: aggregator: Add missing fwnode_handle_put() platform/x86: think-lmi: Add possible_values for ThinkStation platform/x86: think-lmi: only display possible_values if available platform/x86: think-lmi: use correct possible_values delimiters platform/x86: think-lmi: add missing type attribute platform/x86 (gigabyte-wmi): Add support for A320M-S2H V2 platform/x86/intel: tpmi: Revise the comment of intel_vsec_add_aux platform/x86/intel: tpmi: Fix double free in tpmi_create_device() platform/x86/intel: vsec: Fix a memory leak in intel_vsec_add_aux commit fc5d1a9233eef4a3656712994e5bfa0c0470ebfc Merge: 197b6b60ae7bc e732e39ed9929 Author: Linus Torvalds Date: Mon Mar 27 09:41:17 2023 -0700 Merge tag 'mtd/fixes-for-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD fixes from Miquel Raynal: "Raw NAND controller driver fixes: - meson: - Invalidate cache on polling ECC bit - Initialize struct with zeroes - nandsim: Artificially prevent sequential page reads ECC engine driver fixes: - mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() when irq is used Binging fixes: - jedec,spi-nor: Document CPOL/CPHA support" * tag 'mtd/fixes-for-6.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: meson: invalidate cache on polling ECC bit mtd: rawnand: nandsim: Artificially prevent sequential page reads dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() when irq is used mtd: rawnand: meson: initialize struct with zeroes commit f9d323e7c1724270d747657051099826744e91e7 Author: Marc Gonzalez Date: Mon Mar 27 14:09:32 2023 +0200 perf/amlogic: adjust register offsets Commit "perf/amlogic: resolve conflict between canvas & pmu" changed the base address. Fixes: 2016e2113d35 ("perf/amlogic: Add support for Amlogic meson G12 SoC DDR PMU driver") Signed-off-by: Marc Gonzalez Acked-by: Will Deacon Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20230327120932.2158389-4-mgonzalez@freebox.fr Signed-off-by: Neil Armstrong commit f9bbf25e7b2b74b52b2f269216a92657774f239c Author: Heiko Carstens Date: Mon Mar 6 12:31:30 2023 +0100 s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling Return -EFAULT if put_user() for the PTRACE_GET_LAST_BREAK request fails, instead of silently ignoring it. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 7bb2107e63d8a4a13bbb6fe0e1cbd68784a2e9ac Author: Jiri Slaby (SUSE) Date: Thu Mar 16 12:28:09 2023 +0100 s390: reintroduce expoline dependence to scripts Expolines depend on scripts/basic/fixdep. And build of expolines can now race with the fixdep build: make[1]: *** Deleting file 'arch/s390/lib/expoline/expoline.o' /bin/sh: line 1: scripts/basic/fixdep: Permission denied make[1]: *** [../scripts/Makefile.build:385: arch/s390/lib/expoline/expoline.o] Error 126 make: *** [../arch/s390/Makefile:166: expoline_prepare] Error 2 The dependence was removed in the below Fixes: commit. So reintroduce the dependence on scripts. Fixes: a0b0987a7811 ("s390/nospec: remove unneeded header includes") Cc: Joe Lawrence Cc: stable@vger.kernel.org Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Cc: linux-s390@vger.kernel.org Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230316112809.7903-1-jirislaby@kernel.org Signed-off-by: Vasily Gorbik commit 8f8cf767589f2131ae5d40f3758429095c701c84 Author: Tony Krowiak Date: Mon Mar 20 11:04:47 2023 -0400 s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the pointer to the vfio_matrix_dev object in order to free its storage. The problem is, this object is not stored as drvdata with the device; since the kfree function will accept a NULL pointer, the memory for the vfio_matrix_dev object is never freed. Since the device being released is contained within the vfio_matrix_dev object, the container_of macro will be used to retrieve its pointer. Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver") Signed-off-by: Tony Krowiak Reviewed-by: Harald Freudenberger Link: https://lore.kernel.org/r/20230320150447.34557-1-akrowiak@linux.ibm.com Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 89aba4c26fae4e459f755a18912845c348ee48f3 Author: Heiko Carstens Date: Thu Mar 23 13:09:16 2023 +0100 s390/uaccess: add missing earlyclobber annotations to __clear_user() Add missing earlyclobber annotation to size, to, and tmp2 operands of the __clear_user() inline assembly since they are modified or written to before the last usage of all input operands. This can lead to incorrect register allocation for the inline assembly. Fixes: 6c2a9e6df604 ("[S390] Use alternative user-copy operations for new hardware.") Reported-by: Mark Rutland Link: https://lore.kernel.org/all/20230321122514.1743889-3-mark.rutland@arm.com/ Cc: stable@vger.kernel.org Reviewed-by: Gerald Schaefer Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit 80962ec912db56d323883154efc2297473e692cb Author: Sean Christopherson Date: Wed Mar 22 07:33:00 2023 -0700 KVM: nVMX: Do not report error code when synthesizing VM-Exit from Real Mode Don't report an error code to L1 when synthesizing a nested VM-Exit and L2 is in Real Mode. Per Intel's SDM, regarding the error code valid bit: This bit is always 0 if the VM exit occurred while the logical processor was in real-address mode (CR0.PE=0). The bug was introduced by a recent fix for AMD's Paged Real Mode, which moved the error code suppression from the common "queue exception" path to the "inject exception" path, but missed VMX's "synthesize VM-Exit" path. Fixes: b97f07458373 ("KVM: x86: determine if an exception has an error code only when injecting it.") Cc: stable@vger.kernel.org Cc: Maxim Levitsky Signed-off-by: Sean Christopherson Message-Id: <20230322143300.2209476-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 6c41468c7c12d74843bb414fc00307ea8a6318c3 Author: Sean Christopherson Date: Wed Mar 22 07:32:59 2023 -0700 KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection When injecting an exception into a vCPU in Real Mode, suppress the error code by clearing the flag that tracks whether the error code is valid, not by clearing the error code itself. The "typo" was introduced by recent fix for SVM's funky Paged Real Mode. Opportunistically hoist the logic above the tracepoint so that the trace is coherent with respect to what is actually injected (this was also the behavior prior to the buggy commit). Fixes: b97f07458373 ("KVM: x86: determine if an exception has an error code only when injecting it.") Cc: stable@vger.kernel.org Cc: Maxim Levitsky Signed-off-by: Sean Christopherson Message-Id: <20230322143300.2209476-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 33acea2049b5058b93d1dabb536b494f543f02a2 Author: Marc Gonzalez Date: Mon Mar 27 14:09:31 2023 +0200 arm64: dts: meson-g12-common: resolve conflict between canvas & pmu According to S905X2 Datasheet - Revision 07: DMC_MON area spans 0xff638080-0xff6380c0 DDR_PLL area spans 0xff638c00-0xff638c34 Round DDR_PLL area size up to 0x40 Fixes: 90cf8e21016fa3 ("arm64: dts: meson: Add DDR PMU node") Signed-off-by: Marc Gonzalez Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20230327120932.2158389-3-mgonzalez@freebox.fr Signed-off-by: Neil Armstrong commit 0dc902267cb32ade1c29eed8208e566ad743518a Author: Sean Christopherson Date: Wed Mar 22 07:12:20 2023 -0700 KVM: x86: Suppress pending MMIO write exits if emulator detects exception Clear vcpu->mmio_needed when injecting an exception from the emulator to squash a (legitimate) warning about vcpu->mmio_needed being true at the start of KVM_RUN without a callback being registered to complete the userspace MMIO exit. Suppressing the MMIO write exit is inarguably wrong from an architectural perspective, but it is the least awful hack-a-fix due to shortcomings in KVM's uAPI, not to mention that KVM already suppresses MMIO writes in this scenario. Outside of REP string instructions, KVM doesn't provide a way to resume an instruction at the exact point where it was "interrupted" if said instruction partially completed before encountering an MMIO access. For MMIO reads, KVM immediately exits to userspace upon detecting MMIO as userspace provides the to-be-read value in a buffer, and so KVM can safely (more or less) restart the instruction from the beginning. When the emulator re-encounters the MMIO read, KVM will service the MMIO by getting the value from the buffer instead of exiting to userspace, i.e. KVM won't put the vCPU into an infinite loop. On an emulated MMIO write, KVM finishes the instruction before exiting to userspace, as exiting immediately would ultimately hang the vCPU due to the aforementioned shortcoming of KVM not being able to resume emulation in the middle of an instruction. For the vast majority of _emulated_ instructions, deferring the userspace exit doesn't cause problems as very few x86 instructions (again ignoring string operations) generate multiple writes. But for instructions that generate multiple writes, e.g. PUSHA (multiple pushes onto the stack), deferring the exit effectively results in only the final write triggering an exit to userspace. KVM does support multiple MMIO "fragments", but only for page splits; if an instruction performs multiple distinct MMIO writes, the number of fragments gets reset when the next MMIO write comes along and any previous MMIO writes are dropped. Circling back to the warning, if a deferred MMIO write coincides with an exception, e.g. in this case a #SS due to PUSHA underflowing the stack after queueing a write to an MMIO page on a previous push, KVM injects the exceptions and leaves the deferred MMIO pending without registering a callback, thus triggering the splat. Sweep the problem under the proverbial rug as dropping MMIO writes is not unique to the exception scenario (see above), i.e. instructions like PUSHA are fundamentally broken with respect to MMIO, and have been since KVM's inception. Reported-by: zhangjianguo Reported-by: syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com Reported-by: syzbot+8accb43ddc6bd1f5713a@syzkaller.appspotmail.com Signed-off-by: Sean Christopherson Message-Id: <20230322141220.2206241-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit aec4353114a408b3a831a22ba34942d05943e462 Author: Marc Gonzalez Date: Mon Mar 27 14:09:30 2023 +0200 arm64: dts: meson-g12-common: specify full DMC range According to S905X2 Datasheet - Revision 07: DRAM Memory Controller (DMC) register area spans ff638000-ff63a000. According to DeviceTree Specification - Release v0.4-rc1: simple-bus nodes do not require reg property. Fixes: 1499218c80c99a ("arm64: dts: move common G12A & G12B modes to meson-g12-common.dtsi") Signed-off-by: Marc Gonzalez Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20230327120932.2158389-2-mgonzalez@freebox.fr Signed-off-by: Neil Armstrong commit fef8f2b90edbd7089a4278021314f11f056b0cbb Author: Dmytro Maluka Date: Wed Mar 22 21:43:44 2023 +0100 KVM: x86/ioapic: Resample the pending state of an IRQ when unmasking KVM irqfd based emulation of level-triggered interrupts doesn't work quite correctly in some cases, particularly in the case of interrupts that are handled in a Linux guest as oneshot interrupts (IRQF_ONESHOT). Such an interrupt is acked to the device in its threaded irq handler, i.e. later than it is acked to the interrupt controller (EOI at the end of hardirq), not earlier. Linux keeps such interrupt masked until its threaded handler finishes, to prevent the EOI from re-asserting an unacknowledged interrupt. However, with KVM + vfio (or whatever is listening on the resamplefd) we always notify resamplefd at the EOI, so vfio prematurely unmasks the host physical IRQ, thus a new physical interrupt is fired in the host. This extra interrupt in the host is not a problem per se. The problem is that it is unconditionally queued for injection into the guest, so the guest sees an extra bogus interrupt. [*] There are observed at least 2 user-visible issues caused by those extra erroneous interrupts for a oneshot irq in the guest: 1. System suspend aborted due to a pending wakeup interrupt from ChromeOS EC (drivers/platform/chrome/cros_ec.c). 2. Annoying "invalid report id data" errors from ELAN0000 touchpad (drivers/input/mouse/elan_i2c_core.c), flooding the guest dmesg every time the touchpad is touched. The core issue here is that by the time when the guest unmasks the IRQ, the physical IRQ line is no longer asserted (since the guest has acked the interrupt to the device in the meantime), yet we unconditionally inject the interrupt queued into the guest by the previous resampling. So to fix the issue, we need a way to detect that the IRQ is no longer pending, and cancel the queued interrupt in this case. With IOAPIC we are not able to probe the physical IRQ line state directly (at least not if the underlying physical interrupt controller is an IOAPIC too), so in this patch we use irqfd resampler for that. Namely, instead of injecting the queued interrupt, we just notify the resampler that this interrupt is done. If the IRQ line is actually already deasserted, we are done. If it is still asserted, a new interrupt will be shortly triggered through irqfd and injected into the guest. In the case if there is no irqfd resampler registered for this IRQ, we cannot fix the issue, so we keep the existing behavior: immediately unconditionally inject the queued interrupt. This patch fixes the issue for x86 IOAPIC only. In the long run, we can fix it for other irqchips and other architectures too, possibly taking advantage of reading the physical state of the IRQ line, which is possible with some other irqchips (e.g. with arm64 GIC, maybe even with the legacy x86 PIC). [*] In this description we assume that the interrupt is a physical host interrupt forwarded to the guest e.g. by vfio. Potentially the same issue may occur also with a purely virtual interrupt from an emulated device, e.g. if the guest handles this interrupt, again, as a oneshot interrupt. Signed-off-by: Dmytro Maluka Link: https://lore.kernel.org/kvm/31420943-8c5f-125c-a5ee-d2fde2700083@semihalf.com/ Link: https://lore.kernel.org/lkml/87o7wrug0w.wl-maz@kernel.org/ Message-Id: <20230322204344.50138-3-dmy@semihalf.com> Signed-off-by: Paolo Bonzini commit d583fbd7066a2dea43050521a95d9770f7d7593e Author: Dmytro Maluka Date: Wed Mar 22 21:43:43 2023 +0100 KVM: irqfd: Make resampler_list an RCU list It is useful to be able to do read-only traversal of the list of all the registered irqfd resamplers without locking the resampler_lock mutex. In particular, we are going to traverse it to search for a resampler registered for the given irq of an irqchip, and that will be done with an irqchip spinlock (ioapic->lock) held, so it is undesirable to lock a mutex in this context. So turn this list into an RCU list. For protecting the read side, reuse kvm->irq_srcu which is already used for protecting a number of irq related things (kvm->irq_routing, irqfd->resampler->list, kvm->irq_ack_notifier_list, kvm->arch.mask_notifier_list). Signed-off-by: Dmytro Maluka Message-Id: <20230322204344.50138-2-dmy@semihalf.com> Signed-off-by: Paolo Bonzini commit e5c972c1fadacc858b6a564d056f177275238040 Author: Jeremi Piotrowski Date: Fri Mar 24 15:52:33 2023 +0100 KVM: SVM: Flush Hyper-V TLB when required The Hyper-V "EnlightenedNptTlb" enlightenment is always enabled when KVM is running on top of Hyper-V and Hyper-V exposes support for it (which is always). On AMD CPUs this enlightenment results in ASID invalidations not flushing TLB entries derived from the NPT. To force the underlying (L0) hypervisor to rebuild its shadow page tables, an explicit hypercall is needed. The original KVM implementation of Hyper-V's "EnlightenedNptTlb" on SVM only added remote TLB flush hooks. This worked out fine for a while, as sufficient remote TLB flushes where being issued in KVM to mask the problem. Since v5.17, changes in the TDP code reduced the number of flushes and the out-of-sync TLB prevents guests from booting successfully. Split svm_flush_tlb_current() into separate callbacks for the 3 cases (guest/all/current), and issue the required Hyper-V hypercall when a Hyper-V TLB flush is needed. The most important case where the TLB flush was missing is when loading a new PGD, which is followed by what is now svm_flush_tlb_current(). Cc: stable@vger.kernel.org # v5.17+ Fixes: 1e0c7d40758b ("KVM: SVM: hyper-v: Remote TLB flush for SVM") Link: https://lore.kernel.org/lkml/43980946-7bbf-dcef-7e40-af904c456250@linux.microsoft.com/ Suggested-by: Sean Christopherson Signed-off-by: Jeremi Piotrowski Reviewed-by: Vitaly Kuznetsov Message-Id: <20230324145233.4585-1-jpiotrowski@linux.microsoft.com> Signed-off-by: Paolo Bonzini commit 9e347ba03029e10e6405f8c3a7a91a5597943ed9 Merge: 8607daa2145f2 6eff38048944c Author: Paolo Bonzini Date: Mon Mar 27 10:04:07 2023 -0400 Merge tag 'kvm-riscv-fixes-6.3-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.3, take #1 - Fix VM hang in case of timer delta being zero commit 8607daa2145f277c2548eee22e9fa45dfecd8dea Merge: f3e707413dbe3 8c2e8ac8ad4be Author: Paolo Bonzini Date: Mon Mar 27 10:03:16 2023 -0400 Merge tag 'kvmarm-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.3, part #2 Fixes for a rather interesting set of bugs relating to the MMU: - Read the MMU notifier seq before dropping the mmap lock to guard against reading a potentially stale VMA - Disable interrupts when walking user page tables to protect against the page table being freed - Read the MTE permissions for the VMA within the mmap lock critical section, avoiding the use of a potentally stale VMA pointer Additionally, some fixes targeting the vPMU: - Return the sum of the current perf event value and PMC snapshot for reads from userspace - Don't save the value of guest writes to PMCR_EL0.{C,P}, which could otherwise lead to userspace erroneously resetting the vPMU during VM save/restore commit 441d901fbf669f6360566a4437b1e563b854de4a Author: Thomas Weißschuh Date: Mon Mar 27 13:05:02 2023 +0000 platform/x86: gigabyte-wmi: add support for B650 AORUS ELITE AX This has been reported as working. Suggested-by: got3nks Link: https://github.com/t-8ch/linux-gigabyte-wmi-driver/issues/15#issuecomment-1483942966 Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20230327-gigabyte-wmi-b650-elite-ax-v1-1-d4d645c21d0b@weissschuh.net Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f Author: Ivan Orlov Date: Tue Mar 14 16:04:45 2023 +0400 can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write Syzkaller reported the following issue: ===================================================== BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 aio_rw_done fs/aio.c:1520 [inline] aio_write+0x899/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 kmalloc_array include/linux/slab.h:636 [inline] bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] sock_write_iter+0x495/0x5e0 net/socket.c:1108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 ===================================================== We can follow the call chain and find that 'bcm_tx_setup' function calls 'memcpy_from_msg' to copy some content to the newly allocated frame of 'op->frames'. After that the 'len' field of copied structure being compared with some constant value (64 or 8). However, if 'memcpy_from_msg' returns an error, we will compare some uninitialized memory. This triggers 'uninit-value' issue. This patch will add 'memcpy_from_msg' possible errors processing to avoid uninit-value issue. Tested via syzkaller Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089 Signed-off-by: Ivan Orlov Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames") Acked-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@gmail.com Signed-off-by: Marc Kleine-Budde commit fb5755100a0a5aa5957bdb204fd1e249684557fc Author: Rajvi Jingar Date: Mon Mar 20 14:20:29 2023 -0700 platform/x86/intel/pmc: Alder Lake PCH slp_s0_residency fix For platforms with Alder Lake PCH (Alder Lake S and Raptor Lake S) the slp_s0_residency attribute has been reporting the wrong value. Unlike other platforms, ADL PCH does not have a counter for the time that the SLP_S0 signal was asserted. Instead, firmware uses the aggregate of the Low Power Mode (LPM) substate counters as the S0ix value. Since the LPM counters run at a different frequency, this lead to misreporting of the S0ix time. Add a check for Alder Lake PCH and adjust the frequency accordingly when display slp_s0_residency. Fixes: bbab31101f44 ("platform/x86/intel: pmc/core: Add Alderlake support to pmc core driver") Signed-off-by: Rajvi Jingar Signed-off-by: David E. Box Reviewed-by: Rajneesh Bhardwaj Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230320212029.3154407-1-david.e.box@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 5c95b2d5d44fa250ce8aeee27bdb39b381d03857 Author: Chris Wilson Date: Thu Mar 23 15:58:51 2023 -0700 drm/i915/perf: Drop wakeref on GuC RC error If we fail to adjust the GuC run-control on opening the perf stream, make sure we unwind the wakeref just taken. v2: Retain old goto label names (Ashutosh) v3: Drop bitfield boolean Fixes: 01e742746785 ("drm/i915/guc: Support OA when Wa_16011777198 is enabled") Signed-off-by: Chris Wilson Reviewed-by: Ashutosh Dixit Signed-off-by: Umesh Nerlige Ramappa Link: https://patchwork.freedesktop.org/patch/msgid/20230323225901.3743681-2-umesh.nerlige.ramappa@intel.com (cherry picked from commit 2810ac6c753d17ee2572ffb57fe2382a786a080a) Signed-off-by: Jani Nikula commit 3413881e1ecc3cba722a2e87ec099692eed5be28 Author: Ville Syrjälä Date: Mon Mar 20 11:05:17 2023 +0200 drm/i915/dpt: Treat the DPT BO as a framebuffer Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem. That causes an immediate oops during hibernate as we try to rewrite the PTEs inside the already evicted DPT obj. TODO: presumably this might also be the reason for the DPT related display faults under heavy memory pressure, but I'm still not sure how that would happen as the object should be pinned by intel_dpt_pin() while in active use by the display engine... Cc: stable@vger.kernel.org Cc: Juha-Pekka Heikkila Cc: Matthew Auld Cc: Imre Deak Fixes: 0dc987b699ce ("drm/i915/display: Add smem fallback allocation for dpt") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230320090522.9909-2-ville.syrjala@linux.intel.com Reviewed-by: Juha-Pekka Heikkila (cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a) Signed-off-by: Jani Nikula commit d032ca43f2c80049ce5aabd3f208dc3849359497 Author: Chris Wilson Date: Thu Mar 16 17:59:18 2023 +0100 drm/i915/gem: Flush lmem contents after construction i915_gem_object_create_lmem_from_data() lacks the flush of the data written to lmem to ensure the object is marked as dirty and the writes flushed to the backing store. Once created, we can immediately release the obj->mm.mapping caching of the vmap. Fixes: 7acbbc7cf485 ("drm/i915/guc: put all guc objects in lmem when available") Cc: Matthew Auld Cc: Daniele Ceraolo Spurio Cc: Andi Shyti Cc: Matthew Brost Cc: John Harrison Signed-off-by: Chris Wilson Cc: # v5.16+ Signed-off-by: Nirmoy Das Reviewed-by: Andi Shyti Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20230316165918.13074-1-nirmoy.das@intel.com (cherry picked from commit e2ee10474ce766686e7a7496585cdfaf79e3a1bf) Signed-off-by: Jani Nikula commit 38c583019484f190d5b33f59b8ae810e6b1763c6 Author: Imre Deak Date: Thu Mar 16 15:17:13 2023 +0200 drm/i915/tc: Fix the ICL PHY ownership check in TC-cold state The commit renaming icl_tc_phy_is_in_safe_mode() to icl_tc_phy_take_ownership() didn't flip the function's return value accordingly, fix this up. This didn't cause an actual problem besides state check errors, since the function is only used during HW readout. Cc: José Roberto de Souza Fixes: f53979d68a77 ("drm/i915/display/tc: Rename safe_mode functions ownership") Reviewed-by: José Roberto de Souza Reviewed-by: Ville Syrjälä Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230316131724.359612-4-imre.deak@intel.com (cherry picked from commit f2c7959dda614d9b7c6a41510492de39d31705ec) Signed-off-by: Jani Nikula commit a2b6e99d8a623544f3bdccd28ee35b9c1b00daa5 Author: Ville Syrjälä Date: Mon Mar 20 20:35:32 2023 +0200 drm/i915: Disable DC states for all commits Keeping DC states enabled is incompatible with the _noarm()/_arm() split we use for writing pipe/plane registers. When DC5 and PSR are enabled, all pipe/plane registers effectively become self-arming on account of DC5 exit arming the update, and PSR exit latching it. What probably saves us most of the time is that (with PIPE_MISC[21]=0) all pipe register writes themselves trigger PSR exit, and then we don't re-enter PSR until the idle frame count has elapsed. So it may be that the PSR exit happens already before we've updated the state too much. Also the PSR1 panel (at least on this KBL) seems to discard the first frame we trasmit, presumably still scanning out from its internal framebuffer at that point. So only the second frame we transmit is actually visible. But I suppose that could also be panel specific behaviour. I haven't checked out how other PSR panels behave, nor did I bother to check what the eDP spec has to say about this. And since this really is all about DC states, let's switch from the MODESET domain to the DC_OFF domain. Functionally they are 100% identical. We should probably remove the MODESET domain... And for good measure let's toss in an assert to the place where we do the _noarm() register writes to make sure DC states are in fact off. v2: Just use intel_display_power_is_enabled() (Imre) Cc: #v5.17+ Cc: Manasi Navare Cc: Drew Davenport Cc: Jouni Högander Reviewed-by: Imre Deak Fixes: d13dde449580 ("drm/i915: Split pipe+output CSC programming to noarm+arm pair") Fixes: f8a005eb8972 ("drm/i915: Optimize icl+ universal plane programming") Fixes: 890b6ec4a522 ("drm/i915: Split skl+ plane update into noarm+arm pair") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230320183532.17727-1-ville.syrjala@linux.intel.com (cherry picked from commit 41b4c7fe72b6105a4b49395eea9aa40cef94288d) Signed-off-by: Jani Nikula commit 4d4e766f8b7dbdefa7a78e91eb9c7a29d0d818b8 Author: Ville Syrjälä Date: Mon Mar 20 11:54:36 2023 +0200 drm/i915: Workaround ICL CSC_MODE sticky arming Unlike SKL/GLK the ICL CSC unit suffers from a new issue where CSC_MODE arming is sticky. That is, once armed it remains armed causing the CSC coeff/offset registers to become effectively self-arming. CSC coeff/offset registers writes no longer disarm the CSC, but fortunately register read still do. So we can use that to disarm the CSC unit once the registers for the current frame have been latched. This avoid s the self-arming behaviour from persisting into the next frame's .color_commit_noarm() call. Cc: #v5.19+ Cc: Manasi Navare Cc: Drew Davenport Cc: Imre Deak Cc: Jouni Högander Fixes: d13dde449580 ("drm/i915: Split pipe+output CSC programming to noarm+arm pair") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-5-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak (cherry picked from commit 92736f1b452bbb8a66bdb5b1d263ad00e04dd3b8) Signed-off-by: Jani Nikula commit c880f855d1e240a956dcfce884269bad92fc849c Author: Ville Syrjälä Date: Mon Mar 20 11:54:35 2023 +0200 drm/i915: Add a .color_post_update() hook We're going to need stuff after the color management register latching has happened. Add a corresponding hook. Cc: #v5.19+ Cc: Manasi Navare Cc: Drew Davenport Cc: Imre Deak Cc: Jouni Högander Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-4-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak (cherry picked from commit 3962ca4e080a525fc9eae87aa6b2286f1fae351d) Signed-off-by: Jani Nikula commit a8e03e00b62073b494886dbff32f8b5338066c8b Author: Ville Syrjälä Date: Mon Mar 20 11:54:34 2023 +0200 drm/i915: Move CSC load back into .color_commit_arm() when PSR is enabled on skl/glk SKL/GLK CSC unit suffers from a nasty issue where a CSC coeff/offset register read or write between DC5 exit and PSR exit will undo the CSC arming performed by DMC, and then during PSR exit the hardware will latch zeroes into the active CSC registers. This causes any plane going through the CSC to output all black. We can sidestep the issue by making sure the PSR exit has already actually happened before we touch the CSC coeff/offset registers. Easiest way to guarantee that is to just move the CSC programming back into the .color_commir_arm() as we force a PSR exit (and crucially wait for it to actually happen) prior to touching the arming registers. When PSR (and thus also DC states) are disabled we don't have anything to worry about, so we can keep using the more optional _noarm() hook for writing the CSC registers. Cc: #v5.19+ Cc: Manasi Navare Cc: Drew Davenport Cc: Imre Deak Cc: Jouni Högander Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8283 Fixes: d13dde449580 ("drm/i915: Split pipe+output CSC programming to noarm+arm pair") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-3-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak (cherry picked from commit 80a892a4c2428b65366721599fc5fe50eaed35fd) Signed-off-by: Jani Nikula commit 76b767d4d1cd052e455cf18e06929e8b2b70101d Author: Ville Syrjälä Date: Mon Mar 20 11:54:33 2023 +0200 drm/i915: Split icl_color_commit_noarm() from skl_color_commit_noarm() We're going to want different behavior for skl/glk vs. icl in .color_commit_noarm(), so split the hook into two. Arguably we already had slightly different behaviour since csc_enable/gamma_enable are never set on icl+, so the old code was perhaps a bit confusing as well. Cc: #v5.19+ Cc: Manasi Navare Cc: Drew Davenport Cc: Imre Deak Cc: Jouni Högander Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230320095438.17328-2-ville.syrjala@linux.intel.com Reviewed-by: Imre Deak (cherry picked from commit f161eb01f50ab31f2084975b43bce54b7b671e17) Signed-off-by: Jani Nikula commit 12d4eb20d9d86fae5f84117ff047e966e470f7b9 Author: Ashutosh Dixit Date: Wed Mar 15 17:48:00 2023 -0700 drm/i915/pmu: Use functions common with sysfs to read actual freq Expose intel_rps_read_actual_frequency_fw to read the actual freq without taking forcewake for use by PMU. The code is refactored to use a common set of functions across sysfs and PMU. Using common functions with sysfs in PMU solves the issues of missing support for MTL and missing support for older generations (prior to Gen6). It also future proofs the PMU where sometimes code has been updated for sysfs and PMU has been missed. v2: Remove runtime_pm_if_in_use from read_actual_frequency_fw (Tvrtko) v3: (Tvrtko) - Remove goto in __read_cagf - Unexport intel_rps_get_cagf and intel_rps_read_punit_req Fixes: 22009b6dad66 ("drm/i915/mtl: Modify CAGF functions for MTL") Link: https://gitlab.freedesktop.org/drm/intel/-/issues/8280 Signed-off-by: Ashutosh Dixit Reviewed-by: Tvrtko Ursulin Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20230316004800.2539753-1-ashutosh.dixit@intel.com (cherry picked from commit 44df42e66139b5fac8db49ee354be279210f9816) Signed-off-by: Jani Nikula commit a7602e7332b97cfbec7bacb0f1ade99a575fe104 Author: Vladimir Oltean Date: Sat Mar 25 13:28:15 2023 +0200 net: stmmac: don't reject VLANs when IFF_PROMISC is set The blamed commit has introduced the following tests to dwmac4_add_hw_vlan_rx_fltr(), called from stmmac_vlan_rx_add_vid(): if (hw->promisc) { netdev_err(dev, "Adding VLAN in promisc mode not supported\n"); return -EPERM; } "VLAN promiscuous" mode is keyed in this driver to IFF_PROMISC, and so, vlan_vid_add() and vlan_vid_del() calls cannot take place in IFF_PROMISC mode. I have the following 2 arguments that this restriction is.... hm, how shall I put it nicely... unproductive :) First, take the case of a Linux bridge. If the kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y, then this bridge shall have a VLAN database. The bridge shall try to call vlan_add_vid() on its bridge ports for each VLAN in the VLAN table. It will do this irrespectively of whether that port is *currently* VLAN-aware or not. So it will do this even when the bridge was created with vlan_filtering 0. But the Linux bridge, in VLAN-unaware mode, configures its ports in promiscuous (IFF_PROMISC) mode, so that they accept packets with any MAC DA (a switch must do this in order to forward those packets which are not directly targeted to its MAC address). As a result, the stmmac driver does not work as a bridge port, when the kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y. $ ip link add br0 type bridge && ip link set br0 up $ ip link set eth0 master br0 && ip link set eth0 up [ 2333.943296] br0: port 1(eth0) entered blocking state [ 2333.943381] br0: port 1(eth0) entered disabled state [ 2333.943782] device eth0 entered promiscuous mode [ 2333.944080] 4033c000.ethernet eth0: Adding VLAN in promisc mode not supported [ 2333.976509] 4033c000.ethernet eth0: failed to initialize vlan filtering on this port RTNETLINK answers: Operation not permitted Secondly, take the case of stmmac as DSA master. Some switch tagging protocols are based on 802.1Q VLANs (tag_sja1105.c), and as such, tag_8021q.c uses vlan_vid_add() to work with VLAN-filtering DSA masters. But also, when a DSA port becomes promiscuous (for example when it joins a bridge), the DSA framework also makes the DSA master promiscuous. Moreover, for every VLAN that a DSA switch sends to the CPU, DSA also programs a VLAN filter on the DSA master, because if the the DSA switch uses a tail tag, then the hardware frame parser of the DSA master will see VLAN as VLAN, and might filter them out, for being unknown. Due to the above 2 reasons, my belief is that the stmmac driver does not get to choose to not accept vlan_vid_add() calls while IFF_PROMISC is enabled, because the 2 are completely independent and there are code paths in the network stack which directly lead to this situation occurring, without the user's direct input. In fact, my belief is that "VLAN promiscuous" mode should have never been keyed on IFF_PROMISC in the first place, but rather, on the NETIF_F_HW_VLAN_CTAG_FILTER feature flag which can be toggled by the user through ethtool -k, when present in netdev->hw_features. In the stmmac driver, NETIF_F_HW_VLAN_CTAG_FILTER is only present in "features", making this feature "on [fixed]". I have this belief because I am unaware of any definition of promiscuity which implies having an effect on anything other than MAC DA (therefore not VLAN). However, I seem to be rather alone in having this opinion, looking back at the disagreements from this discussion: https://lore.kernel.org/netdev/20201110153958.ci5ekor3o2ekg3ky@ipetronik.com/ In any case, to remove the vlan_vid_add() dependency on !IFF_PROMISC, one would need to remove the check and see what fails. I guess the test was there because of the way in which dwmac4_vlan_promisc_enable() is implemented. For context, the dwmac4 supports Perfect Filtering for a limited number of VLANs - dwmac4_get_num_vlan(), priv->hw->num_vlan, with a fallback on Hash Filtering - priv->dma_cap.vlhash - see stmmac_vlan_update(), also visible in cat /sys/kernel/debug/stmmaceth/eth0/dma_cap | grep 'VLAN Hash Filtering'. The perfect filtering is based on MAC_VLAN_Tag_Filter/MAC_VLAN_Tag_Data registers, accessed in the driver through dwmac4_write_vlan_filter(). The hash filtering is based on the MAC_VLAN_Hash_Table register, named GMAC_VLAN_HASH_TABLE in the driver and accessed by dwmac4_update_vlan_hash(). The control bit for enabling hash filtering is GMAC_VLAN_VTHM (MAC_VLAN_Tag_Ctrl bit VTHM: VLAN Tag Hash Table Match Enable). Now, the description of dwmac4_vlan_promisc_enable() is that it iterates through the driver's cache of perfect filter entries (hw->vlan_filter[i], added by dwmac4_add_hw_vlan_rx_fltr()), and evicts them from hardware by unsetting their GMAC_VLAN_TAG_DATA_VEN (MAC_VLAN_Tag_Data bit VEN - VLAN Tag Enable) bit. Then it unsets the GMAC_VLAN_VTHM bit, which disables hash matching. This leaves the MAC, according to table "VLAN Match Status" from the documentation, to always enter these data paths: VID |VLAN Perfect Filter |VTHM Bit |VLAN Hash Filter |Final VLAN Match |Match Result | |Match Result |Status -------|--------------------|---------|-----------------|---------------- VID!=0 |Fail |0 |don't care |Pass So, dwmac4_vlan_promisc_enable() does its job, but by unsetting GMAC_VLAN_VTHM, it conflicts with the other code path which controls this bit: dwmac4_update_vlan_hash(), called through stmmac_update_vlan_hash() from stmmac_vlan_rx_add_vid() and from stmmac_vlan_rx_kill_vid(). This is, I guess, why dwmac4_add_hw_vlan_rx_fltr() is not allowed to run after dwmac4_vlan_promisc_enable() has unset GMAC_VLAN_VTHM: because if it did, then dwmac4_update_vlan_hash() would set GMAC_VLAN_VTHM again, breaking the "VLAN promiscuity". It turns out that dwmac4_vlan_promisc_enable() is way too complicated for what needs to be done. The MAC_Packet_Filter register also has the VTFE bit (VLAN Tag Filter Enable), which simply controls whether VLAN tagged packets which don't match the filtering tables (either perfect or hash) are dropped or not. At the moment, this driver unconditionally sets GMAC_PACKET_FILTER_VTFE if NETIF_F_HW_VLAN_CTAG_FILTER was detected through the priv->dma_cap.vlhash capability bits of the device, in stmmac_dvr_probe(). I would suggest deleting the unnecessarily complex logic from dwmac4_vlan_promisc_enable(), and simply unsetting GMAC_PACKET_FILTER_VTFE when becoming IFF_PROMISC, which has the same effect of allowing packets with any VLAN tags, but has the additional benefit of being able to run concurrently with stmmac_vlan_rx_add_vid() and stmmac_vlan_rx_kill_vid(). As much as I believe that the VTFE bit should have been exclusively controlled by NETIF_F_HW_VLAN_CTAG_FILTER through ethtool, and not by IFF_PROMISC, changing that is not a punctual fix to the problem, and it would probably break the VFFQ feature added by the later commit e0f9956a3862 ("net: stmmac: Add option for VLAN filter fail queue enable"). From the commit description, VFFQ needs IFF_PROMISC=on and VTFE=off in order to work (and this change respects that). But if VTFE was changed to be controlled through ethtool -k, then a user-visible change would have been introduced in Intel's scripts (a need to run "ethtool -k eth0 rx-vlan-filter off" which did not exist before). The patch was tested with this set of commands: ip link set eth0 up ip link add link eth0 name eth0.100 type vlan id 100 ip addr add 192.168.100.2/24 dev eth0.100 && ip link set eth0.100 up ip link set eth0 promisc on ip link add link eth0 name eth0.101 type vlan id 101 ip addr add 192.168.101.2/24 dev eth0.101 && ip link set eth0.101 up ip link set eth0 promisc off ping -c 5 192.168.100.1 ping -c 5 192.168.101.1 ip link set eth0 promisc on ping -c 5 192.168.100.1 ping -c 5 192.168.101.1 ip link del eth0.100 ip link del eth0.101 # Wait for VLAN-tagged pings from the other end... # Check with "tcpdump -i eth0 -e -n -p" and we should see them ip link set eth0 promisc off # Wait for VLAN-tagged pings from the other end... # Check with "tcpdump -i eth0 -e -n -p" and we shouldn't see them # anymore, but remove the "-p" argument from tcpdump and they're there. Fixes: c89f44ff10fd ("net: stmmac: Add support for VLAN promiscuous mode") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit d1366b283d94ac4537a4b3a1e8668da4df7ce7e9 Author: Oleksij Rempel Date: Fri Mar 24 14:01:41 2023 +0100 can: j1939: prevent deadlock by moving j1939_sk_errqueue() This commit addresses a deadlock situation that can occur in certain scenarios, such as when running data TP/ETP transfer and subscribing to the error queue while receiving a net down event. The deadlock involves locks in the following order: 3 j1939_session_list_lock -> active_session_list_lock j1939_session_activate ... j1939_sk_queue_activate_next -> sk_session_queue_lock ... j1939_xtp_rx_eoma_one 2 j1939_sk_queue_drop_all -> sk_session_queue_lock ... j1939_sk_netdev_event_netdown -> j1939_socks_lock j1939_netdev_notify 1 j1939_sk_errqueue -> j1939_socks_lock __j1939_session_cancel -> active_session_list_lock j1939_tp_rxtimer CPU0 CPU1 ---- ---- lock(&priv->active_session_list_lock); lock(&jsk->sk_session_queue_lock); lock(&priv->active_session_list_lock); lock(&priv->j1939_socks_lock); The solution implemented in this commit is to move the j1939_sk_errqueue() call out of the active_session_list_lock context, thus preventing the deadlock situation. Reported-by: syzbot+ee1cd780f69483a8616b@syzkaller.appspotmail.com Fixes: 5b9272e93f2e ("can: j1939: extend UAPI to notify about RX status") Co-developed-by: Hillf Danton Signed-off-by: Hillf Danton Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/all/20230324130141.2132787-1-o.rempel@pengutronix.de Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 45977e58ce65ed0459edc9a0466d9dfea09463f5 Author: Álvaro Fernández Rojas Date: Thu Mar 23 20:48:41 2023 +0100 net: dsa: b53: mmap: add phy ops Implement phy_read16() and phy_write16() ops for B53 MMAP to avoid accessing B53_PORT_MII_PAGE registers which hangs the device. This access should be done through the MDIO Mux bus controller. Signed-off-by: Álvaro Fernández Rojas Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit f2e9d083f768ec147da3e3e5209030d3c090c689 Author: Oleksij Rempel Date: Fri Mar 24 14:39:08 2023 +0100 net: phy: micrel: correct KSZ9131RNX EEE capabilities and advertisement The KSZ9131RNX incorrectly shows EEE capabilities in its registers. Although the "EEE control and capability 1" (Register 3.20) is set to 0, indicating no EEE support, the "EEE advertisement 1" (Register 7.60) is set to 0x6, advertising EEE support for 1000BaseT/Full and 100BaseT/Full. This inconsistency causes PHYlib to assume there is no EEE support, preventing control over EEE advertisement, which is enabled by default. This patch resolves the issue by utilizing the ksz9477_get_features() function to correctly set the EEE capabilities for the KSZ9131RNX. This adjustment allows proper control over EEE advertisement and ensures accurate representation of the device's capabilities. Fixes: 8b68710a3121 ("net: phy: start using genphy_c45_ethtool_get/set_eee()") Reported-by: Marek Vasut Tested-by: Marek Vasut Signed-off-by: Oleksij Rempel Signed-off-by: David S. Miller commit b465518dc27da1ed74b8cbada4659708aac35adb Author: Stefano Garzarella Date: Fri Mar 24 12:54:50 2023 +0100 vsock/loopback: use only sk_buff_head.lock to protect the packet queue pkt_list_lock was used before commit 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") to protect the packet queue. After that commit we switched to sk_buff and we are using sk_buff_head.lock in almost every place to protect the packet queue except in vsock_loopback_work() when we call skb_queue_splice_init(). As reported by syzbot, this caused unlocked concurrent access to the packet queue between vsock_loopback_work() and vsock_loopback_cancel_pkt() since it is not holding pkt_list_lock. With the introduction of sk_buff_head, pkt_list_lock is redundant and can cause confusion, so let's remove it and use sk_buff_head.lock everywhere to protect the packet queue access. Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Cc: bobby.eshleman@bytedance.com Reported-and-tested-by: syzbot+befff0a9536049e7902e@syzkaller.appspotmail.com Signed-off-by: Stefano Garzarella Reviewed-by: Bobby Eshleman Reviewed-by: Arseniy Krasnov Signed-off-by: David S. Miller commit 622035847f5e8661be7c0b9d6222391ccd8022bc Merge: e3cbdcb0fbb61 4a0faa02d419a Author: David S. Miller Date: Mon Mar 27 08:12:01 2023 +0100 Merge branch 'constify-sfp-phy-nodes' Russell King says: ==================== Constify a few sfp/phy fwnodes This series constifies a bunch of fwnode_handle pointers that are only used to refer to but not modify the contents of the fwnode structures. ==================== Signed-off-by: David S. Miller commit 4a0faa02d419a6728abef0f1d8a32d8c35ef95e6 Author: Russell King (Oracle) Date: Fri Mar 24 09:23:53 2023 +0000 net: phy: constify fwnode_get_phy_node() fwnode argument fwnode_get_phy_node() does not motify the fwnode structure, so make the argument const, Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 850a8d2dc712abeea9a39b6cb53db6b78069ace0 Author: Russell King (Oracle) Date: Fri Mar 24 09:23:48 2023 +0000 net: sfp: constify sfp-bus internal fwnode uses Constify sfp-bus internal fwnode uses, since we do not modify the fwnode structures. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit a90ac762d345890b40d88a1385a34a2449c2d75e Author: Russell King (Oracle) Date: Fri Mar 24 09:23:42 2023 +0000 net: sfp: make sfp_bus_find_fwnode() take a const fwnode sfp_bus_find_fwnode() does not write to the fwnode, so let's make it const. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 Author: Faicker Mo Date: Fri Mar 24 17:19:54 2023 +0800 net/net_failover: fix txq exceeding warning The failover txq is inited as 16 queues. when a packet is transmitted from the failover device firstly, the failover device will select the queue which is returned from the primary device if the primary device is UP and running. If the primary device txq is bigger than the default 16, it can lead to the following warning: eth0 selects TX queue 18, but real number of TX queues is 16 The warning backtrace is: [ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 [ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 [ 32.147730] Call Trace: [ 32.147971] [ 32.148183] dump_stack_lvl+0x48/0x70 [ 32.148514] dump_stack+0x10/0x20 [ 32.148820] netdev_core_pick_tx+0xb1/0xe0 [ 32.149180] __dev_queue_xmit+0x529/0xcf0 [ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0 [ 32.149967] ip_finish_output2+0x278/0x560 [ 32.150327] __ip_finish_output+0x1fe/0x2f0 [ 32.150690] ip_finish_output+0x2a/0xd0 [ 32.151032] ip_output+0x7a/0x110 [ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 [ 32.151733] ip_local_out+0x5e/0x70 [ 32.152054] ip_send_skb+0x19/0x50 [ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 [ 32.152736] udp_sendmsg+0xba8/0xec0 [ 32.153060] ? __folio_memcg_unlock+0x25/0x60 [ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 32.153854] ? sock_has_perm+0x85/0xa0 [ 32.154190] inet_sendmsg+0x6d/0x80 [ 32.154508] ? inet_sendmsg+0x6d/0x80 [ 32.154838] sock_sendmsg+0x62/0x70 [ 32.155152] ____sys_sendmsg+0x134/0x290 [ 32.155499] ___sys_sendmsg+0x81/0xc0 [ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 [ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 [ 32.156649] ? get_random_u16+0x69/0xf0 [ 32.156989] ? __fget_light+0xcf/0x110 [ 32.157326] __sys_sendmmsg+0xc4/0x210 [ 32.157657] ? __sys_connect+0xb7/0xe0 [ 32.157995] ? __audit_syscall_entry+0xce/0x140 [ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 [ 32.158820] __x64_sys_sendmmsg+0x24/0x30 [ 32.159171] do_syscall_64+0x38/0x90 [ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc Fix that by reducing txq number as the non-existent primary-dev does. Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") Signed-off-by: Faicker Mo Signed-off-by: David S. Miller commit c355d913d21736c8a00a41cfacc19d2839063d89 Author: Alexander Stein Date: Mon Mar 27 10:06:00 2023 +0800 arm64: dts: imx8mp: fix address length for LCDIF2 0x238 is the offset for PANIC0_THRES, so the length needs to be greater than that. Use the size from memory map from reference manual. Fixes: 94e6197dadc9 ("arm64: dts: imx8mp: Add LCDIF2 & LDB nodes") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 Author: Christophe JAILLET Date: Sun Mar 26 10:29:33 2023 +0200 regulator: Handle deferred clk devm_clk_get() can return -EPROBE_DEFER. So it is better to return the error code from devm_clk_get(), instead of a hard coded -ENOENT. This gives more opportunities to successfully probe the driver. Fixes: 8959e5324485 ("regulator: fixed: add possibility to enable by clock") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/18459fae3d017a66313699c7c8456b28158b2dd0.1679819354.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit 707823e7f22f3864ddc7d85e8e9b614afe4f1b16 Author: Ivan Orlov Date: Sat Mar 11 16:50:25 2023 +0400 9P FS: Fix wild-memory-access write in v9fs_get_acl KASAN reported the following issue: [ 36.825817][ T5923] BUG: KASAN: wild-memory-access in v9fs_get_acl+0x1a4/0x390 [ 36.827479][ T5923] Write of size 4 at addr 9fffeb37f97f1c00 by task syz-executor798/5923 [ 36.829303][ T5923] [ 36.829846][ T5923] CPU: 0 PID: 5923 Comm: syz-executor798 Not tainted 6.2.0-syzkaller-18302-g596b6b709632 #0 [ 36.832110][ T5923] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 [ 36.834464][ T5923] Call trace: [ 36.835196][ T5923] dump_backtrace+0x1c8/0x1f4 [ 36.836229][ T5923] show_stack+0x2c/0x3c [ 36.837100][ T5923] dump_stack_lvl+0xd0/0x124 [ 36.838103][ T5923] print_report+0xe4/0x4c0 [ 36.839068][ T5923] kasan_report+0xd4/0x130 [ 36.840052][ T5923] kasan_check_range+0x264/0x2a4 [ 36.841199][ T5923] __kasan_check_write+0x2c/0x3c [ 36.842216][ T5923] v9fs_get_acl+0x1a4/0x390 [ 36.843232][ T5923] v9fs_mount+0x77c/0xa5c [ 36.844163][ T5923] legacy_get_tree+0xd4/0x16c [ 36.845173][ T5923] vfs_get_tree+0x90/0x274 [ 36.846137][ T5923] do_new_mount+0x25c/0x8c8 [ 36.847066][ T5923] path_mount+0x590/0xe58 [ 36.848147][ T5923] __arm64_sys_mount+0x45c/0x594 [ 36.849273][ T5923] invoke_syscall+0x98/0x2c0 [ 36.850421][ T5923] el0_svc_common+0x138/0x258 [ 36.851397][ T5923] do_el0_svc+0x64/0x198 [ 36.852398][ T5923] el0_svc+0x58/0x168 [ 36.853224][ T5923] el0t_64_sync_handler+0x84/0xf0 [ 36.854293][ T5923] el0t_64_sync+0x190/0x194 Calling '__v9fs_get_acl' method in 'v9fs_get_acl' creates the following chain of function calls: __v9fs_get_acl v9fs_fid_get_acl v9fs_fid_xattr_get p9_client_xattrwalk Function p9_client_xattrwalk accepts a pointer to u64-typed variable attr_size and puts some u64 value into it. However, after the executing the p9_client_xattrwalk, in some circumstances we assign the value of u64-typed variable 'attr_size' to the variable 'retval', which we will return. However, the type of 'retval' is ssize_t, and if the value of attr_size is larger than SSIZE_MAX, we will face the signed type overflow. If the overflow occurs, the result of v9fs_fid_xattr_get may be negative, but not classified as an error. When we try to allocate an acl with 'broken' size we receive an error, but don't process it. When we try to free this acl, we face the 'wild-memory-access' error (because it wasn't allocated). This patch will add new condition to the 'v9fs_fid_xattr_get' function, so it will return an EOVERFLOW error if the 'attr_size' is larger than SSIZE_MAX. In this version of the patch I simplified the condition. In previous (v2) version of the patch I removed explicit type conversion and added separate condition to check the possible overflow and return an error (in v1 version I've just modified the existing condition). Tested via syzkaller. Suggested-by: Christian Schoenebeck Reported-by: syzbot+cb1d16facb3cc90de5fb@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=fbbef66d9e4d096242f3617de5d14d12705b4659 Signed-off-by: Ivan Orlov Reviewed-by: Christian Schoenebeck Signed-off-by: Eric Van Hensbergen commit 8056dc043d7f74d7675d413cb3dc4fa290609922 Author: Krzysztof Kozlowski Date: Sun Mar 26 18:47:51 2023 +0200 riscv: dts: canaan: drop invalid spi-max-frequency The spi-max-frequency is a property of SPI children, not the controller: k210_generic.dtb: spi@50240000: Unevaluated properties are not allowed ('spi-max-frequency' was unexpected) Signed-off-by: Krzysztof Kozlowski Signed-off-by: Conor Dooley commit 197b6b60ae7bc51dd0814953c562833143b292aa Author: Linus Torvalds Date: Sun Mar 26 14:40:20 2023 -0700 Linux 6.3-rc4 commit 0ec57cfa721fbd36b4c4c0d9ccc5d78a78f7fa35 Merge: 18940c888c85f 5021383242ada Author: Linus Torvalds Date: Sun Mar 26 10:22:44 2023 -0700 Merge tag 'usb-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt driver fixes from Greg KH: "Here are a small set of USB and Thunderbolt driver fixes for reported problems and a documentation update, for 6.3-rc4. Included in here are: - documentation update for uvc gadget driver - small thunderbolt driver fixes - cdns3 driver fixes - dwc3 driver fixes - dwc2 driver fixes - chipidea driver fixes - typec driver fixes - onboard_usb_hub device id updates - quirk updates All of these have been in linux-next with no reported problems" * tag 'usb-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits) usb: dwc2: fix a race, don't power off/on phy for dual-role mode usb: dwc2: fix a devres leak in hw_enable upon suspend resume usb: chipidea: core: fix possible concurrent when switch role usb: chipdea: core: fix return -EINVAL if request role is the same with current role thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit thunderbolt: Disable interrupt auto clear for rings thunderbolt: Use const qualifier for `ring_interrupt_index` usb: gadget: Use correct endianness of the wLength field for WebUSB uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver usb: cdns3: Fix issue with using incorrect PCI device function usb: cdnsp: Fixes issue with redundant Status Stage MAINTAINERS: make me a reviewer of USB/IP thunderbolt: Use scale field when allocating USB3 bandwidth thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers thunderbolt: Call tb_check_quirks() after initializing adapters thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access thunderbolt: Fix memory leak in margining usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host" docs: usb: Add documentation for the UVC Gadget ... commit 18940c888c85fd7527375343bd4fcc94a540c69c Merge: 974fc94336df8 a53ce18cacb47 Author: Linus Torvalds Date: Sun Mar 26 09:18:30 2023 -0700 Merge tag 'sched_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Fix a corner case where vruntime of a task is not being sanitized * tag 'sched_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Sanitize vruntime of entity being migrated commit 974fc94336df81137b3b3502e73f89282a743607 Merge: f6cdaeb08b66d 263f5ecaf7080 Author: Linus Torvalds Date: Sun Mar 26 09:13:35 2023 -0700 Merge tag 'perf_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Properly clear perf event status tracking in the AMD perf event overflow handler * tag 'perf_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/amd/core: Always clear status for idx commit f6cdaeb08b66db0d06b1b70c0801a00b6f30571c Merge: 986c63741da24 b416514054810 Author: Linus Torvalds Date: Sun Mar 26 09:06:20 2023 -0700 Merge tag 'core_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fixes from Borislav Petkov: - Do the delayed RCU wakeup for kthreads in the proper order so that former doesn't get ignored - A noinstr warning fix * tag 'core_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up entry: Fix noinstr warning in __enter_from_user_mode() commit 986c63741da243c68e1faa97064a1bb216e8d7c0 Merge: 6485ac65af2b2 62faca1ca10cc Author: Linus Torvalds Date: Sun Mar 26 09:01:24 2023 -0700 Merge tag 'x86_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Add a AMX ptrace self test - Prevent a false-positive warning when retrieving the (invalid) address of dynamic FPU features in their init state which are not saved in init_fpstate at all - Randomize per-CPU entry areas only when KASLR is enabled * tag 'x86_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/x86/amx: Add a ptrace test x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() x86/mm: Do not shuffle CPU entry areas without KASLR commit 6485ac65af2b204e5150576d800c92d968c065b0 Merge: da8e7da11e4ba 491eafce1a51c Author: Linus Torvalds Date: Sun Mar 26 08:56:09 2023 -0700 Merge tag 'smb3-client-fixes-6.3-rc3' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Twelve cifs/smb3 client fixes (most also for stable) - forced umount fix - fix for two perf regressions - reconnect fixes - small debugging improvements - multichannel fixes" * tag 'smb3-client-fixes-6.3-rc3' of git://git.samba.org/sfrench/cifs-2.6: smb3: fix unusable share after force unmount failure cifs: fix dentry lookups in directory handle cache smb3: lower default deferred close timeout to address perf regression cifs: fix missing unload_nls() in smb2_reconnect() cifs: avoid race conditions with parallel reconnects cifs: append path to open_enter trace event cifs: print session id while listing open files cifs: dump pending mids for all channels in DebugData cifs: empty interface list when server doesn't support query interfaces cifs: do not poll server interfaces too regularly cifs: lock chan_lock outside match_session cifs: check only tcon status on tcon related functions commit da8e7da11e4ba758caf4c149cc8d8cd555aefe5f Merge: 5b9ff397a26ae 5f24a8725fe7b Author: Linus Torvalds Date: Sat Mar 25 13:32:43 2023 -0700 Merge tag 'nfsd-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix a crash when using NFS with krb5p * tag 'nfsd-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Fix a crash in gss_krb5_checksum() commit 5b9ff397a26aeb94180e0d459fda9731c3c617ba Merge: f768b35a2371c 4dfb02d5cae80 Author: Linus Torvalds Date: Sat Mar 25 13:12:36 2023 -0700 Merge tag 'xfs-6.3-fixes-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull yet more xfs bug fixes from Darrick Wong: "The first bugfix addresses a longstanding problem where we use the wrong file mapping cursors when trying to compute the speculative preallocation quantity. This has been causing sporadic crashes when alwayscow mode is engaged. The other two fixes correct minor problems in more recent changes. - Fix the new allocator tracepoints because git am mismerged the changes such that the trace_XXX got rebased to be in function YYY instead of XXX - Ensure that the perag AGFL_RESET state is consistent with whatever we've just read off the disk - Fix a bug where we used the wrong iext cursor during a write begin" * tag 'xfs-6.3-fixes-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix mismerged tracepoints xfs: clear incore AGFL_RESET state if it's not needed xfs: pass the correct cursor to xfs_iomap_prealloc_size commit f768b35a2371ccf85255f608444d234062a1b5c9 Merge: d704426300f2e e9b60c7f97130 Author: Linus Torvalds Date: Sat Mar 25 12:57:34 2023 -0700 Merge tag 'xfs-6.3-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs percpu counter fixes from Darrick Wong: "We discovered a filesystem summary counter corruption problem that was traced to cpu hot-remove racing with the call to percpu_counter_sum that sets the free block count in the superblock when writing it to disk. The root cause is that percpu_counter_sum doesn't cull from dying cpus and hence misses those counter values if the cpu shutdown hooks have not yet run to merge the values. I'm hoping this is a fairly painless fix to the problem, since the dying cpu mask should generally be empty. It's been in for-next for a week without any complaints from the bots. - Fix a race in the percpu counters summation code where the summation failed to add in the values for any CPUs that were dying but not yet dead. This fixes some minor discrepancies and incorrect assertions when running generic/650" * tag 'xfs-6.3-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: pcpcntr: remove percpu_counter_sum_all() fork: remove use of percpu_counter_sum_all pcpcntrs: fix dying cpu summation race cpumask: introduce for_each_cpu_or commit 2824861773eb512b37547516d81ef78108032cb2 Author: Tom Rix Date: Fri Mar 24 13:30:56 2023 -0400 ksmbd: remove unused is_char_allowed function clang with W=1 reports fs/ksmbd/unicode.c:122:19: error: unused function 'is_char_allowed' [-Werror,-Wunused-function] static inline int is_char_allowed(char *ch) ^ This function is not used so remove it. Signed-off-by: Tom Rix Reviewed-by: Sergey Senozhatsky Acked-by: Namjae Jeon Signed-off-by: Steve French commit e416ea62a9166e6075a07a970cc5bf79255d2700 Author: Marios Makassikis Date: Thu Mar 16 14:40:43 2023 +0100 ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN Commit 83dcedd5540d ("ksmbd: fix infinite loop in ksmbd_conn_handler_loop()"), changes GFP modifiers passed to kvmalloc(). This cause xfstests generic/551 test to fail. We limit pdu length size according to connection status and maximum number of connections. In the rest, memory allocation of request is limited by credit management. so these flags are no longer needed. Fixes: 83dcedd5540d ("ksmbd: fix infinite loop in ksmbd_conn_handler_loop()") Cc: stable@vger.kernel.org Signed-off-by: Marios Makassikis Acked-by: Namjae Jeon Signed-off-by: Steve French commit d704426300f2e95275267a387ffc3b8e5f4ae8b7 Merge: 4bdec23f971b1 3cfb9290da3d8 Author: Linus Torvalds Date: Sat Mar 25 12:51:25 2023 -0700 Merge tag 'xfs-6.3-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "This batch started with some debugging enhancements to the new allocator refactoring that we put in 6.3-rc1 to assist developers in rebasing their dev branches. As for more serious code changes -- there's a bug fix to make the lockless allocator scan the whole filesystem before resorting to the locking allocator. We're also adding a selftest for the venerable directory/xattr hash function to make sure that it produces consistent results so that we can address any fallout as soon as possible. - Add a few debugging assertions so that people (me) trying to port code to the new allocator functions don't mess up the caller requirements - Relax some overly cautious lock ordering enforcement in the new allocator code, which means that file allocations will locklessly scan for the best space they can get before backing off to the traditional lock-and-really-get-it behavior - Add tracepoints to make it easier to trace the xfs allocator behavior - Actually test the dir/xattr hash algorithm to make sure it produces consistent results across all the platforms XFS supports" * tag 'xfs-6.3-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: test dir/attr hash when loading module xfs: add tracepoints for each of the externally visible allocators xfs: walk all AGs if TRYLOCK passed to xfs_alloc_vextent_iterate_ags xfs: try to idiot-proof the allocators commit 4bdec23f971b1a5caf7a18ae117e44bdfaf26c93 Merge: 65aca32efdcb0 968b66ffeb795 Author: Linus Torvalds Date: Sat Mar 25 10:27:27 2023 -0700 Merge tag 'hwmon-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - it87: Fix voltage scaling for chips with 10.9mV ADCs - xgene: Fix ioremap and memremap leak - peci/cputemp: Fix miscalculated DTS temperature for SKX - hwmon core: fix potential sensor registration failure with thermal subsystem if of_node is missing * tag 'hwmon-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs hwmon: (xgene) Fix ioremap and memremap leak hwmon: fix potential sensor registration fail if of_node is missing hwmon: (peci/cputemp) Fix miscalculated DTS for SKX commit 33189f0a94b9639c058781fcf82e4ea3803b1682 Author: ChunHao Lin Date: Thu Mar 23 22:33:09 2023 +0800 r8169: fix RTL8168H and RTL8107E rx crc error When link speed is 10 Mbps and temperature is under -20°C, RTL8168H and RTL8107E may have rx crc error. Disable phy 10 Mbps pll off to fix this issue. Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") Signed-off-by: ChunHao Lin Reviewed-by: Heiner Kallweit Signed-off-by: David S. Miller commit 2d45e6e9f71b662fe3553dd1cf41d69d69ef6de1 Merge: f33642224e38d 9aa5757e1f71d Author: David S. Miller Date: Sat Mar 25 11:17:32 2023 +0000 Merge branch 'ksz-fixes' Oleksij Rempel says: ==================== net: dsa: microchip: ksz8: fixes for stable changes v2: - use proper Fixes tag - add Acked-by: Arun Ramadoss on all reviewed patches except the ksz8863_smi patch. These fixes address issues such as incomplete FDB extraction, incorrect FID extraction and configuration, incorrect timestamp extraction, and ghost entry extraction from an empty dynamic MAC table. These updates ensure proper functioning of the FDB/MDB functionality for the ksz8863/ksz8873 series of chips. ==================== Signed-off-by: David S. Miller commit 9aa5757e1f71d85facdc3c98028762cbab8d15c7 Author: Oleksij Rempel Date: Fri Mar 24 09:06:08 2023 +0100 net: dsa: microchip: ksz8: fix MDB configuration with non-zero VID FID is directly mapped to VID. However, configuring a MAC address with a VID != 0 resulted in incorrect configuration due to an incorrect bit mask. This kernel commit fixed the issue by correcting the bit mask and ensuring proper configuration of MAC addresses with non-zero VID. Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 392ff7a84cbca34118ca286dfbfe8aee24605897 Author: Oleksij Rempel Date: Fri Mar 24 09:06:07 2023 +0100 net: dsa: microchip: ksz8863_smi: fix bulk access Current regmap bulk access is broken, resulting to wrong reads/writes if ksz_read64/ksz_write64 functions are used. Mostly this issue was visible by using ksz8_fdb_dump(), which returned corrupt MAC address. The reason is that regmap was configured to have max_raw_read/write, even if ksz8863_mdio_read/write functions are able to handle unlimited read/write accesses. On ksz_read64 function we are using multiple 32bit accesses by incrementing each access by 1 instead of 4. Resulting buffer had 01234567.12345678 instead of 01234567.89abcdef. We have multiple ways to fix it: - enable 4 byte alignment for 32bit accesses. Since the HW do not have this requirement. It will break driver. - disable max_raw_* limit. This patch is removing max_raw_* limit for regmap accesses in ksz8863_smi. Fixes: 60a364760002 ("net: dsa: microchip: Add Microchip KSZ8863 SMI based driver support") Signed-off-by: Oleksij Rempel Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 492606cdc74804d372ab1bdb8f3ef4a6fb6f9f59 Author: Oleksij Rempel Date: Fri Mar 24 09:06:06 2023 +0100 net: dsa: microchip: ksz8: ksz8_fdb_dump: avoid extracting ghost entry from empty dynamic MAC table. If the dynamic MAC table is empty, we will still extract one outdated entry. Fix it by using correct bit offset. Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit b3177aab89be540dc50d2328427b073361093e38 Author: Oleksij Rempel Date: Fri Mar 24 09:06:05 2023 +0100 net: dsa: microchip: ksz8: fix offset for the timestamp filed We are using wrong offset, so we will get not a timestamp. Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 5d90492dd4ff50ad65c582c76c345d0b90001728 Author: Oleksij Rempel Date: Fri Mar 24 09:06:04 2023 +0100 net: dsa: microchip: ksz8: fix ksz8_fdb_dump() to extract all 1024 entries Current ksz8_fdb_dump() is able to extract only max 249 entries on the ksz8863/ksz8873 series of switches. This happened due to wrong bit mask and offset calculation. This commit corrects the issue and allows for the complete extraction of all 1024 entries. Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 88e943e83827a349f70c3464b3eba7260be7461d Author: Oleksij Rempel Date: Fri Mar 24 09:06:03 2023 +0100 net: dsa: microchip: ksz8: fix ksz8_fdb_dump() Before this patch, the ksz8_fdb_dump() function had several issues, such as uninitialized variables and incorrect usage of source port as a bit mask. These problems caused inaccurate reporting of vid information and port assignment in the bridge fdb. Fixes: e587be759e6e ("net: dsa: microchip: update fdb add/del/dump in ksz_common") Signed-off-by: Oleksij Rempel Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit d2b727cb532b15e8b33aa259c2e885679618971c Author: Michal Simek Date: Tue Mar 21 16:33:23 2023 +0100 fpga: xilinx-pr-decoupler: Use readl wrapper instead of pure readl Driver has IO wrappers but xlnx_pr_decouple_read() is not used and readl is used instead which is just wrong. It is also generating sparse issue that xlnx_pr_decouple_read() is unused. Signed-off-by: Michal Simek Reviewed-by: Tom Rix Acked-by: Xu Yilun Link: https://lore.kernel.org/r/0381e4e8061c2fee182a104768e84feff3a82d25.1679412800.git.michal.simek@amd.com Signed-off-by: Xu Yilun commit f33642224e38d7e0d59336e10e7b4e370b1c4506 Author: SongJingyi Date: Fri Mar 24 11:14:06 2023 +0800 ptp_qoriq: fix memory leak in probe() Smatch complains that: drivers/ptp/ptp_qoriq.c ptp_qoriq_probe() warn: 'base' from ioremap() not released. Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. This is only a bug if ptp_qoriq_init() returns on the first -ENODEV error path. For other error paths ptp_qoriq->base and base are the same. And this change makes the code more readable. Fixes: 7f4399ba405b ("ptp_qoriq: fix NULL access if ptp dt node missing") Signed-off-by: SongJingyi Reviewed-by: Dan Carpenter Reviewed-by: Dongliang Mu Link: https://lore.kernel.org/r/20230324031406.1895159-1-u201912584@hust.edu.cn Signed-off-by: Jakub Kicinski commit 3bced313b9a5a237c347e0f079c8c2fe4b3935aa Author: Ronak Doshi Date: Thu Mar 23 13:07:21 2023 -0700 vmxnet3: use gro callback when UPT is enabled Currently, vmxnet3 uses GRO callback only if LRO is disabled. However, on smartNic based setups where UPT is supported, LRO can be enabled from guest VM but UPT devicve does not support LRO as of now. In such cases, there can be performance degradation as GRO is not being done. This patch fixes this issue by calling GRO API when UPT is enabled. We use updateRxProd to determine if UPT mode is active or not. To clarify few things discussed over the thread: The patch is not neglecting any feature bits nor disabling GRO. It uses GRO callback when UPT is active as LRO is not available in UPT. GRO callback cannot be used as default for all cases as it degrades performance for non-UPT cases or for cases when LRO is already done in ESXi. Cc: stable@vger.kernel.org Fixes: 6f91f4ba046e ("vmxnet3: add support for capability registers") Signed-off-by: Ronak Doshi Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230323200721.27622-1-doshir@vmware.com Signed-off-by: Jakub Kicinski commit b93eb564869321d0dffaf23fcc5c88112ed62466 Author: Ahmad Fatoum Date: Thu Mar 23 11:37:35 2023 +0100 net: dsa: realtek: fix out-of-bounds access The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) with the expectation that priv has enough trailing space. However, only realtek-smi actually allocated this chip_data space. Do likewise in realtek-mdio to fix out-of-bounds accesses. These accesses likely went unnoticed so far, because of an (unused) buf[4096] member in struct realtek_priv, which caused kmalloc to round up the allocated buffer to a big enough size, so nothing of value was overwritten. With a different allocator (like in the barebox bootloader port of the driver) or with KASAN, the memory corruption becomes quickly apparent. Fixes: aac94001067d ("net: dsa: realtek: add new mdio interface for drivers") Reviewed-by: Florian Fainelli Reviewed-by: Luiz Angelo Daros de Luca Reviewed-by: Alvin Šipraga Reviewed-by: Linus Walleij Signed-off-by: Ahmad Fatoum Link: https://lore.kernel.org/r/20230323103735.2331786-1-a.fatoum@pengutronix.de Signed-off-by: Jakub Kicinski commit d684a7a26f7d2c7122a4581ac966ed64e88fb29c Author: Jerry Snitselaar Date: Fri Mar 24 12:32:04 2023 -0700 scsi: mpt3sas: Don't print sense pool info twice _base_allocate_sense_dma_pool() already prints out the sense pool information, so don't print it a second time after calling it in _base_allocate_memory_pools(). In addition the version in _base_allocate_memory_pools() was using the wrong size value, sz, which was last assigned when doing some nvme calculations instead of sense_sz to determine the pool size in kilobytes. Cc: Sathya Prakash Cc: Sreekanth Reddy Cc: Suganath Prabu Subramani Cc: MPT-FusionLinux.pdl@broadcom.com Cc: "Martin K. Petersen" Cc: "James E.J. Bottomley" Fixes: 970ac2bb70e7 ("scsi: mpt3sas: Force sense buffer allocations to be within same 4 GB region") Signed-off-by: Jerry Snitselaar Link: https://lore.kernel.org/r/20230324193204.567932-1-jsnitsel@redhat.com Signed-off-by: Martin K. Petersen commit 65aca32efdcb0965502d3db2f1fa33838c070952 Merge: 90c8ce31dbe93 d0072ca529674 Author: Linus Torvalds Date: Fri Mar 24 18:06:11 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-03-24-17-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "21 hotfixes, 8 of which are cc:stable. 11 are for MM, the remainder are for other subsystems" * tag 'mm-hotfixes-stable-2023-03-24-17-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (21 commits) mm: mmap: remove newline at the end of the trace mailmap: add entries for Richard Leitner kcsan: avoid passing -g for test kfence: avoid passing -g for test mm: kfence: fix using kfence_metadata without initialization in show_object() lib: dhry: fix unstable smp_processor_id(_) usage mailmap: add entry for Enric Balletbo i Serra mailmap: map Sai Prakash Ranjan's old address to his current one mailmap: map Rajendra Nayak's old address to his current one Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare" mailmap: add entry for Tobias Klauser kasan, powerpc: don't rename memintrinsics if compiler adds prefixes mm/ksm: fix race with VMA iteration and mm_struct teardown kselftest: vm: fix unused variable warning mm: fix error handling for map_deny_write_exec mm: deduplicate error handling for map_deny_write_exec checksyscalls: ignore fstat to silence build warning on LoongArch nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() test_maple_tree: add more testing for mas_empty_area() maple_tree: fix mas_skip_node() end slot detection ... commit f0aa59a33d2ac2267d260fe21eaf92500df8e7b4 Author: Damien Le Moal Date: Wed Mar 22 11:22:11 2023 +0900 scsi: core: Improve scsi_vpd_inquiry() checks Some USB-SATA adapters have broken behavior when an unsupported VPD page is probed: Depending on the VPD page number, a 4-byte header with a valid VPD page number but with a 0 length is returned. Currently, scsi_vpd_inquiry() only checks that the page number is valid to determine if the page is valid, which results in receiving only the 4-byte header for the non-existent page. This error manifests itself very often with page 0xb9 for the Concurrent Positioning Ranges detection done by sd_read_cpr(), resulting in the following error message: sd 0:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page Prevent such misleading error message by adding a check in scsi_vpd_inquiry() to verify that the page length is not 0. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230322022211.116327-1-damien.lemoal@opensource.wdc.com Reviewed-by: Benjamin Block Signed-off-by: Martin K. Petersen commit 90c8ce31dbe93f277fc1157e34740e841094c254 Merge: e76db6e50c85c 39b291b86b598 Author: Linus Torvalds Date: Fri Mar 24 17:59:00 2023 -0700 Merge tag '6.3-rc3-ksmbd-smb3-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: - return less confusing messages on unsupported dialects (STATUS_NOT_SUPPORTED instead of I/O error) - fix for overly frequent inactive session termination - fix refcount leak - fix bounds check problems found by static checkers - fix to advertise named stream support correctly - Fix AES256 signing bug when connected to from MacOS * tag '6.3-rc3-ksmbd-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: return unsupported error on smb1 mount ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: don't terminate inactive sessions after a few seconds ksmbd: fix possible refcount leak in smb2_open() ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION ksmbd: fix wrong signingkey creation when encryption is AES256 commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 Author: Tomas Henzl Date: Fri Mar 24 16:01:34 2023 +0100 scsi: megaraid_sas: Fix crash after a double completion When a physical disk is attached directly "without JBOD MAP support" (see megasas_get_tm_devhandle()) then there is no real error handling in the driver. Return FAILED instead of SUCCESS. Fixes: 18365b138508 ("megaraid_sas: Task management support") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com Signed-off-by: Martin K. Petersen commit 0808ed6ebbc292222ca069d339744870f6d801da Author: Tomas Henzl Date: Fri Mar 24 14:52:49 2023 +0100 scsi: megaraid_sas: Fix fw_crash_buffer_show() If crash_dump_buf is not allocated then crash dump can't be available. Replace logical 'and' with 'or'. Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230324135249.9733-1-thenzl@redhat.com Signed-off-by: Martin K. Petersen commit e76db6e50c85cce9e68c47076f8eab06189fe4db Merge: d7b5c942f0752 ec7d8bd7d40f1 Author: Linus Torvalds Date: Fri Mar 24 15:38:13 2023 -0700 Merge tag 'arm-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "As usual, most of the bug fixes address issues in the devicetree files, and out of these, most are for the Qualcomm and NXP platforms, including: - A missing 'reserved-memory' property on LG G Watch R that is needed to prevent clashing with firmware - Annotations for cache coherency on multiple machines - Corrections for pinctrl, regulator, clock, iommu and power domain properties for i.MX and Qualcomm to correctly reflect the hardware settings - Firmware file names on multiple machines SA8540P Ride board - An incompatible change to the qcom vadc driver requires adding individual labels - Fix EQoS PHY reset GPIO by dropping the deprecated/wrong property and switch to the new bindings. - A fix for PCI bus address translation Tegra194 and Tegra234. There are also a couple of device driver fixes, addressing: - A race condition in the amdtee driver - A performance regression in the Qualcomm 'llcc' driver - An unitialized variable use NXP i.MX 'weim' driver - Error handling issues in Qualcomm 'rmtfs', and 'scm' drivers and the Arm scmi firmware driver" * tag 'arm-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (48 commits) arm64: dts: qcom: sc8280xp-x13s: mark bob regulator as always-on arm64: dts: qcom: sc8280xp-x13s: mark s12b regulator as always-on arm64: dts: qcom: sc8280xp-x13s: mark s10b regulator as always-on arm64: dts: qcom: sc8280xp-x13s: mark s11b regulator as always-on arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes bus: imx-weim: fix branch condition evaluates to a garbage value arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl arm64: dts: imx93: Fix eqos properties arm64: dts: imx8mp: Fix LCDIF2 node clock order arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio firmware: qcom: scm: fix bogus irq error at probe arm64: dts: qcom: sm8550: Mark UFS controller as cache coherent arm64: dts: qcom: sa8540p-ride: correct name of remoteproc_nsp0 firmware arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent arm64: dts: qcom: sm8350: Mark UFS controller as cache coherent arm64: dts: qcom: sm8550: fix LPASS pinctrl slew base address ... commit d7b5c942f0752894a91a925c7249116333d4ab25 Merge: 37154c19dd799 06615d11cc781 Author: Linus Torvalds Date: Fri Mar 24 15:32:01 2023 -0700 Merge tag 'for-v6.3-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply fixes from Sebastian Reichel: - rk817: Fix compiler warning - cros_usbpd-charger: Fix excessive error printing - axp288_fuel_gauge: handle platform_get_irq error - bq24190 and da9150: Fix race condition in remove path * tag 'for-v6.3-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition power: supply: axp288_fuel_gauge: Added check for negative values power: supply: cros_usbpd: reclassify "default case!" as debug power: supply: rk817: Fix unsigned comparison with less than zero commit 37154c19dd79966009befdcf2b499099e3cbbe9c Merge: 5ad4fe9613cb8 08570b7c8db6d Author: Linus Torvalds Date: Fri Mar 24 15:21:24 2023 -0700 Merge tag 'drm-fixes-2023-03-24' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Daniel Vetter: - usual pile of fixes for amdgpu & i915 - probe error handling fixes for meson, lt8912b bridge - the host1x patch from Arnd - panel-orientation fix for Lenovo Book X90F * tag 'drm-fixes-2023-03-24' of git://anongit.freedesktop.org/drm/drm: (23 commits) gpu: host1x: fix uninitialized variable use drm/amd/display: Set dcn32 caps.seamless_odm drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi drm/amd/display: remove outdated 8bpc comments drm/amdgpu/gfx: set cg flags to enter/exit safe mode drm/amdgpu: Force signal hw_fences that are embedded in non-sched jobs drm/amdgpu: add mes resume when do gfx post soft reset drm/amdgpu: skip ASIC reset for APUs when go to S4 drm/amdgpu: reposition the gpu reset checking for reuse drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found drm/meson: fix missing component unbind on bind errors drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F Revert "drm/i915/hwmon: Enable PL1 power limit" drm/i915: Update vblank timestamping stuff on seamless M/N change drm/i915: Fix format for perf_limit_reasons drm/i915/gt: perform uc late init after probe error injection drm/i915/active: Fix missing debug object activation drm/i915/guc: Fix missing ecodes drm/i915/mtl: Disable MC6 for MTL A step ... commit 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 Author: Josua Mayer Date: Thu Mar 23 12:25:36 2023 +0200 net: phy: dp83869: fix default value for tx-/rx-internal-delay dp83869 internally uses a look-up table for mapping supported delays in nanoseconds to register values. When specific delays are defined in device-tree, phy_get_internal_delay does the lookup automatically returning an index. The default case wrongly assigns the nanoseconds value from the lookup table, resulting in numeric value 2000 applied to delay configuration register, rather than the expected index values 0-7 (7 for 2000). Ultimately this issue broke RX for 1Gbps links. Fix default delay configuration by assigning the intended index value directly. Cc: stable@vger.kernel.org Fixes: 736b25afe284 ("net: dp83869: Add RGMII internal delay configuration") Co-developed-by: Yazan Shhady Signed-off-by: Yazan Shhady Signed-off-by: Josua Mayer Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230323102536.31988-1-josua@solid-run.com Signed-off-by: Jakub Kicinski commit ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 Author: Íñigo Huguet Date: Thu Mar 23 09:34:17 2023 +0100 sfc: ef10: don't overwrite offload features at NIC reset At NIC reset, some offload features related to encapsulated traffic might have changed (this mainly happens if the firmware-variant is changed with the sfboot userspace tool). Because of this, features are checked and set again at reset time. However, this was not done right, and some features were improperly overwritten at NIC reset: - Tunneled IPv6 segmentation was always disabled - Features disabled with ethtool were reenabled - Features that becomes unsupported after the reset were not disabled Also, checking if the device supports IPV6_CSUM to enable TSO6 is no longer necessary because all currently supported devices support it. Additionally, move the assignment of some other features to the EF10_OFFLOAD_FEATURES macro, like it is done in ef100, leaving the selection of features in efx_pci_probe_post_io a bit cleaner. Fixes: ffffd2454a7a ("sfc: correctly advertise tunneled IPv6 segmentation") Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10") Reported-by: Tianhao Zhao Suggested-by: Jonathan Cooper Tested-by: Jonathan Cooper Signed-off-by: Íñigo Huguet Acked-by: Edward Cree Link: https://lore.kernel.org/r/20230323083417.7345-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 5ad4fe9613cb8c202150f5cce5347fc8926c6c01 Merge: 83511470af1a7 d3aa3e060c4a8 Author: Linus Torvalds Date: Fri Mar 24 14:20:48 2023 -0700 Merge tag 'for-6.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM thin to work as a swap device by using 'limit_swap_bios' DM target flag (initially added to allow swap to dm-crypt) to throttle the amount of outstanding swap bios. - Fix DM crypt soft lockup warnings by calling cond_resched() from the cpu intensive loop in dmcrypt_write(). - Fix DM crypt to not access an uninitialized tasklet. This fix allows for consistent handling of IO completion, by _not_ needlessly punting to a workqueue when tasklets are not needed. - Fix DM core's alloc_dev() initialization for DM stats to check for and propagate alloc_percpu() failure. * tag 'for-6.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm stats: check for and propagate alloc_percpu failure dm crypt: avoid accessing uninitialized tasklet dm crypt: add cond_resched() to dmcrypt_write() dm thin: fix deadlock when swapping to thin device commit 83511470af1a734ec47c37957612d2eecf1a2352 Merge: e344eb7be2a25 f915da0f0dfb6 Author: Linus Torvalds Date: Fri Mar 24 14:10:39 2023 -0700 Merge tag 'block-6.3-2023-03-24' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - Send Identify with CNS 06h only to I/O controllers (Martin George) - Fix nvme_tcp_term_pdu to match spec (Caleb Sander) - Pass in issue_flags for uring_cmd, so the end_io handlers don't need to assume what the right context is (me) - Fix for ublk, marking it as LIVE before adding it to avoid races on the initial IO (Ming) * tag 'block-6.3-2023-03-24' of git://git.kernel.dk/linux: nvme-tcp: fix nvme_tcp_term_pdu to match spec nvme: send Identify with CNS 06h only to I/O controllers block/io_uring: pass in issue_flags for uring_cmd task_work handling block: ublk_drv: mark device as LIVE before adding disk commit e344eb7be2a25c66a8bac5d4388f1a4583450a72 Merge: fd3d06ff5f4fa 02a4d923e4400 Author: Linus Torvalds Date: Fri Mar 24 14:01:01 2023 -0700 Merge tag 'io_uring-6.3-2023-03-24' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix an issue with repeated -ECONNREFUSED on a socket (me) - Fix a NULL pointer deference due to a stale lookup cache for allocating direct descriptors (Savino) * tag 'io_uring-6.3-2023-03-24' of git://git.kernel.dk/linux: io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() io_uring/net: avoid sending -ECONNABORTED on repeated connection requests commit fd3d06ff5f4fa23f32bdb7f4d9f308503801d9e0 Merge: 1868d192d8f50 6babf38d894be Author: Linus Torvalds Date: Fri Mar 24 13:45:58 2023 -0700 Merge tag 'thermal-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "These address two recent regressions related to thermal control. Specifics: - Restore the thermal core behavior regarding zero-temperature trip points to avoid a driver regression (Ido Schimmel) - Fix a recent regression in the ACPI processor driver preventing it from changing the number of CPU cooling device states exposed via sysfs after the given CPU cooling device has been registered (Rafael Wysocki)" * tag 'thermal-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: core: Restore behavior regarding invalid trip points ACPI: processor: thermal: Update CPU cooling devices on cpufreq policy changes thermal: core: Introduce thermal_cooling_device_update() thermal: core: Introduce thermal_cooling_device_present() ACPI: processor: Reorder acpi_processor_driver_init() commit 1868d192d8f504f88e61a8e83164fce6e6b7190c Merge: cb7f5b41f8341 8dbfa057b3f8e Author: Linus Torvalds Date: Fri Mar 24 13:29:44 2023 -0700 Merge tag 'acpi-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These add new ACPI IRQ override and backlight detection quirks. Specifics: - Add backlight=native DMI quirk for Acer Aspire 3830TG to the ACPI backlight driver (Hans de Goede) - Add an ACPI IRQ override quirk for Medion S17413 (Aymeric Wibo)" * tag 'acpi-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: resource: Add Medion S17413 to IRQ override quirk ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG commit 4dfb02d5cae80289384c4d3c6ddfbd92d30aced9 Author: Darrick J. Wong Date: Fri Mar 24 13:14:48 2023 -0700 xfs: fix mismerged tracepoints At some point in between sending this patch to the list and merging it into for-next, the tracepoints got all mixed up because I've over-reliant on automated tools not sucking. The end result is that the tracepoints are all wrong, so fix them. Signed-off-by: Darrick J. Wong commit 491eafce1a51c457701351a4bf40733799745314 Author: Steve French Date: Thu Mar 23 16:20:02 2023 -0500 smb3: fix unusable share after force unmount failure If user does forced unmount ("umount -f") while files are still open on the share (as was seen in a Kubernetes example running on SMB3.1.1 mount) then we were marking the share as "TID_EXITING" in umount_begin() which caused all subsequent operations (except write) to fail ... but unfortunately when umount_begin() is called we do not know yet that there are open files or active references on the share that would prevent unmount from succeeding. Kubernetes had example when they were doing umount -f when files were open which caused the share to become unusable until the files were closed (and the umount retried). Fix this so that TID_EXITING is not set until we are about to send the tree disconnect (not at the beginning of forced umounts in umount_begin) so that if "umount -f" fails (due to open files or references) the mount is still usable. Cc: stable@vger.kernel.org Reviewed-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit be4fde79812f02914e350bde0bc4cfeae8429378 Author: Paulo Alcantara Date: Fri Mar 24 13:56:33 2023 -0300 cifs: fix dentry lookups in directory handle cache Get rid of any prefix paths in @path before lookup_positive_unlocked() as it will call ->lookup() which already adds those prefix paths through build_path_from_dentry(). This has caused a performance regression when mounting shares with a prefix path where readdir(2) would end up retrying several times to open bad directory names that contained duplicate prefix paths. Fix this by skipping any prefix paths in @path before calling lookup_positive_unlocked(). Fixes: e4029e072673 ("cifs: find and use the dentry for cached non-root directories also") Cc: stable@vger.kernel.org # 6.1+ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 7e0e76d99079be13c9961dde7c93b2d1ee665af4 Author: Steve French Date: Thu Mar 23 15:10:26 2023 -0500 smb3: lower default deferred close timeout to address perf regression Performance tests with large number of threads noted that the change of the default closetimeo (deferred close timeout between when close is done by application and when client has to send the close to the server), to 5 seconds from 1 second, significantly degraded perf in some cases like this (in the filebench example reported, the stats show close requests on the wire taking twice as long, and 50% regression in filebench perf). This is stil configurable via mount parm closetimeo, but to be safe, decrease default back to its previous value of 1 second. Reported-by: Yin Fengwei Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/997614df-10d4-af53-9571-edec36b0e2f3@intel.com/ Fixes: 5efdd9122eff ("smb3: allow deferred close timeout to be configurable") Cc: stable@vger.kernel.org # 6.0+ Tested-by: Yin Fengwei Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: Shyam Prasad N Signed-off-by: Steve French commit c24bb1a87dc3f2d77d410eaac2c6a295961bf50e Author: Paulo Alcantara Date: Fri Mar 24 16:05:19 2023 -0300 cifs: fix missing unload_nls() in smb2_reconnect() Make sure to unload_nls() @nls_codepage if we no longer need it. Fixes: bc962159e8e3 ("cifs: avoid race conditions with parallel reconnects") Signed-off-by: Paulo Alcantara (SUSE) Cc: Shyam Prasad N Signed-off-by: Steve French commit f6887a71bdd2f0dcba9b8180dd2223cfa8637e85 Author: Jason Montleon Date: Fri Mar 24 13:07:11 2023 -0400 ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots() hdac_hdmi was not updated to use set_stream() instead of set_tdm_slots() in the original commit so HDMI no longer produces audio. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/regressions/CAJD_bPKQdtaExvVEKxhQ47G-ZXDA=k+gzhMJRHLBe=mysPnuKA@mail.gmail.com/ Fixes: 636110411ca7 ("ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio") Signed-off-by: Jason Montleon Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230324170711.2526-1-jmontleo@redhat.com Signed-off-by: Mark Brown commit 59513714f6659409adf717b0f85e0a6e35480a01 Author: Jiawen Wu Date: Wed Mar 22 18:36:32 2023 +0800 net: wangxun: Fix vector length of interrupt cause There is 64-bit interrupt cause register for txgbe. Fix to clear upper 32 bits. Fixes: 3f703186113f ("net: libwx: Add irq flow functions") Signed-off-by: Jiawen Wu Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230322103632.132011-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit cb7f5b41f8341148050fe63e27cf52aa4f1519ad Merge: 877c20b104253 66a1c22b70917 Author: Linus Torvalds Date: Fri Mar 24 10:12:14 2023 -0700 Merge tag 'slab-fix-for-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fix from Vlastimil Babka: "A single build fix for a corner case configuration that is apparently possible to achieve on some arches, from Geert" * tag 'slab-fix-for-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP commit 877c20b1042535d79f9806095b03fdb082095532 Merge: 19a6b66ca5244 0b1d9debe3030 Author: Linus Torvalds Date: Fri Mar 24 10:07:38 2023 -0700 Merge tag 'efi-fixes-for-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Set the NX compat flag for arm64 and zboot, to ensure compatibility with EFI firmware that complies with tightening requirements imposed across the ecosystem. - Improve identification of Ampere Altra systems based on SMBIOS data. - Fix some issues related to the EFI framebuffer that were introduced as a result from some refactoring related to zboot and the merge with sysfb. - Makefile tweak to avoid rebuilding vmlinuz unnecessarily. - Fix efi_random_alloc() return value on out of memory condition. * tag 'efi-fixes-for-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/libstub: randomalloc: Return EFI_OUT_OF_RESOURCES on failure efi/libstub: Use relocated version of kernel's struct screen_info efi/libstub: zboot: Add compressed image to make targets efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L efi: sysfb_efi: Fix DMI quirks not working for simpledrm efi/libstub: smbios: Drop unused 'recsize' parameter arm64: efi: Use SMBIOS processor version to key off Ampere quirk efi/libstub: smbios: Use length member instead of record struct size efi: earlycon: Reprobe after parsing config tables arm64: efi: Set NX compat flag in PE/COFF header efi/libstub: arm64: Remap relocated image with strict permissions efi/libstub: zboot: Mark zboot EFI application as NX compatible commit ec7d8bd7d40f14b03da2d9cc3c6c8c845d62fb0f Merge: 7158e61c6cc8d f3d0fbad6765d Author: Arnd Bergmann Date: Fri Mar 24 18:06:28 2023 +0100 Merge tag 'qcom-driver-fixes-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/fixes Qualcomm driver fixes for v6.3 Support for the secure world interrupting the SCM driver drive the wait queue mechanism was recently introduced, but most platforms doesn't have this mechanism and an error should not be printed in the log. The rmtfs_mem driver recently gained support for assigning the region to multiple VMIDs, but accidentally removed the support for running without assignment. A couple of changes are introducd to correct this. The SC8280XP LLCC slice configuration is wrong, reslting in incorrect configuration of the hardware. The table is corrected, based on the datasheet. * tag 'qcom-driver-fixes-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: firmware: qcom: scm: fix bogus irq error at probe soc: qcom: rmtfs: handle optional qcom,vmid correctly soc: qcom: rmtfs: fix error handling reading qcom,vmid soc: qcom: llcc: Fix slice configuration values for SC8280XP Link: https://lore.kernel.org/r/20230323142505.1086072-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 7158e61c6cc8dc90f822d520c2ba696619b14812 Merge: f42ee7c457641 ecd240875e877 Author: Arnd Bergmann Date: Fri Mar 24 18:06:16 2023 +0100 Merge tag 'qcom-dts-fixes-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/fixes Qualcomm ARM32 Devicetree fixes for v6.3 This introduces missing reserved-memory ranges on LG G Watch R, resolving stability issues caused by Linux reusing memory used by firmware. * tag 'qcom-dts-fixes-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: apq8026-lg-lenok: add missing reserved memory Link: https://lore.kernel.org/r/20230323141922.1085875-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit f42ee7c45764102c1351ed1dfcba93d3591e37da Merge: d2e53ceaf284e 07b0883e1f094 Author: Arnd Bergmann Date: Fri Mar 24 18:05:35 2023 +0100 Merge tag 'qcom-arm64-fixes-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/fixes Qualcomm ARM64 Devicetree fixes for v6.3 This correct SIM card selection on the two newly introduced MSM8916-based USB modems. The firmware-name for the first CDSP is corrected on the SA8540P Ride board. The PCIe controller in SC7280 is marked cache-coherent, which resolves seen data corruption issues. Labels are added to the vadc channel nodes on SC8280XP, as the Linux driver was updated to not include the unit address when generating device names and collisions thereby prevented registration of the channels. Audio clocks and routing is corrected and a few regulators are marked always-on for the Lenovo Thinkpad X13s, as their clients are not fully described at this point. SPI5 was accidentally enabled by default on SM6115, and is disabled again. CDSP on SM6375 is provided its power-domains, to appropriately vote for during power up for the DSP. The iommu mask for the PCIe controllers in SM8150 is updated, to match what the hypervisor expects. Th Venus firmware path is corrected on Xiaomi Mi Pad 5 Pro. The UFS controller is marked cache coherent on SM8350 and SM8450. The clocks for the second WSA macro on SM8450 is corrected, and given its own clocks. The bias-pull-up value for I2C pins are corrected on SM8550, to trigger the selection of the strong pull. CPU compatibles and the base address of the LPASS TLMM block are corrected. * tag 'qcom-arm64-fixes-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (23 commits) arm64: dts: qcom: sc8280xp-x13s: mark bob regulator as always-on arm64: dts: qcom: sc8280xp-x13s: mark s12b regulator as always-on arm64: dts: qcom: sc8280xp-x13s: mark s10b regulator as always-on arm64: dts: qcom: sc8280xp-x13s: mark s11b regulator as always-on arm64: dts: qcom: sm8550: Mark UFS controller as cache coherent arm64: dts: qcom: sa8540p-ride: correct name of remoteproc_nsp0 firmware arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent arm64: dts: qcom: sm8350: Mark UFS controller as cache coherent arm64: dts: qcom: sm8550: fix LPASS pinctrl slew base address arm64: dts: qcom: sc8280xp-x13s: fix va dmic dai links and routing arm64: dts: qcom: sc8280xp-x13s: fix dmic sample rate arm64: dts: qcom: sc8280xp: fix lpass tx macro clocks arm64: dts: qcom: sc8280xp: fix rx frame shapping info arm64: dts: qcom: sm8450: correct WSA2 assigned clocks arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent arm64: dts: qcom: msm8916-ufi: Fix sim card selection pinctrl arm64: dts: qcom: sm8250-xiaomi-elish: Correct venus firmware path arm64: dts: qcom: sm8550: Use correct CPU compatibles arm64: dts: qcom: sm8550: Add bias pull up value to tlmm i2c data clk states arm64: dts: qcom: sm6375: Add missing power-domain-named to CDSP ... Link: https://lore.kernel.org/r/20230323141642.1085684-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 19a6b66ca5244203214726376fda978cda2fc488 Merge: 2495697422d37 e89c2e815e764 Author: Linus Torvalds Date: Fri Mar 24 09:52:26 2023 -0700 Merge tag 'riscv-for-linus-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A fix to match the CSR ASID masking rules when passing ASIDs to firmware - Force GCC to use ISA 2.2, to avoid a host of compatibily issues between toolchains * tag 'riscv-for-linus-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Handle zicsr/zifencei issues between clang and binutils riscv: mm: Fix incorrect ASID argument when flushing TLB commit 2495697422d374b097151205d399ff0dcbaa08e0 Merge: 4bae0ad148f41 aadbd07ff8a75 Author: Linus Torvalds Date: Fri Mar 24 09:44:43 2023 -0700 Merge tag 'for-linus-6.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - fix build warning - avoid concurrent accesses to the Xen PV console ring page * tag 'for-linus-6.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86/PVH: avoid 32-bit build warning when obtaining VGA console info hvc/xen: prevent concurrent accesses to the shared ring commit 6babf38d894bec696761c10fbfccafceae76f4eb Merge: f1b80a3878b2d 22c52fa5155a2 Author: Rafael J. Wysocki Date: Fri Mar 24 17:11:27 2023 +0100 Merge branch 'thermal-acpi' Merge a fix for a recent thermal-related regression in the ACPI processor driver. * thermal-acpi: ACPI: processor: thermal: Update CPU cooling devices on cpufreq policy changes thermal: core: Introduce thermal_cooling_device_update() thermal: core: Introduce thermal_cooling_device_present() ACPI: processor: Reorder acpi_processor_driver_init() commit 8dbfa057b3f8e8402f639c0bf5fcbc4e43a8b3da Merge: 2d0ab14634a26 5e7a3bf65db57 Author: Rafael J. Wysocki Date: Fri Mar 24 17:08:52 2023 +0100 Merge branch 'acpi-video' Merge an ACPI backlight quirk for Acer Aspire 3830TG (Hans de Goede). * acpi-video: ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG commit 2d0ab14634a26e54f8d6d231b47b7ef233e84599 Author: Aymeric Wibo Date: Sun Mar 19 03:12:05 2023 +0100 ACPI: resource: Add Medion S17413 to IRQ override quirk Add DMI info of the Medion S17413 (board M1xA) to the IRQ override quirk table. This fixes the keyboard not working on these laptops. Link: https://bugzilla.kernel.org/show_bug.cgi?id=213031 Signed-off-by: Aymeric Wibo [ rjw: Fixed up white space ] Signed-off-by: Rafael J. Wysocki commit 4bae0ad148f41904dd4e5857bdc2e3e31b950b3d Merge: ed1407e7f7f90 b20cf3f89c56b Author: Linus Torvalds Date: Fri Mar 24 09:05:25 2023 -0700 Merge tag 'tag-chrome-platform-fixes-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform fix from Tzung-Bi Shih: "Fix a kernel data leak vulnerability" * tag 'tag-chrome-platform-fixes-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl commit ed1407e7f7f906aed5afa851b0f409740c4bfea8 Merge: 608f1b136616f 92fbb6d1296f8 Author: Linus Torvalds Date: Fri Mar 24 09:02:24 2023 -0700 Merge tag 'i2c-for-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "A set of regular driver fixes" * tag 'i2c-for-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() i2c: hisi: Only use the completion interrupt to finish the transfer i2c: hisi: Avoid redundant interrupts i2c: mxs: ensure that DMA buffers are safe for DMA i2c: imx-lpi2c: check only for enabled interrupt flags i2c: imx-lpi2c: clean rx/tx buffers upon new message commit 608f1b136616ff09d717776922c9ea9e9f9f3947 Merge: 285063049a652 1b4ae19e432df Author: Linus Torvalds Date: Fri Mar 24 08:48:12 2023 -0700 Merge tag 'net-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf, wifi and bluetooth. Current release - regressions: - wifi: mt76: mt7915: add back 160MHz channel width support for MT7915 - libbpf: revert poisoning of strlcpy, it broke uClibc-ng Current release - new code bugs: - bpf: improve the coverage of the "allow reads from uninit stack" feature to fix verification complexity problems - eth: am65-cpts: reset PPS genf adj settings on enable Previous releases - regressions: - wifi: mac80211: serialize ieee80211_handle_wake_tx_queue() - wifi: mt76: do not run mt76_unregister_device() on unregistered hw, fix null-deref - Bluetooth: btqcomsmd: fix command timeout after setting BD address - eth: igb: revert rtnl_lock() that causes a deadlock - dsa: mscc: ocelot: fix device specific statistics Previous releases - always broken: - xsk: add missing overflow check in xdp_umem_reg() - wifi: mac80211: - fix QoS on mesh interfaces - fix mesh path discovery based on unicast packets - Bluetooth: - ISO: fix timestamped HCI ISO data packet parsing - remove "Power-on" check from Mesh feature - usbnet: more fixes to drivers trusting packet length - wifi: iwlwifi: mvm: fix mvmtxq->stopped handling - Bluetooth: btintel: iterate only bluetooth device ACPI entries - eth: iavf: fix inverted Rx hash condition leading to disabled hash - eth: igc: fix the validation logic for taprio's gate list - dsa: tag_brcm: legacy: fix daisy-chained switches Misc: - bpf: adjust insufficient default bpf_jit_limit to account for growth of BPF use over the last 5 years - xdp: bpf_xdp_metadata() use EOPNOTSUPP as unique errno indicating no driver support" * tag 'net-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (84 commits) Bluetooth: HCI: Fix global-out-of-bounds Bluetooth: mgmt: Fix MGMT add advmon with RSSI command Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work Bluetooth: L2CAP: Fix responding with wrong PDU type Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: btinel: Check ACPI handle for NULL before accessing net: mdio: thunder: Add missing fwnode_handle_put() net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup() net: asix: fix modprobe "sysfs: cannot create duplicate filename" gve: Cache link_speed value from device tools: ynl: Fix genlmsg header encoding formats net: enetc: fix aggregate RMON counters not showing the ranges Bluetooth: Remove "Power-on" check from Mesh feature Bluetooth: Fix race condition in hci_cmd_sync_clear Bluetooth: btintel: Iterate only bluetooth device ACPI entries Bluetooth: ISO: fix timestamped HCI ISO data packet parsing Bluetooth: btusb: Remove detection of ISO packets over bulk Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet ... commit e2e63b071b2da53ad6a154e34c387bb064137f74 Author: Darrick J. Wong Date: Tue Mar 21 16:33:20 2023 -0700 xfs: clear incore AGFL_RESET state if it's not needed Prior to commit 7ac2ff8bb371, when we loaded the incore perag structure with information from the AGF header, we would set or clear the pagf_agfl_reset field based on whether or not the AGFL list was misaligned within the block. IOWs, it's an incore state bit that's supposed to cache something in the ondisk metadata. Therefore, the code still needs to support clearing the incore bit if (somehow) the AGFL were to correct itself. It turns out that xfs_repair does exactly this -- phase 4 loads the AGF to scan the rmapbt for corrupt records, which can set NEEDS_AGFL_RESET. The scan unsets AGF_INIT but doesn't unset NEEDS_AGFL_RESET. Phase 5 totally rewrites the AGFL and fixes the alignment problem, didn't clear NEEDS_AGFL_RESET historically, and reloads the perag state to fix the freelist. This results in the AGFL being reset based on stale data, which then causes the new AGFL blocks to be leaked. A subsequent xfs_repair -n then complains about the leaks. One could argue that phase 5 ought to clear this bit directly when it reloads the perag AGF data after rewriting the AGFL, but libxfs used to handle this for us, so it should go back to doing that. Found by fuzzing flfirst = ones in xfs/352. Fixes: 7ac2ff8bb371 ("xfs: perags need atomic operational state") Signed-off-by: Darrick J. Wong commit fcde88af6a783d32e735dd2615528e2bf7a0f533 Author: Darrick J. Wong Date: Sat Mar 18 20:58:40 2023 -0700 xfs: pass the correct cursor to xfs_iomap_prealloc_size In xfs_buffered_write_iomap_begin, @icur is the iext cursor for the data fork and @ccur is the cursor for the cow fork. Pass in whichever cursor corresponds to allocfork, because otherwise the xfs_iext_prev_extent call can use the data fork cursor to walk off the end of the cow fork structure. Best case it returns the wrong results, worst case it does this: stack segment: 0000 [#1] PREEMPT SMP CPU: 2 PID: 3141909 Comm: fsstress Tainted: G W 6.3.0-rc2-xfsx #6.3.0-rc2 7bf5cc2e98997627cae5c930d890aba3aeec65dd Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20171121_152543-x86-ol7-builder-01.us.oracle.com-4.el7.1 04/01/2014 RIP: 0010:xfs_iext_prev+0x71/0x150 [xfs] RSP: 0018:ffffc90002233aa8 EFLAGS: 00010297 RAX: 000000000000000f RBX: 000000000000000e RCX: 000000000000000c RDX: 0000000000000002 RSI: 000000000000000e RDI: ffff8883d0019ba0 RBP: 989642409af8a7a7 R08: ffffea0000000001 R09: 0000000000000002 R10: 0000000000000000 R11: 000000000000000c R12: ffffc90002233b00 R13: ffff8883d0019ba0 R14: 989642409af8a6bf R15: 000ffffffffe0000 FS: 00007fdf8115f740(0000) GS:ffff88843fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdf8115e000 CR3: 0000000357256000 CR4: 00000000003506e0 Call Trace: xfs_iomap_prealloc_size.constprop.0.isra.0+0x1a6/0x410 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] xfs_buffered_write_iomap_begin+0xa87/0xc60 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] iomap_iter+0x132/0x2f0 iomap_file_buffered_write+0x92/0x330 xfs_file_buffered_write+0xb1/0x330 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] vfs_write+0x2eb/0x410 ksys_write+0x65/0xe0 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Found by xfs/538 in alwayscow mode, but this doesn't seem particular to that test. Fixes: 590b16516ef3 ("xfs: refactor xfs_iomap_prealloc_size") Actually-Fixes: 66ae56a53f0e ("xfs: introduce an always_cow mode") Signed-off-by: Darrick J. Wong commit 285063049a65251aada1c34664de692dd083aa03 Merge: 6dd74c51b4856 e15acc25880cf Author: Linus Torvalds Date: Fri Mar 24 08:32:10 2023 -0700 Merge tag 'for-6.3-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A few more fixes, the zoned accounting fix is spread across a few patches, preparatory and the actual fixes: - zoned mode: - fix accounting of unusable zone space - fix zone activation condition for DUP profile - preparatory patches - improved error handling of missing chunks - fix compiler warning" * tag 'for-6.3-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zoned: drop space_info->active_total_bytes btrfs: zoned: count fresh BG region as zone unusable btrfs: use temporary variable for space_info in btrfs_update_block_group btrfs: rename BTRFS_FS_NO_OVERCOMMIT to BTRFS_FS_ACTIVE_ZONE_TRACKING btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile btrfs: fix compiler warning on SPARC/PA-RISC handling fscrypt_setup_filename btrfs: handle missing chunk mapping more gracefully commit 6dd74c51b48567e6ec56276aa35c8d25f6472f6f Merge: 1e760fa3596e8 a13faca032acb Author: Linus Torvalds Date: Fri Mar 24 08:27:13 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes, three in drivers. The core fix adds a UFS device to an existing quirk to avoid a huge delay on boot" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() scsi: qla2xxx: Synchronize the IOCB count to be in order scsi: qla2xxx: Perform lockless command completion in abort path scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR commit bc962159e8e326af634a506508034a375bf2b858 Author: Shyam Prasad N Date: Mon Mar 20 06:08:19 2023 +0000 cifs: avoid race conditions with parallel reconnects When multiple processes/channels do reconnects in parallel we used to return success immediately negotiate/session-setup/tree-connect, causing race conditions between processes that enter the function in parallel. This caused several errors related to session not found to show up during parallel reconnects. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit fddc6ccc487e5de07b98df8d04118d5dcb5e0407 Author: Shyam Prasad N Date: Fri Mar 17 12:51:17 2023 +0000 cifs: append path to open_enter trace event We do not dump the file path for smb3_open_enter ftrace calls, which is a severe handicap while debugging using ftrace evens. This change adds that info. Unfortunately, we're not updating the path in open params in many places; which I had to do as a part of this change. SMB2_open gets path in utf16 format, but it's easier of path is supplied as char pointer in oparms. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 7c3650a8007c43bc1a60d8bdb4cdbea3ad9a7dd4 Author: Todd Brandt Date: Tue Mar 14 11:12:56 2023 -0700 HID: hid-sensor-custom: Fix buffer overrun in device name On some platforms there are some platform devices created with invalid names. For example: "HID-SENSOR-INT-020b?.39.auto" instead of "HID-SENSOR-INT-020b.39.auto" This string include some invalid characters, hence it will fail to properly load the driver which will handle this custom sensor. Also it is a problem for some user space tools, which parses the device names from ftrace and dmesg. This is because the string, real_usage, is not NULL terminated and printed with %s to form device name. To address this, initialize the real_usage string with 0s. Reported-and-tested-by: Todd Brandt Link: https://bugzilla.kernel.org/show_bug.cgi?id=217169 Fixes: 98c062e82451 ("HID: hid-sensor-custom: Allow more custom iio sensors") Cc: stable@vger.kernel.org Suggested-by: Philipp Jungkamp Signed-off-by: Philipp Jungkamp Signed-off-by: Todd Brandt Reviewed-by: Andi Shyti Reviewed-by: Jonathan Cameron Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 1dc40551f206d20b7e46ea7dd538dcdd928451c6 Author: Dmitry Baryshkov Date: Fri Mar 24 05:16:51 2023 +0300 arm64: dts: qcom: ipq8074-hk10: enable QMP device, not the PHY node Correct PCIe PHY enablement to refer the QMP device nodes rather than PHY device nodes. QMP nodes have 'status = "disabled"' property in the ipq8074.dtsi, while PHY nodes do not correspond to the actual device and do not have the status property. Fixes: 1ed34da63a37 ("arm64: dts: qcom: Add board support for HK10") Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230324021651.1799969-2-dmitry.baryshkov@linaro.org commit 72630ba422b70ea0874fc90d526353cf71c72488 Author: Dmitry Baryshkov Date: Fri Mar 24 05:16:50 2023 +0300 arm64: dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node Correct PCIe PHY enablement to refer the QMP device nodes rather than PHY device nodes. QMP nodes have 'status = "disabled"' property in the ipq8074.dtsi, while PHY nodes do not correspond to the actual device and do not have the status property. Fixes: e8a7fdc505bb ("arm64: dts: ipq8074: qcom: Re-arrange dts nodes based on address") Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230324021651.1799969-1-dmitry.baryshkov@linaro.org commit e313de5b5b04176f28384b45ebebd552c0c7dae3 Author: Max Filippov Date: Fri Mar 24 05:30:35 2023 -0700 MAINTAINERS: xtensa: drop linux-xtensa@linux-xtensa.org mailing list The linux-xtensa@linux-xtensa.org mailing list has been bouncing emails for a few months now. Drop it from the xtensa entries in the MAINTAINERS file. Signed-off-by: Max Filippov commit 34224133458ca48caf2b57df335e870f1abb7af5 Author: Andrzej Kacprowski Date: Thu Mar 23 13:55:04 2023 +0100 accel/ivpu: Fix IPC buffer header status field value IPC messages transmitted to the device must be marked as allocated - status field must be set to 1. The VPU driver has IVPU_IPC_HDR_ALLOCATED incorrectly defined. Future VPU firmware versions will reject all IPC messages with invalid status and will not work with a VPU driver that is missing this fix. Fixes: 5d7422cfb498 ("accel/ivpu: Add IPC driver and JSM messages") Signed-off-by: Andrzej Kacprowski Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-9-stanislaw.gruszka@linux.intel.com commit 252776b2973ea8c7e2e6db09993e6f33c81b776e Author: Stanislaw Gruszka Date: Thu Mar 23 13:55:03 2023 +0100 accel/ivpu: Fix VPU clock calculation The driver calculates the wrong frequency because it ignores the workpoint config and this cause undesired power/performance characteristics. Fix this by using the workpoint config in the freq calculations. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Co-developed-by: Andrzej Kacprowski Signed-off-by: Andrzej Kacprowski Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-8-stanislaw.gruszka@linux.intel.com commit 392b35bf92605deb620a9b0c94c14cad1c69fd34 Author: Stanislaw Gruszka Date: Thu Mar 23 13:55:02 2023 +0100 accel/ivpu: Remove support for 1 tile SKUs The support for single tile SKUs was dropped from MTL. Note that we can still boot the VPU with 1-tile work point config - this is independent from number of tiles present in the VPU. Co-developed-by: Andrzej Kacprowski Signed-off-by: Andrzej Kacprowski Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-7-stanislaw.gruszka@linux.intel.com commit 3d8b2727d8de4720c6865917dd05249b1f449f34 Author: Stanislaw Gruszka Date: Thu Mar 23 13:55:01 2023 +0100 accel/ivpu: Disable buttress on device removal Use pci_set_power_state() to disable buttress when device is removed. This is workaround of hardware bug that hangs the system. Additionally not disabling buttress prevents CPU enter deeper Pkg-C states when the driver is unloaded or fail to probe. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-6-stanislaw.gruszka@linux.intel.com commit a8fed6d1e0b9bbea2cbe602831f84a2cff4653e3 Author: Stanislaw Gruszka Date: Thu Mar 23 13:55:00 2023 +0100 accel/ivpu: Fix power down sequence Remove FPGA workaround on power_down to skip checking for noc quiescent state. Put VPU in reset before powering it down and skip manipulating registers that are reset by the VPU reset. This fixes power down errors where VPU is powered down just after VPU is booted. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-5-stanislaw.gruszka@linux.intel.com commit 3ff6edbc17dbab87f705b1da93854ffff3912673 Author: Stanislaw Gruszka Date: Thu Mar 23 13:54:59 2023 +0100 accel/ivpu: Do not use SSID 1 The SSID=1 is used by the firmware as default value in case SSID mapping is not initialized. This allows detecting use of miss-configured memory contexts. The future FW versions may not allow using SSID=1. SSID=65 is valid value, number of contexts are limited by number of available command queues, but SSID can be any u16 value. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Co-developed-by: Andrzej Kacprowski Signed-off-by: Andrzej Kacprowski Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-4-stanislaw.gruszka@linux.intel.com commit 6013aa84ee45fd0faa23fc6312a1af60b06d408b Author: Stanislaw Gruszka Date: Thu Mar 23 13:54:58 2023 +0100 accel/ivpu: Cancel recovery work Prevent running recovery_work after device is removed. Fixes: 852be13f3bd3 ("accel/ivpu: Add PM support") Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-3-stanislaw.gruszka@linux.intel.com commit 4522ad764d7e99a79de817fcbc682ebcc75d01fe Author: Stanislaw Gruszka Date: Thu Mar 23 13:54:57 2023 +0100 accel/ivpu: Do not access HW registers after unbind We should not access hardware after we unbind from the bus. Use drm_dev_enter() / drm_dev_exit() to mark code sections where hardware is accessed (and not already protected by other locks) and drm_dev_unplug() to mark device is gone. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Signed-off-by: Jacek Lawrynowicz Link: https://patchwork.freedesktop.org/patch/msgid/20230323125504.2586442-2-stanislaw.gruszka@linux.intel.com commit 08570b7c8db6d9185deccf5bcda773bd6f17172f Author: Arnd Bergmann Date: Fri Jan 27 23:14:00 2023 +0100 gpu: host1x: fix uninitialized variable use The error handling for platform_get_irq() failing no longer works after a recent change, clang now points this out with a warning: drivers/gpu/host1x/dev.c:520:6: error: variable 'syncpt_irq' is uninitialized when used here [-Werror,-Wuninitialized] if (syncpt_irq < 0) ^~~~~~~~~~ Fix this by removing the variable and checking the correct error status. Fixes: 625d4ffb438c ("gpu: host1x: Rewrite syncpoint interrupt handling") Reviewed-by: Nathan Chancellor Reviewed-by: Mikko Perttunen Reported-by: "kernelci.org bot" Reviewed-by: Nick Desaulniers Reviewed-by: Jon Hunter Signed-off-by: Arnd Bergmann Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20230127221418.2522612-1-arnd@kernel.org commit 2e4e9de1620f76a69893b35f920171b563bd007c Merge: e37fef79bf3b0 f9537b1fa7fb5 Author: Daniel Vetter Date: Fri Mar 24 10:23:28 2023 +0100 Merge tag 'amd-drm-fixes-6.3-2023-03-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.3-2023-03-23: amdgpu: - S4 fix - Soft reset fixes - SR-IOV fix - Remove an out of date comment in the DC code - ASPM fix - DCN 3.2 fixes Signed-off-by: Daniel Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230323161939.7751-1-alexander.deucher@amd.com commit e37fef79bf3b045c44a1350acc327a8e34f07184 Merge: 9b5dbf6b15b56 22aa20e4c5dcb Author: Daniel Vetter Date: Fri Mar 24 10:18:43 2023 +0100 Merge tag 'drm-intel-fixes-2023-03-23' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.3-rc4: - Fix an MTL workaround - Fix fbdev obj locking before vma pin - Fix state inheritance tracking in initial commit - Fix missing GuC error capture codes - Fix missing debug object activation - Fix uc init late order relative to probe error injection - Fix perf limit reasons formatting - Fix vblank timestamp update on seamless M/N changes Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/878rfn7njw.fsf@intel.com commit 9b5dbf6b15b564be5c7cd562737853dc95d30935 Merge: e8d018dd0257f 1a70ca89d59c7 Author: Daniel Vetter Date: Fri Mar 24 09:33:03 2023 +0100 Merge tag 'drm-misc-fixes-2023-03-23' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * fixes for bind and probing error handling for meson, lt8912b bridge * panel-orientation fixes for Lenovo Book X90F Signed-off-by: Daniel Vetter From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230323082401.GA8371@linux-uq9g commit fa4e7a6fa12b1132340785e14bd439cbe95b7a5a Author: Takashi Iwai Date: Fri Mar 24 08:50:05 2023 +0100 ALSA: usb-audio: Fix regression on detection of Roland VS-100 It's been reported that the recent kernel can't probe the PCM devices on Roland VS-100 properly, and it turned out to be a regression by the recent addition of the bit shift range check for the format bits. In the old code, we just did bit-shift and it resulted in zero, which is then corrected to the standard PCM format, while the new code explicitly returns an error in such a case. For addressing the regression, relax the check and fallback to the standard PCM type (with the info output). Fixes: 43d5ca88dfcd ("ALSA: usb-audio: Fix potential out-of-bounds shift") Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=217084 Link: https://lore.kernel.org/r/20230324075005.19403-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 39b291b86b5988bf8753c3874d5c773399d09b96 Author: Namjae Jeon Date: Thu Mar 23 21:15:52 2023 +0900 ksmbd: return unsupported error on smb1 mount ksmbd disconnect connection when mounting with vers=smb1. ksmbd should send smb1 negotiate response to client for correct unsupported error return. This patch add needed SMB1 macros and fill NegProt part of the response for smb1 negotiate response. Cc: stable@vger.kernel.org Reported-by: Steve French Reviewed-by: Sergey Senozhatsky Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 Author: Tzung-Bi Shih Date: Fri Mar 24 09:06:58 2023 +0800 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl It is possible to peep kernel page's data by providing larger `insize` in struct cros_ec_command[1] when invoking EC host commands. Fix it by using zeroed memory. [1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74 Fixes: eda2e30c6684 ("mfd / platform: cros_ec: Miscellaneous character device to talk with the EC") Signed-off-by: Tzung-Bi Shih Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230324010658.1082361-1-tzungbi@kernel.org commit cbedf1a33970c9b825ae75b81fbd3e88e224a418 Author: Werner Sembach Date: Thu Mar 23 18:13:11 2023 -0700 Input: i8042 - add TUXEDO devices to i8042 quirk tables for partial fix A lot of modern Clevo barebones have touchpad and/or keyboard issues after suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of them have an external PS/2 port so this can safely be set for all of them. I'm not entirely sure if every device listed really needs all four quirks, but after testing and production use, no negative effects could be observed when setting all four. Setting SERIO_QUIRK_NOMUX or SERIO_QUIRK_RESET_ALWAYS on the Clevo N150CU and the Clevo NHxxRZQ makes the keyboard very laggy for ~5 seconds after boot and sometimes also after resume. However both are required for the keyboard to not fail completely sometimes after boot or resume. Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230321191619.647911-1-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov commit d0072ca529674c36421023ffe90837a7de9387f3 Author: Minwoo Im Date: Sat Mar 11 08:18:00 2023 +0900 mm: mmap: remove newline at the end of the trace We already have newline in TP_printk so remove the redundant newline character at the end of the mmap trace. <...>-345 [006] ..... 95.589290: exit_mmap: mt_mod ... <...>-345 [006] ..... 95.589413: vm_unmapped_area: addr=... <...>-345 [006] ..... 95.589571: vm_unmapped_area: addr=... <...>-345 [006] ..... 95.589606: vm_unmapped_area: addr=... to <...>-336 [006] ..... 44.762506: exit_mmap: mt_mod ... <...>-336 [006] ..... 44.762654: vm_unmapped_area: addr=... <...>-336 [006] ..... 44.762794: vm_unmapped_area: addr=... <...>-336 [006] ..... 44.762835: vm_unmapped_area: addr=... Link: https://lkml.kernel.org/r/ZAu6qDsNPmk82UjV@minwoo-desktop FIxes: df529cabb7a25 ("mm: mmap: add trace point of vm_unmapped_area") Signed-off-by: Minwoo Im Acked-by: Steven Rostedt (Google) Reviewed-by: Mukesh Ojha Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit 5aa360971beaadf51f099fb7904fa4807b7d39cd Author: Richard Leitner Date: Thu Mar 16 11:25:25 2023 +0100 mailmap: add entries for Richard Leitner Map all my old email addresses to my current address. Link: https://lkml.kernel.org/r/20230316-my-mailmap-v1-1-76bc3a36ba41@linux.dev Signed-off-by: Richard Leitner Signed-off-by: Andrew Morton commit 5eb39cde1e2487ba5ec1802dc5e58a77e700d99e Author: Marco Elver Date: Thu Mar 16 23:47:05 2023 +0100 kcsan: avoid passing -g for test Nathan reported that when building with GNU as and a version of clang that defaults to DWARF5, the assembler will complain with: Error: non-constant .uleb128 is not supported This is because `-g` defaults to the compiler debug info default. If the assembler does not support some of the directives used, the above errors occur. To fix, remove the explicit passing of `-g`. All the test wants is that stack traces print valid function names, and debug info is not required for that. (I currently cannot recall why I added the explicit `-g`.) Link: https://lkml.kernel.org/r/20230316224705.709984-2-elver@google.com Fixes: 1fe84fd4a402 ("kcsan: Add test suite") Signed-off-by: Marco Elver Reported-by: Nathan Chancellor Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Signed-off-by: Andrew Morton commit 2e08ca1802441224f5b7cc6bffbb687f7406de95 Author: Marco Elver Date: Thu Mar 16 23:47:04 2023 +0100 kfence: avoid passing -g for test Nathan reported that when building with GNU as and a version of clang that defaults to DWARF5: $ make -skj"$(nproc)" ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- \ LLVM=1 LLVM_IAS=0 O=build \ mrproper allmodconfig mm/kfence/kfence_test.o /tmp/kfence_test-08a0a0.s: Assembler messages: /tmp/kfence_test-08a0a0.s:14627: Error: non-constant .uleb128 is not supported /tmp/kfence_test-08a0a0.s:14628: Error: non-constant .uleb128 is not supported /tmp/kfence_test-08a0a0.s:14632: Error: non-constant .uleb128 is not supported /tmp/kfence_test-08a0a0.s:14633: Error: non-constant .uleb128 is not supported /tmp/kfence_test-08a0a0.s:14639: Error: non-constant .uleb128 is not supported ... This is because `-g` defaults to the compiler debug info default. If the assembler does not support some of the directives used, the above errors occur. To fix, remove the explicit passing of `-g`. All the test wants is that stack traces print valid function names, and debug info is not required for that. (I currently cannot recall why I added the explicit `-g`.) Link: https://lkml.kernel.org/r/20230316224705.709984-1-elver@google.com Fixes: bc8fbc5f305a ("kfence: add test suite") Signed-off-by: Marco Elver Reported-by: Nathan Chancellor Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Signed-off-by: Andrew Morton commit 1c86a188e03156223a34d09ce290b49bd4dd0403 Author: Muchun Song Date: Wed Mar 15 11:44:41 2023 +0800 mm: kfence: fix using kfence_metadata without initialization in show_object() The variable kfence_metadata is initialized in kfence_init_pool(), then, it is not initialized if kfence is disabled after booting. In this case, kfence_metadata will be used (e.g. ->lock and ->state fields) without initialization when reading /sys/kernel/debug/kfence/objects. There will be a warning if you enable CONFIG_DEBUG_SPINLOCK. Fix it by creating debugfs files when necessary. Link: https://lkml.kernel.org/r/20230315034441.44321-1-songmuchun@bytedance.com Fixes: 0ce20dd84089 ("mm: add Kernel Electric-Fence infrastructure") Signed-off-by: Muchun Song Tested-by: Marco Elver Reviewed-by: Marco Elver Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Jann Horn Cc: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 13684e966d46283e0e89b6a4941596dc52b18bf3 Author: Geert Uytterhoeven Date: Wed Mar 15 15:28:17 2023 +0100 lib: dhry: fix unstable smp_processor_id(_) usage When running the in-kernel Dhrystone benchmark with CONFIG_DEBUG_PREEMPT=y: BUG: using smp_processor_id() in preemptible [00000000] code: bash/938 Fix this by not using smp_processor_id() directly, but instead wrapping the whole benchmark inside a get_cpu()/put_cpu() pair. This makes sure the whole benchmark is run on the same CPU core, and the reported values are consistent. Link: https://lkml.kernel.org/r/b0d29932bb24ad82cea7f821e295c898e9657be0.1678890070.git.geert+renesas@glider.be Fixes: d5528cc16893f1f6 ("lib: add Dhrystone benchmark test") Signed-off-by: Geert Uytterhoeven Reported-by: Tobias Klausmann Link: https://bugzilla.kernel.org/show_bug.cgi?id=217179 Signed-off-by: Andrew Morton commit d2e44a50ecebb72257e5deb7ce8d227d7e3f53b9 Author: Enric Balletbo i Serra Date: Tue Mar 14 12:54:55 2023 +0100 mailmap: add entry for Enric Balletbo i Serra Map Enric's old corporate addresses to his kernel.org address. Link: https://lkml.kernel.org/r/20230314115455.188818-1-eballetbo@kernel.org Signed-off-by: Enric Balletbo i Serra Signed-off-by: Andrew Morton commit 9e26240c3bc1cf4895abdd5330a35465b5050109 Author: Konrad Dybcio Date: Tue Mar 14 13:56:03 2023 +0100 mailmap: map Sai Prakash Ranjan's old address to his current one Sai's old email is still picked up by the likes of get_maintainer.pl and keeps bouncing like all other @codeaurora.org addresses. Map it to his current one. Link: https://lkml.kernel.org/r/20230314125604.2734146-1-konrad.dybcio@linaro.org Signed-off-by: Konrad Dybcio Cc: Sai Prakash Ranjan Signed-off-by: Andrew Morton commit 83bd3eeb326bb0b5800573622d18e1c5e4355323 Author: Konrad Dybcio Date: Mon Mar 13 10:03:43 2023 +0100 mailmap: map Rajendra Nayak's old address to his current one Rajendra's old email is still picked up by the likes of get_maintainer.pl and keeps bouncing like all other @codeaurora.org addresses. Map it to his current one. Link: https://lkml.kernel.org/r/20230313090343.2148346-1-konrad.dybcio@linaro.org Signed-off-by: Konrad Dybcio Cc: Rajendra Nayak Cc: Andy Gross Cc: Baolin Wang Cc: Bjorn Andersson Cc: Colin Ian King Cc: Jakub Kicinski Cc: Kirill Tkhai Cc: Marijn Suijten Cc: Qais Yousef Cc: Stephen Hemminger Cc: Vasily Averin Signed-off-by: Andrew Morton commit f446883d12b8bfa486f7c98d403054d61d38c989 Author: Peter Collingbourne Date: Thu Mar 9 20:29:13 2023 -0800 Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare" This reverts commit 487a32ec24be819e747af8c2ab0d5c515508086a. should_skip_kasan_poison() reads the PG_skip_kasan_poison flag from page->flags. However, this line of code in free_pages_prepare(): page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP; clears most of page->flags, including PG_skip_kasan_poison, before calling should_skip_kasan_poison(), which meant that it would never return true as a result of the page flag being set. Therefore, fix the code to call should_skip_kasan_poison() before clearing the flags, as we were doing before the reverted patch. This fixes a measurable performance regression introduced in the reverted commit, where munmap() takes longer than intended if HW tags KASAN is supported and enabled at runtime. Without this patch, we see a single-digit percentage performance regression in a particular mmap()-heavy benchmark when enabling HW tags KASAN, and with the patch, there is no statistically significant performance impact when enabling HW tags KASAN. Link: https://lkml.kernel.org/r/20230310042914.3805818-2-pcc@google.com Fixes: 487a32ec24be ("kasan: drop skip_kasan_poison variable in free_pages_prepare") Link: https://linux-review.googlesource.com/id/Ic4f13affeebd20548758438bb9ed9ca40e312b79 Signed-off-by: Peter Collingbourne Reviewed-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Catalin Marinas [arm64] Cc: Evgenii Stepanov Cc: Vincenzo Frascino Cc: Will Deacon Cc: [6.1] Signed-off-by: Andrew Morton commit cc2a978d28422ca957d14cb25caa72e25c45be1d Author: Tobias Klauser Date: Fri Mar 10 13:35:08 2023 +0100 mailmap: add entry for Tobias Klauser Map my old email addresses to the current address. Link: https://lkml.kernel.org/r/20230310123508.22079-1-tklauser@distanz.ch Signed-off-by: Tobias Klauser Signed-off-by: Andrew Morton commit 90db9dbedd26ce029f3a0f8d2cbd3a142f452408 Author: Marco Elver Date: Mon Feb 27 10:47:27 2023 +0100 kasan, powerpc: don't rename memintrinsics if compiler adds prefixes With appropriate compiler support [1], KASAN builds use __asan prefixed meminstrinsics, and KASAN no longer overrides memcpy/memset/memmove. If compiler support is detected (CC_HAS_KASAN_MEMINTRINSIC_PREFIX), define memintrinsics normally (do not prefix '__'). On powerpc, KASAN is the only user of __mem functions, which are used to define instrumented memintrinsics. Alias the normal versions for KASAN to use in its implementation. Link: https://lore.kernel.org/all/20230224085942.1791837-1-elver@google.com/ [1] Link: https://lore.kernel.org/oe-kbuild-all/202302271348.U5lvmo0S-lkp@intel.com/ Link: https://lkml.kernel.org/r/20230227094726.3833247-1-elver@google.com Signed-off-by: Marco Elver Reported-by: kernel test robot Acked-by: Michael Ellerman [powerpc] Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Christophe Leroy Cc: Daniel Axtens Cc: Dmitry Vyukov Cc: Liam R. Howlett Cc: Nicholas Piggin Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 6db504ce55bdbc575723938fc480713c9183f6a2 Author: Liam R. Howlett Date: Wed Mar 8 17:03:10 2023 -0500 mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held in write mode. Ensure that the maple tree is still valid by checking ksm_test_exit() after taking the mmap_lock in read mode, but before the for_each_vma() iterator dereferences a destroyed maple tree. Since the maple tree is destroyed, the flags telling lockdep to check an external lock has been cleared. Skip the for_each_vma() iterator to avoid dereferencing a maple tree without the external lock flag, which would create a lockdep warning. Link: https://lkml.kernel.org/r/20230308220310.3119196-1-Liam.Howlett@oracle.com Fixes: a5f18ba07276 ("mm/ksm: use vma iterators instead of vma linked list") Signed-off-by: Liam R. Howlett Reported-by: Pengfei Xu Link: https://lore.kernel.org/lkml/ZAdUUhSbaa6fHS36@xpf.sh.intel.com/ Reported-by: syzbot+2ee18845e89ae76342c5@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=64a3e95957cd3deab99df7cd7b5a9475af92c93e Acked-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Cc: Signed-off-by: Andrew Morton commit d035230ec9937a9138921d2a0eeb99496ea7eac0 Author: Peter Xu Date: Wed Mar 8 19:04:22 2023 +0000 kselftest: vm: fix unused variable warning Remove unused variable from the MDWE test. [joey.gouly@arm.com: add commit message] Link: https://lkml.kernel.org/r/20230308190423.46491-4-joey.gouly@arm.com Fixes: 4cf1fe34fd18 ("kselftest: vm: add tests for memory-deny-write-execute") Signed-off-by: Peter Xu Signed-off-by: Joey Gouly Acked-by: Catalin Marinas Cc: Alexey Izbyshev Cc: Arnaldo Carvalho de Melo Cc: Kees Cook Cc: nd Cc: Shuah Khan Signed-off-by: Andrew Morton commit 3d27a95b1d96757e48ce970baa3d419af299c2af Author: Joey Gouly Date: Wed Mar 8 19:04:21 2023 +0000 mm: fix error handling for map_deny_write_exec Commit 4a18419f71cd ("mm/mprotect: use mmu_gather") changed 'goto out;' to 'break' in the loop. This wasn't noticed while rebasing the MDWE patches, so fix it now. Link: https://lkml.kernel.org/r/20230308190423.46491-3-joey.gouly@arm.com Fixes: b507808ebce2 ("mm: implement memory-deny-write-execute as a prctl") Signed-off-by: Joey Gouly Reported-by: Alexey Izbyshev Link: https://lore.kernel.org/linux-arm-kernel/8408d8901e9d7ee6b78db4c6cba04b78@ispras.ru/ Reviewed-by: Catalin Marinas Cc: Arnaldo Carvalho de Melo Cc: Kees Cook Cc: nd Cc: Peter Xu Cc: Shuah Khan Signed-off-by: Andrew Morton commit 6bbf1090672673183a98cd6e19de91fa5a319df0 Author: Joey Gouly Date: Wed Mar 8 19:04:20 2023 +0000 mm: deduplicate error handling for map_deny_write_exec Patch series "Fixes for MDWE prctl" These are four small fixes for the recent memory-write-deny-execute prctl patches [1]. Two reported by Alexey about error handling and two tooling fixes by Peter. This patch (of 4): Commit cc8d1b097de7 ("mmap: clean up mmap_region() unrolling") deduplicated the error handling, do the same for the return value of `map_deny_write_exec`. Link: https://lkml.kernel.org/r/20230308190423.46491-1-joey.gouly@arm.com Link: https://lkml.kernel.org/r/20230308190423.46491-2-joey.gouly@arm.com Link: https://lore.kernel.org/linux-arm-kernel/20230119160344.54358-1-joey.gouly@arm.com/ [1] Fixes: b507808ebce2 ("mm: implement memory-deny-write-execute as a prctl") Signed-off-by: Joey Gouly Reported-by: Alexey Izbyshev Link: https://lore.kernel.org/linux-arm-kernel/8408d8901e9d7ee6b78db4c6cba04b78@ispras.ru/ Reviewed-by: Catalin Marinas Cc: Arnaldo Carvalho de Melo Cc: Kees Cook Cc: nd Cc: Peter Xu Cc: Shuah Khan Signed-off-by: Andrew Morton commit 12871a154690c52e2ded718b392a3977c114f6c1 Author: Tiezhu Yang Date: Tue Mar 7 15:59:00 2023 +0800 checksyscalls: ignore fstat to silence build warning on LoongArch fstat is replaced by statx on the new architecture, so an exception is added to the checksyscalls script to silence the following build warning on LoongArch: CALL scripts/checksyscalls.sh :569:2: warning: #warning syscall fstat not implemented [-Wcpp] Link: https://lkml.kernel.org/r/1678175940-20872-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Tiezhu Yang Suggested-by: WANG Xuerui Suggested-by: Arnd Bergmann Reviewed-by: Arnd Bergmann Cc: Huacai Chen Cc: Masahiro Yamada Signed-off-by: Andrew Morton commit 003587000276f81d0114b5ce773d80c119d8cb30 Author: Ryusuke Konishi Date: Tue Mar 7 17:55:48 2023 +0900 nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy() The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO and NILFS_IOCTL_GET_CPINFO. This can occur when the element size of the user space metadata given by the v_size member of the argument nilfs_argv structure is larger than the size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo structure) on the file system side. KMSAN-enabled kernels detect this issue as follows: BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0xc0/0x100 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:169 [inline] nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 __do_compat_sys_ioctl fs/ioctl.c:968 [inline] __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572 alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287 __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599 nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 __do_compat_sys_ioctl fs/ioctl.c:968 [inline] __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Bytes 16-127 of 3968 are uninitialized ... This eliminates the leak issue by initializing the page allocated as buffer using get_zeroed_page(). Link: https://lkml.kernel.org/r/20230307085548.6290-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+132fdd2f1e1805fdc591@syzkaller.appspotmail.com Link: https://lkml.kernel.org/r/000000000000a5bd2d05f63f04ae@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 4bd6dded6318dc8e2514d74868c1f8fb38b61a60 Author: Liam R. Howlett Date: Tue Mar 7 13:02:47 2023 -0500 test_maple_tree: add more testing for mas_empty_area() Test robust filling of an entire area of the tree, then test one beyond. This is to test the walking back up the tree at the end of nodes and error condition. Test inspired by the reproducer code provided by Snild Dolkow. The last test in the function tests for the case of a corrupted maple state caused by the incorrect limits set during mas_skip_node(). There needs to be a gap in the second last child and last child, but the search must rule out the second last child's gap. This would avoid correcting the maple state to the correct max limit and return an error. Link: https://lkml.kernel.org/r/20230307180247.2220303-3-Liam.Howlett@oracle.com Cc: Snild Dolkow Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.com/ Fixes: e15e06a83923 ("lib/test_maple_tree: add testing for maple tree") Signed-off-by: Liam R. Howlett Cc: Peng Zhang Cc: Signed-off-by: Andrew Morton commit 0fa99fdfe1b38da396d0b2d1496a823bcd0ebea0 Author: Liam R. Howlett Date: Tue Mar 7 13:02:46 2023 -0500 maple_tree: fix mas_skip_node() end slot detection Patch series "Fix mas_skip_node() for mas_empty_area()", v2. mas_empty_area() was incorrectly returning an error when there was room. The issue was tracked down to mas_skip_node() using the incorrect end-of-slot count. Instead of using the nodes hard limit, the limit of data should be used. mas_skip_node() was also setting the min and max to that of the child node, which was unnecessary. Within these limits being set, there was also a bug that corrupted the maple state's max if the offset was set to the maximum node pivot. The bug was without consequence unless there was a sufficient gap in the next child node which would cause an error to be returned. This patch set fixes these errors by removing the limit setting from mas_skip_node() and uses the mas_data_end() for slot limits, and adds tests for all failures discovered. This patch (of 2): mas_skip_node() is used to move the maple state to the node with a higher limit. It does this by walking up the tree and increasing the slot count. Since slot count may not be able to be increased, it may need to walk up multiple times to find room to walk right to a higher limit node. The limit of slots that was being used was the node limit and not the last location of data in the node. This would cause the maple state to be shifted outside actual data and enter an error state, thus returning -EBUSY. The result of the incorrect error state means that mas_awalk() would return an error instead of finding the allocation space. The fix is to use mas_data_end() in mas_skip_node() to detect the nodes data end point and continue walking the tree up until it is safe to move to a node with a higher limit. The walk up the tree also sets the maple state limits so remove the buggy code from mas_skip_node(). Setting the limits had the unfortunate side effect of triggering another bug if the parent node was full and the there was no suitable gap in the second last child, but room in the next child. mas_skip_node() may also be passed a maple state in an error state from mas_anode_descend() when no allocations are available. Return on such an error state immediately. Link: https://lkml.kernel.org/r/20230307180247.2220303-1-Liam.Howlett@oracle.com Link: https://lkml.kernel.org/r/20230307180247.2220303-2-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Reported-by: Snild Dolkow Link: https://lore.kernel.org/linux-mm/cb8dc31a-fef2-1d09-f133-e9f7b9f9e77a@sony.com/ Tested-by: Snild Dolkow Cc: Peng Zhang Cc: Signed-off-by: Andrew Morton commit e9c3cda4d86e56bf7fe403729f38c4f0f65d3860 Author: Michal Hocko Date: Mon Mar 6 09:15:17 2023 +0100 mm, vmalloc: fix high order __GFP_NOFAIL allocations Gao Xiang has reported that the page allocator complains about high order __GFP_NOFAIL request coming from the vmalloc core: __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5549 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2286 vm_area_alloc_pages mm/vmalloc.c:2989 [inline] __vmalloc_area_node mm/vmalloc.c:3057 [inline] __vmalloc_node_range+0x978/0x13c0 mm/vmalloc.c:3227 kvmalloc_node+0x156/0x1a0 mm/util.c:606 kvmalloc include/linux/slab.h:737 [inline] kvmalloc_array include/linux/slab.h:755 [inline] kvcalloc include/linux/slab.h:760 [inline] it seems that I have completely missed high order allocation backing vmalloc areas case when implementing __GFP_NOFAIL support. This means that [k]vmalloc at al. can allocate higher order allocations with __GFP_NOFAIL which can trigger OOM killer for non-costly orders easily or cause a lot of reclaim/compaction activity if those requests cannot be satisfied. Fix the issue by falling back to zero order allocations for __GFP_NOFAIL requests if the high order request fails. Link: https://lkml.kernel.org/r/ZAXynvdNqcI0f6Us@dhcp22.suse.cz Fixes: 9376130c390a ("mm/vmalloc: add support for __GFP_NOFAIL") Reported-by: Gao Xiang Link: https://lkml.kernel.org/r/20230305053035.1911-1-hsiangkao@linux.alibaba.com Signed-off-by: Michal Hocko Reviewed-by: Uladzislau Rezki (Sony) Acked-by: Vlastimil Babka Cc: Baoquan He Cc: Christoph Hellwig Cc: Mel Gorman Signed-off-by: Andrew Morton commit 1b4ae19e432dfec785d980993c09593cbb182754 Merge: 2e63a2dfe73fd 915efd8a446b7 Author: Jakub Kicinski Date: Thu Mar 23 16:03:33 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-03-23 We've added 8 non-merge commits during the last 13 day(s) which contain a total of 21 files changed, 238 insertions(+), 161 deletions(-). The main changes are: 1) Fix verification issues in some BPF programs due to their stack usage patterns, from Eduard Zingerman. 2) Fix to add missing overflow checks in xdp_umem_reg and return an error in such case, from Kal Conley. 3) Fix and undo poisoning of strlcpy in libbpf given it broke builds for libcs which provided the former like uClibc-ng, from Jesus Sanchez-Palencia. 4) Fix insufficient bpf_jit_limit default to avoid users running into hard to debug seccomp BPF errors, from Daniel Borkmann. 5) Fix driver return code when they don't support a bpf_xdp_metadata kfunc to make it unambiguous from other errors, from Jesper Dangaard Brouer. 6) Two BPF selftest fixes to address compilation errors from recent changes in kernel structures, from Alexei Starovoitov. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: xdp: bpf_xdp_metadata use EOPNOTSUPP for no driver support bpf: Adjust insufficient default bpf_jit_limit xsk: Add missing overflow check in xdp_umem_reg selftests/bpf: Fix progs/test_deny_namespace.c issues. selftests/bpf: Fix progs/find_vma_fail1.c build error. libbpf: Revert poisoning of strlcpy selftests/bpf: Tests for uninitialized stack reads bpf: Allow reads from uninit stack ==================== Link: https://lore.kernel.org/r/20230323225221.6082-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 2e63a2dfe73fd00e48b615ef1274a44299f57c5f Merge: 4f44d3260536a bce5640520111 Author: Jakub Kicinski Date: Thu Mar 23 15:56:20 2023 -0700 Merge tag 'for-net-2023-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix MGMT add advmon with RSSI command - L2CAP: Fix responding with wrong PDU type - Fix race condition in hci_cmd_sync_clear - ISO: Fix timestamped HCI ISO data packet parsing - HCI: Fix global-out-of-bounds - hci_sync: Resume adv with no RPA when active scan * tag 'for-net-2023-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: HCI: Fix global-out-of-bounds Bluetooth: mgmt: Fix MGMT add advmon with RSSI command Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work Bluetooth: L2CAP: Fix responding with wrong PDU type Bluetooth: btqcomsmd: Fix command timeout after setting BD address Bluetooth: btinel: Check ACPI handle for NULL before accessing Bluetooth: Remove "Power-on" check from Mesh feature Bluetooth: Fix race condition in hci_cmd_sync_clear Bluetooth: btintel: Iterate only bluetooth device ACPI entries Bluetooth: ISO: fix timestamped HCI ISO data packet parsing Bluetooth: btusb: Remove detection of ISO packets over bulk Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet Bluetooth: hci_sync: Resume adv with no RPA when active scan ==================== Link: https://lore.kernel.org/r/20230323202335.3380841-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 4f44d3260536a754fcbf36f47f965147fa59a70c Merge: b1de5c78ebe98 f355f70145744 Author: Jakub Kicinski Date: Thu Mar 23 15:47:53 2023 -0700 Merge tag 'wireless-2023-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.3 Third set of fixes for v6.3. mt76 has two kernel crash fixes and adding back 160 MHz channel support for mt7915. mac80211 has fixes for a race in transmit path and two mesh related fixes. iwlwifi also has fixes for races. * tag 'wireless-2023-03-23' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: fix mesh path discovery based on unicast packets wifi: mac80211: fix qos on mesh interfaces wifi: iwlwifi: mvm: protect TXQ list manipulation wifi: iwlwifi: mvm: fix mvmtxq->stopped handling wifi: mac80211: Serialize ieee80211_handle_wake_tx_queue() wifi: mwifiex: mark OF related data as maybe unused wifi: mt76: connac: do not check WED status for non-mmio devices wifi: mt76: mt7915: add back 160MHz channel width support for MT7915 wifi: mt76: do not run mt76_unregister_device() on unregistered hw ==================== Link: https://lore.kernel.org/r/20230323110332.C4FE4C433D2@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 1e760fa3596e8c7f08412712c168288b79670d78 Merge: 9fd6ba5420ba2 260595b439776 Author: Linus Torvalds Date: Thu Mar 23 15:25:49 2023 -0700 Merge tag 'gfs2-v6.3-rc3-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fix from Andreas Gruenbacher: - Reinstate commit 970343cd4904 ("GFS2: free disk inode which is deleted by remote node -V2") as reverting that commit could cause gfs2_put_super() to hang. * tag 'gfs2-v6.3-rc3-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: Reinstate "GFS2: free disk inode which is deleted by remote node -V2" commit bce56405201111807cc8e4f47c6de3e10b17c1ac Author: Sungwoo Kim Date: Mon Mar 20 21:50:18 2023 -0400 Bluetooth: HCI: Fix global-out-of-bounds To loop a variable-length array, hci_init_stage_sync(stage) considers that stage[i] is valid as long as stage[i-1].func is valid. Thus, the last element of stage[].func should be intentionally invalid as hci_init0[], le_init2[], and others did. However, amp_init1[] and amp_init2[] have no invalid element, letting hci_init_stage_sync() keep accessing amp_init1[] over its valid range. This patch fixes this by adding {} in the last of amp_init1[] and amp_init2[]. ================================================================== BUG: KASAN: global-out-of-bounds in hci_dev_open_sync ( /v6.2-bzimage/net/bluetooth/hci_sync.c:3154 /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) Read of size 8 at addr ffffffffaed1ab70 by task kworker/u5:0/1032 CPU: 0 PID: 1032 Comm: kworker/u5:0 Not tainted 6.2.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04 Workqueue: hci1 hci_power_on Call Trace: dump_stack_lvl (/v6.2-bzimage/lib/dump_stack.c:107 (discriminator 1)) print_report (/v6.2-bzimage/mm/kasan/report.c:307 /v6.2-bzimage/mm/kasan/report.c:417) ? hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) kasan_report (/v6.2-bzimage/mm/kasan/report.c:184 /v6.2-bzimage/mm/kasan/report.c:519) ? hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:3154 /v6.2-bzimage/net/bluetooth/hci_sync.c:3343 /v6.2-bzimage/net/bluetooth/hci_sync.c:4418 /v6.2-bzimage/net/bluetooth/hci_sync.c:4609 /v6.2-bzimage/net/bluetooth/hci_sync.c:4689) ? __pfx_hci_dev_open_sync (/v6.2-bzimage/net/bluetooth/hci_sync.c:4635) ? mutex_lock (/v6.2-bzimage/./arch/x86/include/asm/atomic64_64.h:190 /v6.2-bzimage/./include/linux/atomic/atomic-long.h:443 /v6.2-bzimage/./include/linux/atomic/atomic-instrumented.h:1781 /v6.2-bzimage/kernel/locking/mutex.c:171 /v6.2-bzimage/kernel/locking/mutex.c:285) ? __pfx_mutex_lock (/v6.2-bzimage/kernel/locking/mutex.c:282) hci_power_on (/v6.2-bzimage/net/bluetooth/hci_core.c:485 /v6.2-bzimage/net/bluetooth/hci_core.c:984) ? __pfx_hci_power_on (/v6.2-bzimage/net/bluetooth/hci_core.c:969) ? read_word_at_a_time (/v6.2-bzimage/./include/asm-generic/rwonce.h:85) ? strscpy (/v6.2-bzimage/./arch/x86/include/asm/word-at-a-time.h:62 /v6.2-bzimage/lib/string.c:161) process_one_work (/v6.2-bzimage/kernel/workqueue.c:2294) worker_thread (/v6.2-bzimage/./include/linux/list.h:292 /v6.2-bzimage/kernel/workqueue.c:2437) ? __pfx_worker_thread (/v6.2-bzimage/kernel/workqueue.c:2379) kthread (/v6.2-bzimage/kernel/kthread.c:376) ? __pfx_kthread (/v6.2-bzimage/kernel/kthread.c:331) ret_from_fork (/v6.2-bzimage/arch/x86/entry/entry_64.S:314) The buggy address belongs to the variable: amp_init1+0x30/0x60 The buggy address belongs to the physical page: page:000000003a157ec6 refcount:1 mapcount:0 mapping:0000000000000000 ia flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea0005054688 ffffea0005054688 000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffffaed1aa00: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 00 ffffffffaed1aa80: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 >ffffffffaed1ab00: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 ^ ffffffffaed1ab80: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 f9 ffffffffaed1ac00: f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9 00 00 02 f9 This bug is found by FuzzBT, a modified version of Syzkaller. Other contributors for this bug are Ruoyu Wu and Peng Hui. Fixes: d0b137062b2d ("Bluetooth: hci_sync: Rework init stages") Signed-off-by: Sungwoo Kim Reviewed-by: Simon Horman Signed-off-by: Luiz Augusto von Dentz commit 1a0291f81529e8044fb29845a0196ba47af894ce Author: Howard Chung Date: Thu Mar 16 18:11:38 2023 +0800 Bluetooth: mgmt: Fix MGMT add advmon with RSSI command The MGMT command: MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI uses variable length argument. This causes host not able to register advmon with rssi. This patch has been locally tested by adding monitor with rssi via btmgmt on a kernel 6.1 machine. Reviewed-by: Archie Pusaka Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Signed-off-by: Howard Chung Signed-off-by: Luiz Augusto von Dentz commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f Author: Zheng Wang Date: Thu Mar 9 16:07:39 2023 +0800 Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work In btsdio_probe, &data->work was bound with btsdio_work.In btsdio_send_frame, it was started by schedule_work. If we call btsdio_remove with an unfinished job, there may be a race condition and cause UAF bug on hdev. Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices") Signed-off-by: Zheng Wang Signed-off-by: Luiz Augusto von Dentz commit 9aa9d9473f1550d1936c31259720b3f1f4690576 Author: Luiz Augusto von Dentz Date: Wed Mar 8 14:20:34 2023 -0800 Bluetooth: L2CAP: Fix responding with wrong PDU type L2CAP_ECRED_CONN_REQ shall be responded with L2CAP_ECRED_CONN_RSP not L2CAP_LE_CONN_RSP: L2CAP LE EATT Server - Reject - run Listening for connections New client connection with handle 0x002a Sending L2CAP Request from client Client received response code 0x15 Unexpected L2CAP response code (expected 0x18) L2CAP LE EATT Server - Reject - test failed > ACL Data RX: Handle 42 flags 0x02 dlen 26 LE L2CAP: Enhanced Credit Connection Request (0x17) ident 1 len 18 PSM: 39 (0x0027) MTU: 64 MPS: 64 Credits: 5 Source CID: 65 Source CID: 66 Source CID: 67 Source CID: 68 Source CID: 69 < ACL Data TX: Handle 42 flags 0x00 dlen 16 LE L2CAP: LE Connection Response (0x15) ident 1 len 8 invalid size 00 00 00 00 00 00 06 00 L2CAP LE EATT Server - Reject - run Listening for connections New client connection with handle 0x002a Sending L2CAP Request from client Client received response code 0x18 L2CAP LE EATT Server - Reject - test passed Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode") Signed-off-by: Luiz Augusto von Dentz commit 5d44ab9e204200a78ad55cdf185aa2bb109b5950 Author: Stephan Gerhold Date: Wed Mar 8 14:31:55 2023 +0100 Bluetooth: btqcomsmd: Fix command timeout after setting BD address On most devices using the btqcomsmd driver (e.g. the DragonBoard 410c and other devices based on the Qualcomm MSM8916/MSM8909/... SoCs) the Bluetooth firmware seems to become unresponsive for a while after setting the BD address. On recent kernel versions (at least 5.17+) this often causes timeouts for subsequent commands, e.g. the HCI reset sent by the Bluetooth core during initialization: Bluetooth: hci0: Opcode 0x c03 failed: -110 Unfortunately this behavior does not seem to be documented anywhere. Experimentation suggests that the minimum necessary delay to avoid the problem is ~150us. However, to be sure add a sleep for > 1ms in case it is a bit longer on other firmware versions. Older kernel versions are likely also affected, although perhaps with slightly different errors or less probability. Side effects can easily hide the issue in most cases, e.g. unrelated incoming interrupts that cause the necessary delay. Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver") Signed-off-by: Stephan Gerhold Signed-off-by: Luiz Augusto von Dentz commit 902160cdb2bf4d23cd75f43ed0597ddf0134bb89 Author: Kiran K Date: Wed Mar 8 13:28:37 2023 +0530 Bluetooth: btinel: Check ACPI handle for NULL before accessing Older platforms and Virtual platforms which doesn't have support for bluetooth device in ACPI firmware will not have valid ACPI handle. Check for validity of handle before accessing. dmesg log from simics environment (virtual platform): BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 IP: acpi_ns_walk_namespace+0x5c/0x278 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Modules linked in: bnep intel_powerclamp coretemp kvm_intel kvm irqbypass intel_cstate input_leds joydev serio_raw mac_hid btusb(OE) btintel(OE) bluetooth(OE) lpc_ich compat(OE) ecdh_generic i7core_edac i5500_temp shpchp binfmt_misc sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid e1000e psmouse ahci pata_acpi libahci ptp pps_core floppy CPU: 0 PID: 35 Comm: kworker/u3:0 Tainted: G OE 4.15.0-140-generic #144-Ubuntu Hardware name: Simics Simics, BIOS Simics 01/01/2011 Workqueue: hci0 hci_power_on [bluetooth] RIP: 0010:acpi_ns_walk_namespace+0x5c/0x278 RSP: 0000:ffffaa9c0049bba8 EFLAGS: 00010246 RAX: 0000000000000001 RBX: 0000000000001001 RCX: 0000000000000010 RDX: ffffffff92ea7e27 RSI: ffffffff92ea7e10 RDI: 00000000000000c8 RBP: ffffaa9c0049bbf8 R08: 0000000000000000 R09: ffffffffc05b39d0 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000000 R14: ffffffffc05b39d0 R15: ffffaa9c0049bc70 FS: 0000000000000000(0000) GS:ffff8be73fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 0000000075f0e000 CR4: 00000000000006f0 Fixes: 294d749b5df5 ("Bluetooth: btintel: Iterate only bluetooth device ACPI entries") Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit e89c2e815e76471cb507bd95728bf26da7976430 Author: Nathan Chancellor Date: Mon Mar 13 16:00:23 2023 -0700 riscv: Handle zicsr/zifencei issues between clang and binutils There are two related issues that appear in certain combinations with clang and GNU binutils. The first occurs when a version of clang that supports zicsr or zifencei via '-march=' [1] (i.e, >= 17.x) is used in combination with a version of GNU binutils that do not recognize zicsr and zifencei in the '-march=' value (i.e., < 2.36): riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zicsr2p0_zifencei2p0: Invalid or unknown z ISA extension: 'zifencei' riscv64-linux-gnu-ld: failed to merge target specific data of file fs/efivarfs/file.o riscv64-linux-gnu-ld: -march=rv64i2p0_m2p0_a2p0_c2p0_zicsr2p0_zifencei2p0: Invalid or unknown z ISA extension: 'zifencei' riscv64-linux-gnu-ld: failed to merge target specific data of file fs/efivarfs/super.o The second occurs when a version of clang that does not support zicsr or zifencei via '-march=' (i.e., <= 16.x) is used in combination with a version of GNU as that defaults to a newer ISA base spec, which requires specifying zicsr and zifencei in the '-march=' value explicitly (i.e, >= 2.38): ../arch/riscv/kernel/kexec_relocate.S: Assembler messages: ../arch/riscv/kernel/kexec_relocate.S:147: Error: unrecognized opcode `fence.i', extension `zifencei' required clang-12: error: assembler command failed with exit code 1 (use -v to see invocation) This is the same issue addressed by commit 6df2a016c0c8 ("riscv: fix build with binutils 2.38") (see [2] for additional information) but older versions of clang miss out on it because the cc-option check fails: clang-12: error: invalid arch name 'rv64imac_zicsr_zifencei', unsupported standard user-level extension 'zicsr' clang-12: error: invalid arch name 'rv64imac_zicsr_zifencei', unsupported standard user-level extension 'zicsr' To resolve the first issue, only attempt to add zicsr and zifencei to the march string when using the GNU assembler 2.38 or newer, which is when the default ISA spec was updated, requiring these extensions to be specified explicitly. LLVM implements an older version of the base specification for all currently released versions, so these instructions are available as part of the 'i' extension. If LLVM's implementation is updated in the future, a CONFIG_AS_IS_LLVM condition can be added to CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. To resolve the second issue, use version 2.2 of the base ISA spec when using an older version of clang that does not support zicsr or zifencei via '-march=', as that is the spec version most compatible with the one clang/LLVM implements and avoids the need to specify zicsr and zifencei explicitly due to still being a part of 'i'. [1]: https://github.com/llvm/llvm-project/commit/22e199e6afb1263c943c0c0d4498694e15bf8a16 [2]: https://lore.kernel.org/ZAxT7T9Xy1Fo3d5W@aurel32.net/ Cc: stable@vger.kernel.org Link: https://github.com/ClangBuiltLinux/linux/issues/1808 Co-developed-by: Conor Dooley Signed-off-by: Conor Dooley Signed-off-by: Nathan Chancellor Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230313-riscv-zicsr-zifencei-fiasco-v1-1-dd1b7840a551@kernel.org Signed-off-by: Palmer Dabbelt commit 943d045a6d796175e5d08f9973953b1d2c07d797 Author: Siddharth Kawar Date: Mon Mar 20 20:37:40 2023 +0000 SUNRPC: fix shutdown of NFS TCP client socket NFS server Duplicate Request Cache (DRC) algorithms rely on NFS clients reconnecting using the same local TCP port. Unique NFS operations are identified by the per-TCP connection set of XIDs. This prevents file corruption when non-idempotent NFS operations are retried. Currently, NFS client TCP connections are using different local TCP ports when reconnecting to NFS servers. After an NFS server initiates shutdown of the TCP connection, the NFS client's TCP socket is set to NULL after the socket state has reached TCP_LAST_ACK(9). When reconnecting, the new socket attempts to reuse the same local port but fails with EADDRNOTAVAIL (99). This forces the socket to use a different local TCP port to reconnect to the remote NFS server. State Transition and Events: TCP_CLOSE_WAIT(8) TCP_LAST_ACK(9) connect(fail EADDRNOTAVAIL(99)) TCP_CLOSE(7) bind on new port connect success dmesg excerpts showing reconnect switching from TCP local port of 926 to 763 after commit 7c81e6a9d75b: [13354.947854] NFS call mkdir testW ... [13405.654781] RPC: xs_tcp_state_change client 00000000037d0f03... [13405.654813] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1 [13405.654826] RPC: xs_data_ready... [13405.654892] RPC: xs_tcp_state_change client 00000000037d0f03... [13405.654895] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 [13405.654899] RPC: xs_tcp_state_change client 00000000037d0f03... [13405.654900] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 [13405.654950] RPC: xs_connect scheduled xprt 00000000037d0f03 [13405.654975] RPC: xs_bind 0.0.0.0:926: ok (0) [13405.654980] RPC: worker connecting xprt 00000000037d0f03 via tcp to 10.101.6.228 (port 2049) [13405.654991] RPC: 00000000037d0f03 connect status 99 connected 0 sock state 7 [13405.655001] RPC: xs_tcp_state_change client 00000000037d0f03... [13405.655002] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 [13405.655024] RPC: xs_connect scheduled xprt 00000000037d0f03 [13405.655038] RPC: xs_bind 0.0.0.0:763: ok (0) [13405.655041] RPC: worker connecting xprt 00000000037d0f03 via tcp to 10.101.6.228 (port 2049) [13405.655065] RPC: 00000000037d0f03 connect status 115 connected 0 sock state 2 State Transition and Events with patch applied: TCP_CLOSE_WAIT(8) TCP_LAST_ACK(9) TCP_CLOSE(7) connect(reuse of port succeeds) dmesg excerpts showing reconnect on same TCP local port of 936 with patch applied: [ 257.139935] NFS: mkdir(0:59/560857152), testQ [ 257.139937] NFS call mkdir testQ ... [ 307.822702] RPC: state 8 conn 1 dead 0 zapped 1 sk_shutdown 1 [ 307.822714] RPC: xs_data_ready... [ 307.822817] RPC: xs_tcp_state_change client 00000000ce702f14... [ 307.822821] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 [ 307.822825] RPC: xs_tcp_state_change client 00000000ce702f14... [ 307.822826] RPC: state 9 conn 0 dead 0 zapped 1 sk_shutdown 3 [ 307.823606] RPC: xs_tcp_state_change client 00000000ce702f14... [ 307.823609] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 [ 307.823629] RPC: xs_tcp_state_change client 00000000ce702f14... [ 307.823632] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 [ 307.823676] RPC: xs_connect scheduled xprt 00000000ce702f14 [ 307.823704] RPC: xs_bind 0.0.0.0:936: ok (0) [ 307.823709] RPC: worker connecting xprt 00000000ce702f14 via tcp to 10.101.1.30 (port 2049) [ 307.823748] RPC: 00000000ce702f14 connect status 115 connected 0 sock state 2 ... [ 314.916193] RPC: state 7 conn 0 dead 0 zapped 1 sk_shutdown 3 [ 314.916251] RPC: xs_connect scheduled xprt 00000000ce702f14 [ 314.916282] RPC: xs_bind 0.0.0.0:936: ok (0) [ 314.916292] RPC: worker connecting xprt 00000000ce702f14 via tcp to 10.101.1.30 (port 2049) [ 314.916342] RPC: 00000000ce702f14 connect status 115 connected 0 sock state 2 Fixes: 7c81e6a9d75b ("SUNRPC: Tweak TCP socket shutdown in the RPC client") Signed-off-by: Siddharth Rajendra Kawar Signed-off-by: Anna Schumaker commit f915da0f0dfb69ffea53f62101b38073e0b81f73 Merge: 9d2789ac9d60c aa01c67de5926 Author: Jens Axboe Date: Thu Mar 23 13:02:20 2023 -0600 Merge tag 'nvme-6.3-2023-03-23' of git://git.infradead.org/nvme into block-6.3 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.3 - send Identify with CNS 06h only to I/O controllers (Martin George) - fix nvme_tcp_term_pdu to match spec (Caleb Sander)" * tag 'nvme-6.3-2023-03-23' of git://git.infradead.org/nvme: nvme-tcp: fix nvme_tcp_term_pdu to match spec nvme: send Identify with CNS 06h only to I/O controllers commit 260595b439776c473cc248f0de63fe78d964d849 Author: Bob Peterson Date: Thu Mar 23 12:26:02 2023 -0400 Reinstate "GFS2: free disk inode which is deleted by remote node -V2" It turns out that reverting commit 970343cd4904 ("GFS2: free disk inode which is deleted by remote node -V2") causes a regression related to evicting inodes that were unlinked on a different cluster node. We could also have simply added a call to d_mark_dontcache() to function gfs2_try_evict(), but the original pre-revert code is better tested and proven. This reverts commit 445cb1277e10d7e19b631ef8a64aa3f055df377d. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 5021383242ada277a38bd052a4c12ed4707faccb Author: Fabrice Gasnier Date: Wed Mar 15 15:44:33 2023 +0100 usb: dwc2: fix a race, don't power off/on phy for dual-role mode When in dual role mode (dr_mode == USB_DR_MODE_OTG), platform probe successively basically calls: - dwc2_gadget_init() - dwc2_hcd_init() - dwc2_lowlevel_hw_disable() since recent change [1] - usb_add_gadget_udc() The PHYs (and so the clocks it may provide) shouldn't be disabled for all SoCs, in OTG mode, as the HCD part has been initialized. On STM32 this creates some weird race condition upon boot, when: - initially attached as a device, to a HOST - and there is a gadget script invoked to setup the device part. Below issue becomes systematic, as long as the gadget script isn't started by userland: the hardware PHYs (and so the clocks provided by the PHYs) remains disabled. It ends up in having an endless interrupt storm, before the watchdog resets the platform. [ 16.924163] dwc2 49000000.usb-otg: EPs: 9, dedicated fifos, 952 entries in SPRAM [ 16.962704] dwc2 49000000.usb-otg: DWC OTG Controller [ 16.966488] dwc2 49000000.usb-otg: new USB bus registered, assigned bus number 2 [ 16.974051] dwc2 49000000.usb-otg: irq 77, io mem 0x49000000 [ 17.032170] hub 2-0:1.0: USB hub found [ 17.042299] hub 2-0:1.0: 1 port detected [ 17.175408] dwc2 49000000.usb-otg: Mode Mismatch Interrupt: currently in Host mode [ 17.181741] dwc2 49000000.usb-otg: Mode Mismatch Interrupt: currently in Host mode [ 17.189303] dwc2 49000000.usb-otg: Mode Mismatch Interrupt: currently in Host mode ... The host part is also not functional, until the gadget part is configured. The HW may only be disabled for peripheral mode (original init), e.g. dr_mode == USB_DR_MODE_PERIPHERAL, until the gadget driver initializes. But when in USB_DR_MODE_OTG, the HW should remain enabled, as the HCD part is able to run, while the gadget part isn't necessarily configured. I don't fully get the of purpose the original change, that claims disabling the hardware is missing. It creates conditions on SOCs using the PHY initialization to be completely non working in OTG mode. Original change [1] should be reworked to be platform specific. [1] https://lore.kernel.org/r/20221206-dwc2-gadget-dual-role-v1-2-36515e1092cd@theobroma-systems.com Fixes: ade23d7b7ec5 ("usb: dwc2: power on/off phy for peripheral mode in dual-role mode") Cc: stable Signed-off-by: Fabrice Gasnier Reviewed-by: Quentin Schulz Tested-by: Quentin Schulz Link: https://lore.kernel.org/r/20230315144433.3095859-1-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit f747313249b74f323ddf841a9c8db14d989f296a Author: Fabrice Gasnier Date: Thu Mar 16 09:41:27 2023 +0100 usb: dwc2: fix a devres leak in hw_enable upon suspend resume Each time the platform goes to low power, PM suspend / resume routines call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset(). This adds a new devres each time. This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be called from udc_start(). This can be seen with tracing: - echo 1 > /sys/kernel/debug/tracing/events/dev/devres_log/enable - go to low power - cat /sys/kernel/debug/tracing/trace A new "ADD" entry is found upon each low power cycle: ... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes) ... A second issue is addressed here: - regulator_bulk_enable() is called upon each PM cycle (suspend/resume). - regulator_bulk_disable() never gets called. So the reference count for these regulators constantly increase, by one upon each low power cycle, due to missing regulator_bulk_disable() call in __dwc2_lowlevel_hw_disable(). The original fix that introduced the devm_add_action_or_reset() call, fixed an issue during probe, that happens due to other errors in dwc2_driver_probe() -> dwc2_core_reset(). Then the probe fails without disabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL. Rather fix the error path: disable all the low level hardware in the error path, by using the "hsotg->ll_hw_enabled" flag. Checking dr_mode has been introduced to avoid a dual call to dwc2_lowlevel_hw_disable(). "ll_hw_enabled" should achieve the same (and is used currently in the remove() routine). Fixes: 54c196060510 ("usb: dwc2: Always disable regulators on driver teardown") Fixes: 33a06f1300a7 ("usb: dwc2: Fix error path in gadget registration") Cc: stable Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230316084127.126084-1-fabrice.gasnier@foss.st.com Signed-off-by: Greg Kroah-Hartman commit 9fd6ba5420ba2b637d1ecc6de8613ec8b9c87e5a Merge: fff5a5e7f528b 88b170088ad2c Author: Linus Torvalds Date: Thu Mar 23 11:05:08 2023 -0700 Merge tag 'zonefs-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fixes from Damien Le Moal: - Silence a false positive smatch warning about an uninitialized variable - Fix an error message to provide more useful information about invalid zone append write results * tag 'zonefs-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: Fix error message in zonefs_file_dio_append() zonefs: Prevent uninitialized symbol 'size' warning commit 451b15ed138ec15bffbebb58a00ebdd884c3e659 Author: Xu Yang Date: Fri Mar 17 14:15:16 2023 +0800 usb: chipidea: core: fix possible concurrent when switch role The user may call role_store() when driver is handling ci_handle_id_switch() which is triggerred by otg event or power lost event. Unfortunately, the controller may go into chaos in this case. Fix this by protecting it with mutex lock. Fixes: a932a8041ff9 ("usb: chipidea: core: add sysfs group") cc: Acked-by: Peter Chen Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20230317061516.2451728-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 3670de80678961eda7fa2220883fc77c16868951 Author: Xu Yang Date: Fri Mar 17 14:15:15 2023 +0800 usb: chipdea: core: fix return -EINVAL if request role is the same with current role It should not return -EINVAL if the request role is the same with current role, return non-error and without do anything instead. Fixes: a932a8041ff9 ("usb: chipidea: core: add sysfs group") cc: Acked-by: Peter Chen Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20230317061516.2451728-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 175b54abc443b6965e9379b71ec05f7c73c192e9 Author: Shyam Prasad N Date: Mon Mar 13 12:17:34 2023 +0000 cifs: print session id while listing open files In the output of /proc/fs/cifs/open_files, we only print the tree id for the tcon of each open file. It becomes difficult to know which tcon these files belong to with just the tree id. This change dumps ses id in addition to all other data today. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit d12bc6d26f92c51b28e8f4a146ffcc630b688198 Author: Shyam Prasad N Date: Mon Mar 13 11:09:12 2023 +0000 cifs: dump pending mids for all channels in DebugData Currently, we only dump the pending mid information only on the primary channel in /proc/fs/cifs/DebugData. If multichannel is active, we do not print the pending MID list on secondary channels. This change will dump the pending mids for all the channels based on server->conn_id. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 896cd316b841053f6df95ab77b5f1322c16a8e18 Author: Shyam Prasad N Date: Thu Mar 9 13:23:29 2023 +0000 cifs: empty interface list when server doesn't support query interfaces When querying server interfaces returns -EOPNOTSUPP, clear the list of interfaces. Assumption is that multichannel would be disabled too. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 072a28c8907c841f7d4b56c78bce46d3ee211e73 Author: Shyam Prasad N Date: Wed Mar 8 12:11:31 2023 +0000 cifs: do not poll server interfaces too regularly We have the server interface list hanging off the tcon structure today for reasons unknown. So each tcon which is connected to a file server can query them separately, which is really unnecessary. To avoid this, in the query function, we will check the time of last update of the interface list, and avoid querying the server if it is within a certain range. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 41841f120345be87a12a4096ebcc2d2959c484ef Author: Krzysztof Kozlowski Date: Wed Mar 22 20:30:51 2023 +0100 arm64: dts: qcom: qrb5165-rb5: Use proper WSA881x shutdown GPIO polarity The WSA881x shutdown GPIO is active low (SD_N), but Linux driver assumed DTS always comes with active high. Since Linux drivers were updated to handle proper flag, correct the DTS. The change is not backwards compatible with older Linux kernel. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322193051.826167-5-krzysztof.kozlowski@linaro.org commit 4ded91530544afdbac350f609e6597076f569e52 Author: Krzysztof Kozlowski Date: Wed Mar 22 20:30:50 2023 +0100 arm64: dts: qcom: sm8250-mtp: Use proper WSA881x shutdown GPIO polarity The WSA881x shutdown GPIO is active low (SD_N), but Linux driver assumed DTS always comes with active high. Since Linux drivers were updated to handle proper flag, correct the DTS. The change is not backwards compatible with older Linux kernel. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322193051.826167-4-krzysztof.kozlowski@linaro.org commit 5b91fab8eae27d1436eacde60107bab9987bbd9d Author: Krzysztof Kozlowski Date: Wed Mar 22 20:30:49 2023 +0100 arm64: dts: qcom: sdm850-samsung-w737: Use proper WSA881x shutdown GPIO polarity The WSA881x shutdown GPIO is active low (SD_N), but Linux driver assumed DTS always comes with active high. Since Linux drivers were updated to handle proper flag, correct the DTS. The change is not backwards compatible with older Linux kernel. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322193051.826167-3-krzysztof.kozlowski@linaro.org commit a246c20c45a0a2bf5e865a4c3a76822b79b38c80 Author: Krzysztof Kozlowski Date: Wed Mar 22 20:30:48 2023 +0100 arm64: dts: qcom: sdm850-lenovo-yoga-c630: Use proper WSA881x shutdown GPIO polarity The WSA881x shutdown GPIO is active low (SD_N), but Linux driver assumed DTS always comes with active high. Since Linux drivers were updated to handle proper flag, correct the DTS. The change is not backwards compatible with older Linux kernel. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322193051.826167-2-krzysztof.kozlowski@linaro.org commit 0b1d9debe30304f35c1211e6dcdca1935ce67240 Author: Ard Biesheuvel Date: Wed Mar 8 00:21:34 2023 +0100 efi/libstub: randomalloc: Return EFI_OUT_OF_RESOURCES on failure The logic in efi_random_alloc() will iterate over the memory map twice, once to count the number of candidate slots, and another time to locate the chosen slot after randomization. If there is insufficient memory to do the allocation, the second loop will run to completion without actually having located a slot, but we currently return EFI_SUCCESS in this case, as we fail to initialize status to the appropriate error value of EFI_OUT_OF_RESOURCES. Signed-off-by: Ard Biesheuvel commit a4a3203426f4b67535d6442ddc5dca8878a0678f Author: Srinivas Kandagatla Date: Thu Mar 23 11:01:25 2023 +0000 ASoC: codecs: lpass: fix the order or clks turn off during suspend The order in which clocks are stopped matters as some of the clock like NPL are derived from MCLK. Without this patch, Dragonboard RB5 DSP would crash with below error: qcom_q6v5_pas 17300000.remoteproc: fatal error received: ABT_dal.c:278:ABTimeout: AHB Bus hang is detected, Number of bus hang detected := 2 , addr0 = 0x3370000 , addr1 = 0x0!!! Turn off fsgen first, followed by npl and then finally mclk, which is exactly the opposite order of enable sequence. Fixes: 1dc3459009c3 ("ASoC: codecs: lpass: register mclk after runtime pm") Reported-by: Amit Pundir Signed-off-by: Srinivas Kandagatla Tested-by: Amit Pundir Link: https://lore.kernel.org/r/20230323110125.23790-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 1271a7b98e7989ba6bb978e14403fc84efe16e13 Author: Uwe Kleine-König Date: Wed Mar 22 22:45:45 2023 +0100 pwm: Zero-initialize the pwm_state passed to driver's .get_state() This is just to ensure that .usage_power is properly initialized and doesn't contain random stack data. The other members of struct pwm_state should get a value assigned in a successful call to .get_state(). So in the absence of bugs in driver implementations, this is only a safe-guard and no fix. Reported-by: Munehisa Kamata Link: https://lore.kernel.org/r/20230310214004.2619480-1-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 8caa81eb950cb2e9d2d6959b37d853162d197f57 Author: Uwe Kleine-König Date: Wed Mar 22 22:45:44 2023 +0100 pwm: meson: Explicitly set .polarity in .get_state() The driver only supports normal polarity. Complete the implementation of .get_state() by setting .polarity accordingly. This fixes a regression that was possible since commit c73a3107624d ("pwm: Handle .get_state() failures") which stopped to zero-initialize the state passed to the .get_state() callback. This was reported at https://forum.odroid.com/viewtopic.php?f=177&t=46360 . While this was an unintended side effect, the real issue is the driver's callback not setting the polarity. There is a complicating fact, that the .apply() callback fakes support for inversed polarity. This is not (and cannot) be matched by .get_state(). As fixing this isn't easy, only point it out in a comment to prevent authors of other drivers from copying that approach. Fixes: c375bcbaabdb ("pwm: meson: Read the full hardware state in meson_pwm_get_state()") Reported-by: Munehisa Kamata Acked-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20230310191405.2606296-1-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 2be4dcf6627e1bcbbef8e6ba1811f5127d39202c Author: Uwe Kleine-König Date: Wed Mar 22 22:45:43 2023 +0100 pwm: sprd: Explicitly set .polarity in .get_state() The driver only supports normal polarity. Complete the implementation of .get_state() by setting .polarity accordingly. Fixes: 8aae4b02e8a6 ("pwm: sprd: Add Spreadtrum PWM support") Link: https://lore.kernel.org/r/20230228135508.1798428-5-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit b20b097128d9145fadcea1cbb45c4d186cb57466 Author: Uwe Kleine-König Date: Wed Mar 22 22:45:42 2023 +0100 pwm: iqs620a: Explicitly set .polarity in .get_state() The driver only supports normal polarity. Complete the implementation of .get_state() by setting .polarity accordingly. Fixes: 6f0841a8197b ("pwm: Add support for Azoteq IQS620A PWM generator") Reviewed-by: Jeff LaBundy Link: https://lore.kernel.org/r/20230228135508.1798428-4-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 30006b77c7e130e01d1ab2148cc8abf73dfcc4bf Author: Uwe Kleine-König Date: Wed Mar 22 22:45:41 2023 +0100 pwm: cros-ec: Explicitly set .polarity in .get_state() The driver only supports normal polarity. Complete the implementation of .get_state() by setting .polarity accordingly. Reviewed-by: Guenter Roeck Fixes: 1f0d3bb02785 ("pwm: Add ChromeOS EC PWM driver") Link: https://lore.kernel.org/r/20230228135508.1798428-3-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 6f57937980142715e927697a6ffd2050f38ed6f6 Author: Uwe Kleine-König Date: Wed Mar 22 22:45:40 2023 +0100 pwm: hibvt: Explicitly set .polarity in .get_state() The driver only both polarities. Complete the implementation of .get_state() by setting .polarity according to the configured hardware state. Fixes: d09f00810850 ("pwm: Add PWM driver for HiSilicon BVT SOCs") Link: https://lore.kernel.org/r/20230228135508.1798428-2-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit f9537b1fa7fb51c2162bc15ce469cbbf1ca0fbfe Author: Hersen Wu Date: Thu Mar 9 15:58:54 2023 -0500 drm/amd/display: Set dcn32 caps.seamless_odm [Why & How] seamless_odm set was not picked up while merging commit 2d017189e2b3 ("drm/amd/display: Blank eDP on enable drv if odm enabled") Fixes: 2d017189e2b3 ("drm/amd/display: Blank eDP on enable drv if odm enabled") Reviewed-by: Qingqing Zhuo Acked-by: Qingqing Zhuo Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4c94e57c258cb7800aa5f3a9d9597d91291407a9 Author: Hersen Wu Date: Thu Mar 9 16:14:08 2023 -0500 drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk [Why & How] When merging commit 9af611f29034 ("drm/amd/display: Fix DCN32 DPSTREAMCLK_CNTL programming"), index change was not picked up. Cc: stable@vger.kernel.org Cc: Mario Limonciello Fixes: 9af611f29034 ("drm/amd/display: Fix DCN32 DPSTREAMCLK_CNTL programming") Reviewed-by: Qingqing Zhuo Acked-by: Qingqing Zhuo Signed-off-by: Hersen Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2b072442f4962231a8516485012bb2d2551ef2fe Author: Kai-Heng Feng Date: Wed Mar 15 20:07:23 2023 +0800 drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi S2idle resume freeze can be observed on Intel ADL + AMD WX5500. This is caused by commit 0064b0ce85bb ("drm/amd/pm: enable ASPM by default"). The root cause is still not clear for now. So extend and apply the ASPM quirk from commit e02fe3bc7aba ("drm/amdgpu: vi: disable ASPM on Intel Alder Lake based systems"), to workaround the issue on Navi cards too. Fixes: 0064b0ce85bb ("drm/amd/pm: enable ASPM by default") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2458 Reviewed-by: Alex Deucher Signed-off-by: Kai-Heng Feng Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 6d457ca162da98a6a1a381320e936d7448177de9 Author: Alex Hung Date: Mon Mar 6 11:39:51 2023 +0800 drm/amd/display: remove outdated 8bpc comments [Why] The commit c76e483cd916 ("drm/amd/display: Don't restrict bpc to 8 bpc") removes the historical 8bpc dependency and sets max_bpc to 16. [How] The comment that states "8bpc for non-edp" needs to be removed as well. Reviewed-by: Harry Wentland Acked-by: Qingqing Zhuo Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e06bfcc1a1c41bcb8c31470d437e147ce9f0acfd Author: Jane Jian Date: Wed Mar 15 18:59:59 2023 +0800 drm/amdgpu/gfx: set cg flags to enter/exit safe mode sriov needs to enter/exit safe mode in update umd p state add the cg flag to let it enter or exit while needed Signed-off-by: Jane Jian Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 033c56474acf567a450f8bafca50e0b610f2b716 Author: YuBiao Wang Date: Thu Mar 16 11:30:32 2023 +0800 drm/amdgpu: Force signal hw_fences that are embedded in non-sched jobs [Why] For engines not supporting soft reset, i.e. VCN, there will be a failed ib test before mode 1 reset during asic reset. The fences in this case are never signaled and next time when we try to free the sa_bo, kernel will hang. [How] During pre_asic_reset, driver will clear job fences and afterwards the fences' refcount will be reduced to 1. For drm_sched_jobs it will be released in job_free_cb, and for non-sched jobs like ib_test, it's meant to be released in sa_bo_free but only when the fences are signaled. So we have to force signal the non_sched bad job's fence during pre_asic_reset or the clear is not complete. Signed-off-by: YuBiao Wang Acked-by: Luben Tuikov Signed-off-by: Alex Deucher commit 4eb0b49a0ad3e004a6a65b84efe37bc7e66d560f Author: Tong Liu01 Date: Wed Mar 15 15:24:22 2023 +0800 drm/amdgpu: add mes resume when do gfx post soft reset [why] when gfx do soft reset, mes will also do reset, if mes is not resumed when do recover from soft reset, mes is unable to respond in later sequence [how] resume mes when do gfx post soft reset Signed-off-by: Tong Liu01 Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit b589626674de94d977e81c99bf7905872b991197 Author: Tim Huang Date: Thu Mar 9 16:27:51 2023 +0800 drm/amdgpu: skip ASIC reset for APUs when go to S4 For GC IP v11.0.4/11, PSP TMR need to be reserved for ASIC mode2 reset. But for S4, when psp suspend, it will destroy the TMR that fails the ASIC reset. [ 96.006101] amdgpu 0000:62:00.0: amdgpu: MODE2 reset [ 100.409717] amdgpu 0000:62:00.0: amdgpu: SMU: I'm not done with your previous command: SMN_C2PMSG_66:0x00000011 SMN_C2PMSG_82:0x00000002 [ 100.411593] amdgpu 0000:62:00.0: amdgpu: Mode2 reset failed! [ 100.412470] amdgpu 0000:62:00.0: PM: pci_pm_freeze(): amdgpu_pmops_freeze+0x0/0x50 [amdgpu] returns -62 [ 100.414020] amdgpu 0000:62:00.0: PM: dpm_run_callback(): pci_pm_freeze+0x0/0xd0 returns -62 [ 100.415311] amdgpu 0000:62:00.0: PM: pci_pm_freeze+0x0/0xd0 returned -62 after 4623202 usecs [ 100.416608] amdgpu 0000:62:00.0: PM: failed to freeze async: error -62 We can skip the reset on APUs, assuming we can resume them properly. Verified on some GFX11, GFX10 and old GFX9 APUs. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit aaee0ce460b954e08b6e630d7e54b2abb672feb8 Author: Tim Huang Date: Wed Mar 15 15:52:09 2023 +0800 drm/amdgpu: reposition the gpu reset checking for reuse Move the amdgpu_acpi_should_gpu_reset out of CONFIG_SUSPEND to share it with hibernate case. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit fc3608aaa5751318837e4bbe0282b3836bca5080 Author: Ard Biesheuvel Date: Wed Mar 22 01:11:18 2023 +0100 efi/libstub: Use relocated version of kernel's struct screen_info In some cases, we expose the kernel's struct screen_info to the EFI stub directly, so it gets populated before even entering the kernel. This means the early console is available as soon as the early param parsing happens, which is nice. It also means we need two different ways to pass this information, as this trick only works if the EFI stub is baked into the core kernel image, which is not always the case. Huacai reports that the preparatory refactoring that was needed to implement this alternative method for zboot resulted in a non-functional efifb earlycon for other cases as well, due to the reordering of the kernel image relocation with the population of the screen_info struct, and the latter now takes place after copying the image to its new location, which means we copy the old, uninitialized state. So let's ensure that the same-image version of alloc_screen_info() produces the correct screen_info pointer, by taking the displacement of the loaded image into account. Reported-by: Huacai Chen Tested-by: Huacai Chen Link: https://lore.kernel.org/linux-efi/20230310021749.921041-1-chenhuacai@loongson.cn/ Fixes: 42c8ea3dca094ab8 ("efi: libstub: Factor out EFI stub entrypoint into separate file") Signed-off-by: Ard Biesheuvel commit 2265098fd6a6272fde3fd1be5761f2f5895bd99a Author: Bhavya Kapoor Date: Fri Mar 17 14:57:11 2023 +0530 mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25 Timing Information in Datasheet assumes that HIGH_SPEED_ENA=1 should be set for SDR12 and SDR25 modes. But sdhci_am654 driver clears HIGH_SPEED_ENA register. Thus, Modify sdhci_am654 to not clear HIGH_SPEED_ENA (HOST_CONTROL[2]) bit for SDR12 and SDR25 speed modes. Fixes: e374e87538f4 ("mmc: sdhci_am654: Clear HISPD_ENA in some lower speed modes") Signed-off-by: Bhavya Kapoor Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230317092711.660897-1-b-kapoor@ti.com Signed-off-by: Ulf Hansson commit b1de5c78ebe9858ccec9d49af2f76724f1d47e3e Author: Liang He Date: Wed Mar 22 14:20:57 2023 +0800 net: mdio: thunder: Add missing fwnode_handle_put() In device_for_each_child_node(), we should add fwnode_handle_put() when break out of the iteration device_for_each_child_node() as it will automatically increase and decrease the refcounter. Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") Signed-off-by: Liang He Signed-off-by: David S. Miller commit 58e84f6b3e84e46524b7e5a916b53c1ad798bc8f Author: Mark Zhang Date: Mon Mar 20 12:59:55 2023 +0200 RDMA/cma: Allow UD qp_type to join multicast only As for multicast: - The SIDR is the only mode that makes sense; - Besides PS_UDP, other port spaces like PS_IB is also allowed, as it is UD compatible. In this case qkey also needs to be set [1]. This patch allows only UD qp_type to join multicast, and set qkey to default if it's not set, to fix an uninit-value error: the ib->rec.qkey field is accessed without being initialized. ===================================================== BUG: KMSAN: uninit-value in cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] BUG: KMSAN: uninit-value in cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cma_iboe_join_multicast drivers/infiniband/core/cma.c:4782 [inline] rdma_join_multicast+0x2b83/0x30a0 drivers/infiniband/core/cma.c:4814 ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 ucma_join_multicast+0x1e3/0x250 drivers/infiniband/core/ucma.c:1546 ucma_write+0x639/0x6d0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28c/0x520 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable ib.i created at: cma_iboe_join_multicast drivers/infiniband/core/cma.c:4737 [inline] rdma_join_multicast+0x586/0x30a0 drivers/infiniband/core/cma.c:4814 ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 CPU: 0 PID: 29874 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ===================================================== [1] https://lore.kernel.org/linux-rdma/20220117183832.GD84788@nvidia.com/ Fixes: b5de0c60cc30 ("RDMA/cma: Fix use after free race in roce multicast join") Reported-by: syzbot+8fcbb77276d43cc8b693@syzkaller.appspotmail.com Signed-off-by: Mark Zhang Link: https://lore.kernel.org/r/58a4a98323b5e6b1282e83f6b76960d06e43b9fa.1679309909.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit fb27e70f6e408dee5d22b083e7a38a59e6118253 Author: Ben Hutchings Date: Wed Mar 22 19:11:45 2023 +0100 modpost: Fix processing of CRCs on 32-bit build machines modpost now reads CRCs from .*.cmd files, parsing them using strtol(). This is inconsistent with its parsing of Module.symvers and with their definition as *unsigned* 32-bit values. strtol() clamps values to [LONG_MIN, LONG_MAX], and when building on a 32-bit system this changes all CRCs >= 0x80000000 to be 0x7fffffff. Change extract_crcs_for_object() to use strtoul() instead. Cc: stable@vger.kernel.org Fixes: f292d875d0dc ("modpost: extract symbol versions from *.cmd files") Signed-off-by: Ben Hutchings Signed-off-by: Masahiro Yamada commit 1073c15fd39e804ad36ff26a7c7d53b0ab51b184 Author: Mirsad Goran Todorovac Date: Wed Mar 22 09:51:07 2023 +0100 scripts: merge_config: Fix typo in variable name. ${WARNOVERRIDE} was misspelled as ${WARNOVVERIDE}, which caused a shell syntax error in certain paths of the script execution. Fixes: 46dff8d7e381 ("scripts: merge_config: Add option to suppress warning on overrides") Signed-off-by: Mirsad Goran Todorovac Reviewed-by: Mark Brown Acked-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit fb63d217e68f5040aec88b63c96355f32d522d01 Merge: 3e212b0b968a0 640fcdbcf27fc Author: Jakub Kicinski Date: Wed Mar 22 22:50:01 2023 -0700 Merge tag 'mlx5-fixes-2023-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-03-21 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: E-Switch, Fix an Oops in error handling code net/mlx5: Read the TC mapping of all priorities on ETS query net/mlx5e: Overcome slow response for first macsec ASO WQE net/mlx5e: Initialize link speed to zero net/mlx5: Fix steering rules cleanup net/mlx5e: Block entering switchdev mode with ns inconsistency net/mlx5e: Set uplink rep as NETNS_LOCAL ==================== Link: https://lore.kernel.org/r/20230321211135.47711-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 3e212b0b968a02ddb36c73ff7e8abe0a2256ce49 Merge: cad4fb02d8a3a 7d46c0e670d5f Author: Jakub Kicinski Date: Wed Mar 22 22:45:22 2023 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-21 (ice) This series contains updates to ice driver only. Piotr sets first_desc field for proper handling of Flow Director packets. Michal moves error checking for VF earlier in function to properly return error before other checks/reporting; he also corrects VSI filter removal to be done during VSI removal and not rebuild. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: remove filters only if VSI is deleted ice: check if VF exists before mode check ice: fix rx buffers handling for flow director packets ==================== Link: https://lore.kernel.org/r/20230321183641.2849726-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit cad4fb02d8a3aa9dff97e10342c253a7b96b371b Merge: 407b508bdd70b c672297bbc0e8 Author: Jakub Kicinski Date: Wed Mar 22 22:42:15 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-21 (iavf, i40e) This series contains updates to iavf and i40e drivers. Stefan Assmann adds check, and return, if driver has already gone through remove to prevent hang for iavf. Radoslaw adds zero initialization to ensure Flow Director packets are populated with correct values for i40e. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: fix flow director packet filter programming iavf: fix hang on reboot with ice ==================== Link: https://lore.kernel.org/r/20230321183548.2849671-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 407b508bdd70b6848993843d96ed49ac4108fb52 Author: Arınç ÜNAL Date: Mon Mar 20 22:05:20 2023 +0300 net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case Move setting the ssc_delta variable to under the PHY_INTERFACE_MODE_TRGMII case as it's only needed when trgmii is used. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Signed-off-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230320190520.124513-3-arinc.unal@arinc9.com Signed-off-by: Jakub Kicinski commit fdcc8ccd823740c18e803b886cec461bc0e64201 Author: Arınç ÜNAL Date: Mon Mar 20 22:05:19 2023 +0300 net: dsa: mt7530: move lowering TRGMII driving to mt7530_setup() Move lowering the TRGMII Tx clock driving to mt7530_setup(), after setting the core clock, as seen on the U-Boot MediaTek ethernet driver. Move the code which looks like it lowers the TRGMII Rx clock driving to after the TRGMII Tx clock driving is lowered. This is run after lowering the Tx clock driving on the U-Boot MediaTek ethernet driver as well. This way, the switch should consume less power regardless of port 6 being used. Update the comment explaining mt7530_pad_clk_setup(). Tested rgmii and trgmii modes of port 6 and rgmii mode of port 5 on MCM MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI Bananapi BPI-R2. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Link: https://source.denx.de/u-boot/u-boot/-/blob/29a48bf9ccba45a5e560bb564bbe76e42629325f/drivers/net/mtk_eth.c#L682 Tested-by: Arınç ÜNAL Signed-off-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230320190520.124513-2-arinc.unal@arinc9.com Signed-off-by: Jakub Kicinski commit 8f058a6ef99f0b88a177b58cc46a44ff5112e40a Author: Arınç ÜNAL Date: Mon Mar 20 22:05:18 2023 +0300 net: dsa: mt7530: move enabling disabling core clock to mt7530_pll_setup() Split the code that enables and disables TRGMII clocks and core clock. Move enabling and disabling core clock to mt7530_pll_setup() as it's supposed to be run there. Add 20 ms delay before enabling the core clock as seen on the U-Boot MediaTek ethernet driver. Change the comment for enabling and disabling TRGMII clocks as the code seems to affect both TXC and RXC. Tested rgmii and trgmii modes of port 6 and rgmii mode of port 5 on MCM MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI Bananapi BPI-R2. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Link: https://source.denx.de/u-boot/u-boot/-/blob/29a48bf9ccba45a5e560bb564bbe76e42629325f/drivers/net/mtk_eth.c#L589 Tested-by: Arınç ÜNAL Signed-off-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230320190520.124513-1-arinc.unal@arinc9.com Signed-off-by: Jakub Kicinski commit 8eac0095de355ee31e1b014f79f83d2cd62a2d04 Author: Grant Grundler Date: Tue Mar 21 10:05:39 2023 -0700 net: asix: fix modprobe "sysfs: cannot create duplicate filename" "modprobe asix ; rmmod asix ; modprobe asix" fails with: sysfs: cannot create duplicate filename \ '/devices/virtual/mdio_bus/usb-003:004' Issue was originally reported by Anton Lundin on 2022-06-22 (link below). Chrome OS team hit the same issue in Feb, 2023 when trying to find work arounds for other issues with AX88172 devices. The use of devm_mdiobus_register() with usbnet devices results in the MDIO data being associated with the USB device. When the asix driver is unloaded, the USB device continues to exist and the corresponding "mdiobus_unregister()" is NOT called until the USB device is unplugged or unauthorized. So the next "modprobe asix" will fail because the MDIO phy sysfs attributes still exist. The 'easy' (from a design PoV) fix is to use the non-devm variants of mdiobus_* functions and explicitly manage this use in the asix_bind and asix_unbind function calls. I've not explored trying to fix usbnet initialization so devm_* stuff will work. Fixes: e532a096be0e5 ("net: usb: asix: ax88772: add phylib support") Reported-by: Anton Lundin Link: https://lore.kernel.org/netdev/20220623063649.GD23685@pengutronix.de/T/ Tested-by: Eizan Miyamoto Signed-off-by: Grant Grundler Link: https://lore.kernel.org/r/20230321170539.732147-1-grundler@chromium.org Signed-off-by: Jakub Kicinski commit 68c3e4fc8628b1487c965aabb29207249657eb5f Author: Joshua Washington Date: Tue Mar 21 10:23:32 2023 -0700 gve: Cache link_speed value from device The link speed is never changed for the uptime of a VM, and the current implementation sends an admin queue command for each call. Admin queue command invocations have nontrivial overhead (e.g., VM exits), which can be disruptive to users if triggered frequently. Our telemetry data shows that there are VMs that make frequent calls to this admin queue command. Caching the result of the original admin queue command would eliminate the need to send multiple admin queue commands on subsequent calls to retrieve link speed. Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.") Signed-off-by: Joshua Washington Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230321172332.91678-1-joshwash@google.com Signed-off-by: Jakub Kicinski commit 2f4e429c846972c8405951a9ff7a82aceeca7461 Author: Shyam Prasad N Date: Mon Feb 20 13:02:11 2023 +0000 cifs: lock chan_lock outside match_session Coverity had rightly indicated a possible deadlock due to chan_lock being done inside match_session. All callers of match_* functions should pick up the necessary locks and call them. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Fixes: 724244cdb382 ("cifs: protect session channel fields with chan_lock") Signed-off-by: Steve French commit 758d29fb3a8b3c756b4e4e0aa9b32ca8cfaf3feb Author: Donald Hunter Date: Sun Mar 19 19:37:58 2023 +0000 tools: ynl: Fix genlmsg header encoding formats The pack strings use 'b' signed char for cmd and version but struct genlmsghdr defines them as unsigned char. Use 'B' instead. Fixes: 4e4480e89c47 ("tools: ynl: move the cli and netlink code around") Signed-off-by: Donald Hunter Link: https://lore.kernel.org/r/20230319193803.97453-1-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit c79493c3ccf06a3aeb72017a96ca3dfd166bc16b Author: Vladimir Oltean Date: Wed Mar 22 01:28:31 2023 +0200 net: enetc: fix aggregate RMON counters not showing the ranges When running "ethtool -S eno0 --groups rmon" without an explicit "--src emac|pmac" argument, the kernel will not report rx-rmon-etherStatsPkts64to64Octets, rx-rmon-etherStatsPkts65to127Octets, etc. This is because on ETHTOOL_MAC_STATS_SRC_AGGREGATE, we do not populate the "ranges" argument. ocelot_port_get_rmon_stats() does things differently and things work there. I had forgotten to make sure that the code is structured the same way in both drivers, so do that now. Fixes: cf52bd238b75 ("net: enetc: add support for MAC Merge statistics counters") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230321232831.1200905-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit b37115b6534c4027df75854a44b485596d368171 Author: Sebastian Reichel Date: Fri Mar 17 18:41:02 2023 +0100 arm64: dts: rockchip: add rk3588 cache level information Add missing, mandatory cache-level information for RK3588. Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20230317174102.61209-1-sebastian.reichel@collabora.com Signed-off-by: Heiko Stuebner commit 52dd5e964a55c98c1b0bcf5fc737a5ddd00e7d4d Author: Brian Gix Date: Mon Mar 6 14:32:21 2023 -0800 Bluetooth: Remove "Power-on" check from Mesh feature The Bluetooth mesh experimental feature enable was requiring the controller to be powered off in order for the Enable to work. Mesh is supposed to be enablable regardless of the controller state, and created an unintended requirement that the mesh daemon be started before the classic bluetoothd daemon. Fixes: af6bcc1921ff ("Bluetooth: Add experimental wrapper for MGMT based mesh") Signed-off-by: Brian Gix Signed-off-by: Luiz Augusto von Dentz commit 1c66bee492a5fe00ae3fe890bb693bfc99f994c6 Author: Min Li Date: Sat Mar 4 21:50:35 2023 +0800 Bluetooth: Fix race condition in hci_cmd_sync_clear There is a potential race condition in hci_cmd_sync_work and hci_cmd_sync_clear, and could lead to use-after-free. For instance, hci_cmd_sync_work is added to the 'req_workqueue' after cancel_work_sync The entry of 'cmd_sync_work_list' may be freed in hci_cmd_sync_clear, and causing kernel panic when it is used in 'hci_cmd_sync_work'. Here's the call trace: dump_stack_lvl+0x49/0x63 print_report.cold+0x5e/0x5d3 ? hci_cmd_sync_work+0x282/0x320 kasan_report+0xaa/0x120 ? hci_cmd_sync_work+0x282/0x320 __asan_report_load8_noabort+0x14/0x20 hci_cmd_sync_work+0x282/0x320 process_one_work+0x77b/0x11c0 ? _raw_spin_lock_irq+0x8e/0xf0 worker_thread+0x544/0x1180 ? poll_idle+0x1e0/0x1e0 kthread+0x285/0x320 ? process_one_work+0x11c0/0x11c0 ? kthread_complete_and_exit+0x30/0x30 ret_from_fork+0x22/0x30 Allocated by task 266: kasan_save_stack+0x26/0x50 __kasan_kmalloc+0xae/0xe0 kmem_cache_alloc_trace+0x191/0x350 hci_cmd_sync_queue+0x97/0x2b0 hci_update_passive_scan+0x176/0x1d0 le_conn_complete_evt+0x1b5/0x1a00 hci_le_conn_complete_evt+0x234/0x340 hci_le_meta_evt+0x231/0x4e0 hci_event_packet+0x4c5/0xf00 hci_rx_work+0x37d/0x880 process_one_work+0x77b/0x11c0 worker_thread+0x544/0x1180 kthread+0x285/0x320 ret_from_fork+0x22/0x30 Freed by task 269: kasan_save_stack+0x26/0x50 kasan_set_track+0x25/0x40 kasan_set_free_info+0x24/0x40 ____kasan_slab_free+0x176/0x1c0 __kasan_slab_free+0x12/0x20 slab_free_freelist_hook+0x95/0x1a0 kfree+0xba/0x2f0 hci_cmd_sync_clear+0x14c/0x210 hci_unregister_dev+0xff/0x440 vhci_release+0x7b/0xf0 __fput+0x1f3/0x970 ____fput+0xe/0x20 task_work_run+0xd4/0x160 do_exit+0x8b0/0x22a0 do_group_exit+0xba/0x2a0 get_signal+0x1e4a/0x25b0 arch_do_signal_or_restart+0x93/0x1f80 exit_to_user_mode_prepare+0xf5/0x1a0 syscall_exit_to_user_mode+0x26/0x50 ret_from_fork+0x15/0x30 Fixes: 6a98e3836fa2 ("Bluetooth: Add helper for serialized HCI command execution") Cc: stable@vger.kernel.org Signed-off-by: Min Li Signed-off-by: Luiz Augusto von Dentz commit 294d749b5df5a22d17989833fb1a0a2cd1dfd243 Author: Kiran K Date: Tue Feb 28 16:31:54 2023 +0530 Bluetooth: btintel: Iterate only bluetooth device ACPI entries Current flow interates over entire ACPI table entries looking for Bluetooth Per Platform Antenna Gain(PPAG) entry. This patch iterates over ACPI entries relvant to Bluetooth device only. Fixes: c585a92b2f9c ("Bluetooth: btintel: Set Per Platform Antenna Gain(PPAG)") Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 2f10e40a948e8a2abe7f983df3959a333ca8955f Author: Pauli Virtanen Date: Mon Feb 20 19:38:24 2023 +0000 Bluetooth: ISO: fix timestamped HCI ISO data packet parsing Use correct HCI ISO data packet header struct when the packet has timestamp. The timestamp, when present, goes before the other fields (Core v5.3 4E 5.4.5), so the structs are not compatible. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit efe375b716c1c1c9b52a816f5b933a95421020a2 Author: Luiz Augusto von Dentz Date: Fri Feb 24 15:54:31 2023 -0800 Bluetooth: btusb: Remove detection of ISO packets over bulk This removes the code introduced by 14202eff214e1e941fefa0366d4c3bc4b1a0d500 as hci_recv_frame is now able to detect ACL packets that are in fact ISO packets. Fixes: 14202eff214e ("Bluetooth: btusb: Detect if an ACL packet is in fact an ISO packet") Signed-off-by: Luiz Augusto von Dentz commit 876e78104f23ce9267822757a63562a609b126c3 Author: Luiz Augusto von Dentz Date: Fri Feb 24 15:43:31 2023 -0800 Bluetooth: hci_core: Detect if an ACL packet is in fact an ISO packet Because some transports don't have a dedicated type for ISO packets (see 14202eff214e1e941fefa0366d4c3bc4b1a0d500) they may use ACL type when in fact they are ISO packets. In the past this was left for the driver to detect such thing but it creates a problem when using the likes of btproxy when used by a VM as the host would not be aware of the connection the guest is doing it won't be able to detect such behavior, so this make bt_recv_frame detect when it happens as it is the common interface to all drivers including guest VMs. Fixes: 14202eff214e ("Bluetooth: btusb: Detect if an ACL packet is in fact an ISO packet") Signed-off-by: Luiz Augusto von Dentz commit 3c44a431d62bf4a20d7b901f98266ae3f4676d48 Author: Zhengping Jiang Date: Tue Feb 21 16:17:56 2023 -0800 Bluetooth: hci_sync: Resume adv with no RPA when active scan The address resolution should be disabled during the active scan, so all the advertisements can reach the host. The advertising has to be paused before disabling the address resolution, because the advertising will prevent any changes to the resolving list and the address resolution status. Skipping this will cause the hci error and the discovery failure. According to the bluetooth specification: "7.8.44 LE Set Address Resolution Enable command This command shall not be used when: - Advertising (other than periodic advertising) is enabled, - Scanning is enabled, or - an HCI_LE_Create_Connection, HCI_LE_Extended_Create_Connection, or HCI_LE_Periodic_Advertising_Create_Sync command is outstanding." If the host is using RPA, the controller needs to generate RPA for the advertising, so the advertising must remain paused during the active scan. If the host is not using RPA, the advertising can be resumed after disabling the address resolution. Fixes: 9afc675edeeb ("Bluetooth: hci_sync: allow advertise when scan without RPA") Signed-off-by: Zhengping Jiang Signed-off-by: Luiz Augusto von Dentz commit b53e8cfec30b93c120623232ba27c041b1ef8f1a Author: Namjae Jeon Date: Tue Mar 21 15:36:40 2023 +0900 ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd returned "Input/output error" when mounting with vers=2.0 to ksmbd. It should return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect. Cc: stable@vger.kernel.org Reported-by: Steve French Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit be6f42fad5f5fd1fea9d562df82c38ad6ed3bfe9 Author: Namjae Jeon Date: Tue Mar 21 15:25:34 2023 +0900 ksmbd: don't terminate inactive sessions after a few seconds Steve reported that inactive sessions are terminated after a few seconds. ksmbd terminate when receiving -EAGAIN error from kernel_recvmsg(). -EAGAIN means there is no data available in timeout. So ksmbd should keep connection with unlimited retries instead of terminating inactive sessions. Cc: stable@vger.kernel.org Reported-by: Steve French Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 2624b445544ffc1472ccabfb6ec867c199d4c95c Author: ChenXiaoSong Date: Thu Mar 2 21:58:04 2023 +0800 ksmbd: fix possible refcount leak in smb2_open() Reference count of acls will leak when memory allocation fails. Fix this by adding the missing posix_acl_release(). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: ChenXiaoSong Acked-by: Namjae Jeon Signed-off-by: Steve French commit 342edb60dcda7a409430359b0cac2864bb9dfe44 Author: Namjae Jeon Date: Tue Mar 7 21:56:07 2023 +0900 ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES Smatch static checker warning: fs/ksmbd/vfs.c:1040 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'length' fs/ksmbd/vfs.c:1041 ksmbd_vfs_fqar_lseek() warn: no lower bound on 'start' Fix unexpected result that could caused from negative start and length. Fixes: f44158485826 ("cifsd: add file operations") Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon Reviewed-by: Sergey Senozhatsky Signed-off-by: Steve French commit 2d74ec97131b1179a373b6d521f195c84e894eb6 Author: Namjae Jeon Date: Sun Mar 5 21:04:00 2023 +0900 ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA Smatch static checker warning: fs/ksmbd/smb2pdu.c:7759 smb2_ioctl() warn: no lower bound on 'off' Fix unexpected result that could caused from negative off and bfz. Fixes: b5e5f9dfc915 ("ksmbd: check invalid FileOffset and BeyondFinalZero in FSCTL_ZERO_DATA") Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon Reviewed-by: Sergey Senozhatsky Signed-off-by: Steve French commit 728f14c72b71a19623df329c1c7c9d1452e56f1e Author: Namjae Jeon Date: Wed Mar 1 00:02:30 2023 +0900 ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION If vfs objects = streams_xattr in ksmbd.conf FILE_NAMED_STREAMS should be set to Attributes in FS_ATTRIBUTE_INFORMATION. MacOS client show "Format: SMB (Unknown)" on faked NTFS and no streams support. Cc: stable@vger.kernel.org Reported-by: Miao Lihua <441884205@qq.com> Tested-by: Miao Lihua <441884205@qq.com> Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 7a891d4b62d62566323676cb0e922ded4f37afe1 Author: Namjae Jeon Date: Wed Mar 1 00:01:21 2023 +0900 ksmbd: fix wrong signingkey creation when encryption is AES256 MacOS and Win11 support AES256 encrytion and it is included in the cipher array of encryption context. Especially on macOS, The most preferred cipher is AES256. Connecting to ksmbd fails on newer MacOS clients that support AES256 encryption. MacOS send disconnect request after receiving final session setup response from ksmbd. Because final session setup is signed with signing key was generated incorrectly. For signging key, 'L' value should be initialized to 128 if key size is 16bytes. Cc: stable@vger.kernel.org Reported-by: Miao Lihua <441884205@qq.com> Tested-by: Miao Lihua <441884205@qq.com> Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit fff5a5e7f528b2ed2c335991399a766c2cf01103 Merge: c13e02d335c82 ceac10c83b330 Author: Linus Torvalds Date: Wed Mar 22 14:15:05 2023 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fix from Russell King: "Just one fix for now to eliminate a KASAN false positive" * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9290/1: uaccess: Fix KASAN false-positives commit c13e02d335c825ffc7f4af3733329d38e695b482 Merge: a1effab7a3a35 caa0708a81d6a Author: Linus Torvalds Date: Wed Mar 22 14:09:20 2023 -0700 Merge tag 'bootconfig-fixes-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig fixes from Masami Hiramatsu: - Fix bootconfig test script to test increased maximum number (8192) node correctly - Change the console message if there is no bootconfig data and the kernel is compiled with CONFIG_BOOT_CONFIG_FORCE=y * tag 'bootconfig-fixes-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Change message if no bootconfig with CONFIG_BOOT_CONFIG_FORCE=y bootconfig: Fix testcase to increase max node commit d18a04157fc171fd48075e3dc96471bd3b87f0dd Author: Douglas Raillard Date: Mon Mar 6 12:27:43 2023 +0000 rcu: Fix rcu_torture_read ftrace event Fix the rcutorturename field so that its size is correctly reported in the text format embedded in trace.dat files. As it stands, it is reported as being of size 1: field:char rcutorturename[8]; offset:8; size:1; signed:0; Signed-off-by: Douglas Raillard Reviewed-by: Mukesh Ojha Cc: stable@vger.kernel.org Fixes: 04ae87a52074e ("ftrace: Rework event_create_dir()") Reviewed-by: Steven Rostedt (Google) [ boqun: Add "Cc" and "Fixes" tags per Steven ] Signed-off-by: Boqun Feng Signed-off-by: Paul E. McKenney commit 5f24a8725fe7bc2c6adf7ce00dd3e818387d8995 Author: Chuck Lever Date: Wed Mar 22 15:01:34 2023 -0400 SUNRPC: Fix a crash in gss_krb5_checksum() Anna says: > KASAN reports [...] a slab-out-of-bounds in gss_krb5_checksum(), > and it can cause my client to panic when running cthon basic > tests with krb5p. > Running faddr2line gives me: > > gss_krb5_checksum+0x4b6/0x630: > ahash_request_free at > /home/anna/Programs/linux-nfs.git/./include/crypto/hash.h:619 > (inlined by) gss_krb5_checksum at > /home/anna/Programs/linux-nfs.git/net/sunrpc/auth_gss/gss_krb5_crypto.c:358 My diagnosis is that the memcpy() at the end of gss_krb5_checksum() reads past the end of the buffer containing the checksum data because the callers have ignored gss_krb5_checksum()'s API contract: * Caller provides the truncation length of the output token (h) in * cksumout.len. Instead they provide the fixed length of the hmac buffer. This length happens to be larger than the value returned by crypto_ahash_digestsize(). Change these errant callers to work like krb5_etm_{en,de}crypt(). As a defensive measure, bound the length of the byte copy at the end of gss_krb5_checksum(). Kunit sez: Testing complete. Ran 68 tests: passed: 68 Elapsed time: 81.680s total, 5.875s configuring, 75.610s building, 0.103s running Reported-by: Anna Schumaker Fixes: 8270dbfcebea ("SUNRPC: Obscure Kerberos integrity keys") Signed-off-by: Chuck Lever commit 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 Author: Trond Myklebust Date: Tue Mar 21 00:17:36 2023 -0400 NFSv4: Fix hangs when recovering open state after a server reboot When we're using a cached open stateid or a delegation in order to avoid sending a CLAIM_PREVIOUS open RPC call to the server, we don't have a new open stateid to present to update_open_stateid(). Instead rely on nfs4_try_open_cached(), just as if we were doing a normal open. Fixes: d2bfda2e7aa0 ("NFSv4: don't reprocess cached open CLAIM_PREVIOUS") Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit bbefb7ed83e639ba1633e807f56b38a71c51fda3 Merge: bbf860ed710ba 58cdfe6f58b35 Author: Greg Kroah-Hartman Date: Wed Mar 22 20:22:53 2023 +0100 Merge tag 'thunderbolt-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.3-rc4 This includes following fixes and quirks for v6.3-rc: - Quirk to disable CL-states on AMD USB4 host routers - Fix memory leak in lane margining - Correct the retimer access flows - Quirk to limit USB3 bandwidth on certain Intel USB4 host routers - Fix usage of scale field when allocting USB3 bandwidth - Fix interrupt "auto clear" on non-Intel USB4 host routers. There are also two commits that are not fixes themselves but are needed for the USB3 bandwidth quirk and for the interrupt auto clear fix to work. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit thunderbolt: Disable interrupt auto clear for rings thunderbolt: Use const qualifier for `ring_interrupt_index` thunderbolt: Use scale field when allocating USB3 bandwidth thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers thunderbolt: Call tb_check_quirks() after initializing adapters thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access thunderbolt: Fix memory leak in margining thunderbolt: Add quirk to disable CLx commit e38c5e80c3d293a883c6f1d553f2146ec0bda35e Author: Hans de Goede Date: Wed Mar 22 15:53:32 2023 +0100 ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750 The Acer Iconia One 7 B1-750 tablet mostly works fine with the defaults for an Bay Trail CR tablet. Except for the internal mic, instead of an analog mic on IN3 a digital mic on DMIC1 is uses. Add a quirk with these settings for this tablet. Acked-by: Pierre-Louis Bossart Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230322145332.131525-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit f1b80a3878b2d76ced46a275fdfd7fb80b4f083b Author: Ido Schimmel Date: Tue Mar 14 17:50:10 2023 +0200 thermal: core: Restore behavior regarding invalid trip points Commit 7c3d5c20dc16 ("thermal/core: Add a generic thermal_zone_get_trip() function") stopped marking trip points with a zero temperature as disabled, behavior that was originally introduced in commit 81ad4276b505 ("Thermal: Ignore invalid trip points"). When using the mlxsw driver we see that when such trip points are not disabled, the thermal subsystem repeatedly tries to set the state of the associated cooling devices to the maximum state. Address this by restoring the original behavior and mark trip points with a zero temperature as disabled. Fixes: 7c3d5c20dc16 ("thermal/core: Add a generic thermal_zone_get_trip() function") Signed-off-by: Ido Schimmel Signed-off-by: Rafael J. Wysocki commit 62faca1ca10cc84e99ae7f38aa28df2bc945369b Author: Chang S. Bae Date: Mon Feb 27 13:05:04 2023 -0800 selftests/x86/amx: Add a ptrace test Include a test case to validate the XTILEDATA injection to the target. Also, it ensures the kernel's ability to copy states between different XSAVE formats. Refactor the memcmp() code to be usable for the state validation. Signed-off-by: Chang S. Bae Signed-off-by: Dave Hansen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20230227210504.18520-3-chang.seok.bae%40intel.com commit b15888840207c2bfe678dd1f68a32db54315e71f Author: Chang S. Bae Date: Mon Feb 27 13:05:03 2023 -0800 x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() __copy_xstate_to_uabi_buf() copies either from the tasks XSAVE buffer or from init_fpstate into the ptrace buffer. Dynamic features, like XTILEDATA, have an all zeroes init state and are not saved in init_fpstate, which means the corresponding bit is not set in the xfeatures bitmap of the init_fpstate header. But __copy_xstate_to_uabi_buf() retrieves addresses for both the tasks xstate and init_fpstate unconditionally via __raw_xsave_addr(). So if the tasks XSAVE buffer has a dynamic feature set, then the address retrieval for init_fpstate triggers the warning in __raw_xsave_addr() which checks the feature bit in the init_fpstate header. Remove the address retrieval from init_fpstate for extended features. They have an all zeroes init state so init_fpstate has zeros for them. Then zeroing the user buffer for the init state is the same as copying them from init_fpstate. Fixes: 2308ee57d93d ("x86/fpu/amx: Enable the AMX feature in 64-bit mode") Reported-by: Mingwei Zhang Link: https://lore.kernel.org/kvm/20230221163655.920289-2-mizhang@google.com/ Signed-off-by: Chang S. Bae Signed-off-by: Dave Hansen Tested-by: Mingwei Zhang Link: https://lore.kernel.org/all/20230227210504.18520-2-chang.seok.bae%40intel.com Cc: stable@vger.kernel.org commit a3f547addcaa10df5a226526bc9e2d9a94542344 Author: Michal Koutný Date: Mon Mar 6 20:31:44 2023 +0100 x86/mm: Do not shuffle CPU entry areas without KASLR The commit 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") fixed an omission of KASLR on CPU entry areas. It doesn't take into account KASLR switches though, which may result in unintended non-determinism when a user wants to avoid it (e.g. debugging, benchmarking). Generate only a single combination of CPU entry areas offsets -- the linear array that existed prior randomization when KASLR is turned off. Since we have 3f148f331814 ("x86/kasan: Map shadow for percpu pages on demand") and followups, we can use the more relaxed guard kasrl_enabled() (in contrast to kaslr_memory_enabled()). Fixes: 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area") Signed-off-by: Michal Koutný Signed-off-by: Dave Hansen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20230306193144.24605-1-mkoutny%40suse.com commit 02a4d923e4400a36d340ea12d8058f69ebf3a383 Author: Savino Dicanosa Date: Tue Mar 21 19:44:02 2023 +0000 io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get() When fixed files are unregistered, file_alloc_end and alloc_hint are not cleared. This can later cause a NULL pointer dereference in io_file_bitmap_get() if auto index selection is enabled via IORING_FILE_INDEX_ALLOC: [ 6.519129] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] [ 6.541468] RIP: 0010:_find_next_zero_bit+0x1a/0x70 [...] [ 6.560906] Call Trace: [ 6.561322] [ 6.561672] io_file_bitmap_get+0x38/0x60 [ 6.562281] io_fixed_fd_install+0x63/0xb0 [ 6.562851] ? __pfx_io_socket+0x10/0x10 [ 6.563396] io_socket+0x93/0xf0 [ 6.563855] ? __pfx_io_socket+0x10/0x10 [ 6.564411] io_issue_sqe+0x5b/0x3d0 [ 6.564914] io_submit_sqes+0x1de/0x650 [ 6.565452] __do_sys_io_uring_enter+0x4fc/0xb20 [ 6.566083] ? __do_sys_io_uring_register+0x11e/0xd80 [ 6.566779] do_syscall_64+0x3c/0x90 [ 6.567247] entry_SYSCALL_64_after_hwframe+0x72/0xdc [...] To fix the issue, set file alloc range and alloc_hint to zero after file tables are freed. Cc: stable@vger.kernel.org Fixes: 4278a0deb1f6 ("io_uring: defer alloc_hint update to io_file_bitmap_set()") Signed-off-by: Savino Dicanosa [axboe: add explicit bitmap == NULL check as well] Signed-off-by: Jens Axboe commit 1a70ca89d59c7c8af006d29b965a95ede0abb0da Author: Matheus Castello Date: Wed Mar 22 15:38:21 2023 +0100 drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found Returns EPROBE_DEFER when of_drm_find_bridge() fails, this is consistent with what all the other DRM bridge drivers are doing and this is required since the bridge might not be there when the driver is probed and this should not be a fatal failure. Cc: Fixes: 30e2ae943c26 ("drm/bridge: Introduce LT8912B DSI to HDMI bridge") Signed-off-by: Matheus Castello Signed-off-by: Francesco Dolcini Reviewed-by: Laurent Pinchart Reviewed-by: Andrzej Hajda Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230322143821.109744-1-francesco@dolcini.it commit ba98413bf45edbf33672e2539e321b851b2cfbd1 Author: Johan Hovold Date: Mon Mar 6 11:35:33 2023 +0100 drm/meson: fix missing component unbind on bind errors Make sure to unbind all subcomponents when binding the aggregate device fails. Fixes: a41e82e6c457 ("drm/meson: Add support for components") Cc: stable@vger.kernel.org # 4.12 Cc: Neil Armstrong Signed-off-by: Johan Hovold Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230306103533.4915-1-johan+linaro@kernel.org commit 915efd8a446b74442039d31689d5d863caf82517 Author: Jesper Dangaard Brouer Date: Tue Mar 21 14:52:31 2023 +0100 xdp: bpf_xdp_metadata use EOPNOTSUPP for no driver support When driver doesn't implement a bpf_xdp_metadata kfunc the fallback implementation returns EOPNOTSUPP, which indicate device driver doesn't implement this kfunc. Currently many drivers also return EOPNOTSUPP when the hint isn't available, which is ambiguous from an API point of view. Instead change drivers to return ENODATA in these cases. There can be natural cases why a driver doesn't provide any hardware info for a specific hint, even on a frame to frame basis (e.g. PTP). Lets keep these cases as separate return codes. When describing the return values, adjust the function kernel-doc layout to get proper rendering for the return values. Fixes: ab46182d0dcb ("net/mlx4_en: Support RX XDP metadata") Fixes: bc8d405b1ba9 ("net/mlx5e: Support RX XDP metadata") Fixes: 306531f0249f ("veth: Support RX XDP metadata") Fixes: 3d76a4d3d4e5 ("bpf: XDP metadata RX kfuncs") Signed-off-by: Jesper Dangaard Brouer Acked-by: Stanislav Fomichev Acked-by: Toke Høiland-Jørgensen Acked-by: Tariq Toukan Link: https://lore.kernel.org/r/167940675120.2718408.8176058626864184420.stgit@firesoul Signed-off-by: Alexei Starovoitov commit 5f4efc9dfcfd8440113057290f624ba2c893afb7 Author: Jaroslav Kysela Date: Wed Mar 22 16:34:04 2023 +0100 ALSA: hda/realtek: Fix support for Dell Precision 3260 Unfortunately, in commit 5911d78fabbb a wrong codec patch was selected. The model=alc283-dac-wcaps is equivalent to ALC283_FIXUP_CHROME_BOOK not ALC295_FIXUP_CHROME_BOOK. Fixes: 5911d78fabbb ("ALSA: hda/realtek: Improve support for Dell Precision 3260") Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230322153404.386473-1-perex@perex.cz Signed-off-by: Takashi Iwai commit aadbd07ff8a75ed342388846da78dfaddb8b106a Author: Jan Beulich Date: Tue Mar 21 09:03:26 2023 +0100 x86/PVH: avoid 32-bit build warning when obtaining VGA console info In the commit referenced below I failed to pay attention to this code also being buildable as 32-bit. Adjust the type of "ret" - there's no real need for it to be wider than 32 bits. Fixes: 934ef33ee75c ("x86/PVH: obtain VGA console info in Dom0") Reported-by: kernel test robot Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/2d2193ff-670b-0a27-e12d-2c5c4c121c79@suse.com Signed-off-by: Juergen Gross commit 6214894f49a967c749ee6c07cb00f9cede748df4 Author: Roger Pau Monne Date: Wed Nov 30 16:09:11 2022 +0100 hvc/xen: prevent concurrent accesses to the shared ring The hvc machinery registers both a console and a tty device based on the hv ops provided by the specific implementation. Those two interfaces however have different locks, and there's no single locks that's shared between the tty and the console implementations, hence the driver needs to protect itself against concurrent accesses. Otherwise concurrent calls using the split interfaces are likely to corrupt the ring indexes, leaving the console unusable. Introduce a lock to xencons_info to serialize accesses to the shared ring. This is only required when using the shared memory console, concurrent accesses to the hypercall based console implementation are not an issue. Note the conditional logic in domU_read_console() is slightly modified so the notify_daemon() call can be done outside of the locked region: it's an hypercall and there's no need for it to be done with the lock held. Fixes: b536b4b96230 ('xen: use the hvc console infrastructure for Xen console') Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20221130150919.13935-1-roger.pau@citrix.com Signed-off-by: Juergen Gross commit e732e39ed9929c05fd219035bc9653ba4100d4fa Author: Arseniy Krasnov Date: Mon Mar 13 10:32:44 2023 +0300 mtd: rawnand: meson: invalidate cache on polling ECC bit 'info_buf' memory is cached and driver polls ECC bit in it. This bit is set by the NAND controller. If 'usleep_range()' returns before device sets this bit, 'info_buf' will be cached and driver won't see update of this bit and will loop forever. Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") Signed-off-by: Arseniy Krasnov Reviewed-by: Neil Armstrong Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/d4ef0bd6-816e-f6fa-9385-f05f775f0ae2@sberdevices.ru commit 9b043c649022ec55040aa9315cc72059c4ec254c Author: Miquel Raynal Date: Fri Mar 10 09:54:52 2023 +0100 mtd: rawnand: nandsim: Artificially prevent sequential page reads The continuous read support added recently makes nandsim unhappy. Indeed, all the supported commands should be re-encoded into internal commands, so of course there is currently no support for the commands and patterns needed for continuous reads to work. I tried to add support for them but nandsim (which is more a tool to develop/debug upper layers rather than the raw NAND core) suffers from a big limitation: it's internal parser needs to know what exact operation is happening when the address cycles are performed. The research is then sequential from the start up to the address cycles, but does not check what's coming next even though the information is available. This is a limitation which is related to the old API used by the core which kind of forced the controllers to guess what operation was being performed rather early. Today the core uses a more transparent API called ->exec_op() which no longer requires controller drivers to do any more guessing, but despite being updated to ->exec_op(), nandsim is still a bit constrained on this regard and thus cannot handle sequential page reads because the start sequence beginning is identical to a regular page read. If the internal algorithm is updated some day, it should be possible to make it support sequential page reads by adding something like: /* Large page devices continuous read page start */ {OPT_LARGEPAGE, {STATE_CMD_READ0, STATE_ADDR_PAGE, STATE_CMD_READSTART, STATE_CMD_READCACHESEQ | ACTION_CPY, STATE_DATAOUT, STATE_READY}}, /* Large page devices continuous read page continue */ {OPT_LARGEPAGE, {STATE_CMD_READCACHESEQ | ACTION_CPY_NEXT, STATE_DATAOUT, STATE_READY}}, /* Large page devices continuous read page end */ {OPT_LARGEPAGE, {STATE_CMD_READCACHEEND | ACTION_CPY_NEXT, STATE_DATAOUT, STATE_READY}}, For now, we just return -EOPNOTSUPP when the core asks controller drivers if they support the feature in order to prevent any further use of these opcodes. Note: This is a hack, ->exec_op() is not supposed to check against the COMMAND opcodes unless _really_ needed. Fixes: 003fe4b9545b ("mtd: rawnand: Support for sequential cache reads") Reported-by: Zhihao Cheng Link: https://lore.kernel.org/linux-mtd/fd34fe55-7f4a-030d-8653-9bb9cf08410d@huawei.com/ Signed-off-by: Miquel Raynal Tested-by: Zhihao Cheng Acked-by: Richard Weinberger Link: https://lore.kernel.org/linux-mtd/20230310085452.1368716-1-miquel.raynal@bootlin.com commit a56cde41340ac4049fa6edac9e6cfbcd2804074e Author: Geert Uytterhoeven Date: Tue Feb 14 15:26:43 2023 +0100 dt-bindings: mtd: jedec,spi-nor: Document CPOL/CPHA support SPI EEPROMs typically support both SPI Mode 0 (CPOL=CPHA=0) and Mode 3 (CPOL=CPHA=1). However, using the latter is currently flagged as an error by "make dtbs_check", e.g.: arch/arm/boot/dts/r8a7791-koelsch.dtb: flash@0: Unevaluated properties are not allowed ('spi-cpha', 'spi-cpol' were unexpected) From schema: Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml Fix this by documenting support for CPOL=CPHA=1. Fixes: 233363aba72ac638 ("spi/panel: dt-bindings: drop CPHA and CPOL from common properties") Cc: stable@vger.kernel.org Signed-off-by: Geert Uytterhoeven Reviewed-by: Miquel Raynal Reviewed-by: Krzysztof Kozlowski Reviewed-by: Tudor Ambarus Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/afe470603028db9374930b0c57464b1f6d52bdd3.1676384304.git.geert+renesas@glider.be commit bb765a743377d46d8da8e7f7e5128022504741b9 Author: Ido Schimmel Date: Tue Mar 21 12:42:00 2023 +0100 mlxsw: spectrum_fid: Fix incorrect local port type Local port is a 10-bit number, but it was mistakenly stored in a u8, resulting in firmware errors when using a netdev corresponding to a local port higher than 255. Fix by storing the local port in u16, as is done in the rest of the code. Fixes: bf73904f5fba ("mlxsw: Add support for 802.1Q FID family") Signed-off-by: Ido Schimmel Reviewed-by: Danielle Ratson Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/eace1f9d96545ab8a2775db857cb7e291a9b166b.1679398549.git.petrm@nvidia.com Signed-off-by: Paolo Abeni commit 07b0883e1f09416d07d25a2158f8cd35b732b686 Author: Johan Hovold Date: Wed Mar 22 12:33:16 2023 +0100 arm64: dts: qcom: sc8280xp-x13s: mark bob regulator as always-on The bob supply is used by several pmic regulators and components which are not (yet fully) described in the devicetree. Mark the regulator as always-on for now. Fixes: f29077d86652 ("arm64: dts: qcom: sc8280xp-x13s: Add soundcard support") Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322113318.17908-5-johan+linaro@kernel.org commit 291e6b6cd7145108d45aeffbac4bb1348fece6b6 Author: Johan Hovold Date: Wed Mar 22 12:33:15 2023 +0100 arm64: dts: qcom: sc8280xp-x13s: mark s12b regulator as always-on The s12b supply is used by several pmic regulators as well as the wlan/bluetooth radio which are not yet fully described in the devicetree. Mark the regulator as always-on for now. Fixes: f29077d86652 ("arm64: dts: qcom: sc8280xp-x13s: Add soundcard support") Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322113318.17908-4-johan+linaro@kernel.org commit f4472fd33e4751c54efb13d2536261e9273770a9 Author: Johan Hovold Date: Wed Mar 22 12:33:14 2023 +0100 arm64: dts: qcom: sc8280xp-x13s: mark s10b regulator as always-on The s10b supply is used by several components that are not (yet) described in devicetree (e.g. ram, charger, ec) and must not be disabled. Mark the regulator as always-on. Fixes: f29077d86652 ("arm64: dts: qcom: sc8280xp-x13s: Add soundcard support") Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322113318.17908-3-johan+linaro@kernel.org commit b8838e653034425cd26983c7d96535e2742a6212 Author: Johan Hovold Date: Wed Mar 22 12:33:13 2023 +0100 arm64: dts: qcom: sc8280xp-x13s: mark s11b regulator as always-on The s11b supply is used by the wlan module (as well as some of the pmics) which are not yet fully described in the devicetree. Mark the regulator as always-on for now. Fixes: 123b30a75623 ("arm64: dts: qcom: sc8280xp-x13s: enable WiFi controller") Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230322113318.17908-2-johan+linaro@kernel.org commit acd0acb802b90f88d19ad4337183e44fd0f77c50 Author: Liang He Date: Wed Mar 22 11:30:57 2023 +0800 platform/surface: aggregator: Add missing fwnode_handle_put() In fwnode_for_each_child_node(), we should add fwnode_handle_put() when break out of the iteration fwnode_for_each_child_node() as it will automatically increase and decrease the refcounter. Fixes: fc622b3d36e6 ("platform/surface: Set up Surface Aggregator device registry") Signed-off-by: Liang He Reviewed-by: Maximilian Luz Link: https://lore.kernel.org/r/20230322033057.1855741-1-windhl@126.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 8a02d70679fc1c434401863333c8ea7dbf201494 Author: Mark Pearson Date: Sun Mar 19 20:32:21 2023 -0400 platform/x86: think-lmi: Add possible_values for ThinkStation ThinkStation platforms don't support the API to return possible_values but instead embed it in the settings string. Try and extract this information and set the possible_values attribute appropriately. Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230320003221.561750-4-mpearson-lenovo@squebb.ca Reviewed-by: Thomas Weißschuh Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit cf337f27f3bfc4aeab4954c468239fd6233c7638 Author: Mark Pearson Date: Sun Mar 19 20:32:20 2023 -0400 platform/x86: think-lmi: only display possible_values if available Some attributes don't have any values available. In those cases don't make the possible_values entry visible. Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230320003221.561750-3-mpearson-lenovo@squebb.ca Reviewed-by: Thomas Weißschuh Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 22c52fa5155a2f48aedb0f675903b20457285a27 Author: Rafael J. Wysocki Date: Fri Mar 17 18:03:40 2023 +0100 ACPI: processor: thermal: Update CPU cooling devices on cpufreq policy changes When a cpufreq policy appears or goes away, the CPU cooling devices for the CPUs covered by that policy need to be updated so that the new processor_get_max_state() value is stored as max_state and the statistics in sysfs are rearranged for each of them. Do that accordingly in acpi_thermal_cpufreq_init() and acpi_thermal_cpufreq_exit(). Fixes: a365105c685c("thermal: sysfs: Reuse cdev->max_state") Reported-by: Wang, Quanxian Link: https://lore.kernel.org/linux-pm/53ec1f06f61c984100868926f282647e57ecfb2d.camel@intel.com Signed-off-by: Rafael J. Wysocki Tested-by: Zhang Rui Reviewed-by: Zhang Rui commit 790930f44289c8209c57461b2db499fcc702e0b3 Author: Rafael J. Wysocki Date: Fri Mar 17 18:01:26 2023 +0100 thermal: core: Introduce thermal_cooling_device_update() Introduce a core thermal API function, thermal_cooling_device_update(), for updating the max_state value for a cooling device and rearranging its statistics in sysfs after a possible change of its ->get_max_state() callback return value. That callback is now invoked only once, during cooling device registration, to populate the max_state field in the cooling device object, so if its return value changes, it needs to be invoked again and the new return value needs to be stored as max_state. Moreover, the statistics presented in sysfs need to be rearranged in general, because there may not be enough room in them to store data for all of the possible states (in the case when max_state grows). The new function takes care of that (and some other minor things related to it), but some extra locking and lockdep annotations are added in several places too to protect against crashes in the cases when the statistics are not present or when a stale max_state value might be used by sysfs attributes. Note that the actual user of the new function will be added separately. Link: https://lore.kernel.org/linux-pm/53ec1f06f61c984100868926f282647e57ecfb2d.camel@intel.com/ Signed-off-by: Rafael J. Wysocki Tested-by: Zhang Rui Reviewed-by: Zhang Rui commit c43198af05cffa5de8d4f356c40ce4bdca066272 Author: Rafael J. Wysocki Date: Fri Mar 17 17:54:34 2023 +0100 thermal: core: Introduce thermal_cooling_device_present() Introduce a helper function, thermal_cooling_device_present(), for checking if the given cooling device is in the list of registered cooling devices to avoid some code duplication in a subsequent patch. No expected functional impact. Signed-off-by: Rafael J. Wysocki Tested-by: Zhang Rui Reviewed-by: Zhang Rui commit c0e0421a60bf468e88cf569fbd727346b138ed04 Author: Rafael J. Wysocki Date: Fri Mar 17 17:52:33 2023 +0100 ACPI: processor: Reorder acpi_processor_driver_init() The cpufreq policy notifier in the ACPI processor driver may as well be registered before the driver itself, which causes acpi_processor_cpufreq_init to be true (unless the notifier registration fails, which is unlikely at that point) when the ACPI CPU thermal cooling devices are registered, so the processor_get_max_state() result does not change while acpi_processor_driver_init() is running. Change the ordering in acpi_processor_driver_init() accordingly to prevent the max_state value from remaining 0 permanently for all ACPI CPU cooling devices due to setting acpi_processor_cpufreq_init too late. [Note that processor_get_max_state() may still return different values at different times after this change, depending on the cpufreq driver registration time, but that issue needs to be addressed separately.] Fixes: a365105c685c("thermal: sysfs: Reuse cdev->max_state") Reported-by: Wang, Quanxian Link: https://lore.kernel.org/linux-pm/53ec1f06f61c984100868926f282647e57ecfb2d.camel@intel.com Signed-off-by: Rafael J. Wysocki Tested-by: Zhang Rui Reviewed-by: Zhang Rui commit 45e21289bfc6e257885514790a8a8887da822d40 Author: Mark Pearson Date: Sun Mar 19 20:32:19 2023 -0400 platform/x86: think-lmi: use correct possible_values delimiters firmware-attributes class requires that possible values are delimited using ';' but the Lenovo firmware uses ',' instead. Parse string and replace where appropriate. Suggested-by: Thomas Weißschuh Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230320003221.561750-2-mpearson-lenovo@squebb.ca Reviewed-by: Thomas Weißschuh Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 583329dcf22e568a328a944f20427ccfc95dce01 Author: Mark Pearson Date: Sun Mar 19 20:32:18 2023 -0400 platform/x86: think-lmi: add missing type attribute This driver was missing the mandatory type attribute...oops. Add it in along with logic to determine whether the attribute is an enumeration type or a string by parsing the possible_values attribute. Upstream bug https://bugzilla.kernel.org/show_bug.cgi?id=216460 Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms") Signed-off-by: Mark Pearson Link: https://lore.kernel.org/r/20230320003221.561750-1-mpearson-lenovo@squebb.ca Reviewed-by: Thomas Weißschuh Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit caa0708a81d6a2217c942959ef40d515ec1d3108 Author: Masami Hiramatsu (Google) Date: Tue Feb 28 10:01:42 2023 +0900 bootconfig: Change message if no bootconfig with CONFIG_BOOT_CONFIG_FORCE=y Change no bootconfig data error message if user do not specify 'bootconfig' option but CONFIG_BOOT_CONFIG_FORCE=y. With CONFIG_BOOT_CONFIG_FORCE=y, the kernel proceeds bootconfig check even if user does not specify 'bootconfig' option. So the current error message is confusing. Let's show just an information message to notice skipping the bootconfig in that case. Link: https://lore.kernel.org/all/167754610254.318944.16848412476667893329.stgit@devnote2/ Fixes: b743852ccc1d ("Allow forcing unconditional bootconfig processing") Reported-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/CAMuHMdV9jJvE2y8gY5V_CxidUikCf5515QMZHzTA3rRGEOj6=w@mail.gmail.com/ Suggested-by: Paul E. McKenney Signed-off-by: Masami Hiramatsu (Google) Tested-by: Paul E. McKenney Acked-by: Mukesh Ojha commit d701cf6578e8447af4ac0fa08e7c5a0fad6df1ae Author: Niklas Schnelle Date: Tue Feb 21 17:10:43 2023 +0100 MAINTAINERS: Update s390-iommu driver maintainer information The s390 DMA API conversion changes currently under review will extend the use of the s390-iommu driver to the DMA API. With s390's mandatory use of an IOMMU this means all DMA for PCI devices will then use the s390-iommu driver. With this in mind and considering my involvement in these changes it makes sense to reflect this increased interdependence in the maintainer structure. Thus add myself as first maintainer and move Gerald to reviewer status. Reviewed-by: Gerald Schaefer Reviewed-by: Matthew Rosato Acked-by: Peter Oberparleiter Signed-off-by: Niklas Schnelle Link: https://lore.kernel.org/r/20230221161043.37065-1-schnelle@linux.ibm.com Signed-off-by: Joerg Roedel commit e51f49512d98783b90799c9cc2002895ec3aa0eb Author: Ranjani Sridharan Date: Wed Mar 22 10:55:38 2023 +0200 ASoC: SOF: ipc4: Ensure DSP is in D0I0 during sof_ipc4_set_get_data() The set_get_data() IPC op bypasses the check for the no_pm flag as done with the regular IPC tx_msg op. Since set_get_data should be performed when the DSP is in D0I0, set the DSP power state to D0I0 before sending the IPC's in sof_ipc4_set_get_data(). Fixes: ceb89acc4dc8 ("ASoC: SOF: ipc4: Add support for mandatory message handling functionality") Signed-off-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Pierre-Louis Bossart Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230322085538.10214-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit f355f70145744518ca1d9799b42f4a8da9aa0d36 Author: Felix Fietkau Date: Tue Mar 14 10:59:52 2023 +0100 wifi: mac80211: fix mesh path discovery based on unicast packets If a packet has reached its intended destination, it was bumped to the code that accepts it, without first checking if a mesh_path needs to be created based on the discovered source. Fix this by moving the destination address check further down. Cc: stable@vger.kernel.org Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230314095956.62085-3-nbd@nbd.name Signed-off-by: Johannes Berg commit 4e348c6c6e23491ae6eb5e077848a42d0562339c Author: Felix Fietkau Date: Tue Mar 14 10:59:50 2023 +0100 wifi: mac80211: fix qos on mesh interfaces When ieee80211_select_queue is called for mesh, the sta pointer is usually NULL, since the nexthop is looked up much later in the tx path. Explicitly check for unicast address in that case in order to make qos work again. Cc: stable@vger.kernel.org Fixes: 50e2ab392919 ("wifi: mac80211: fix queue selection for mesh/OCB interfaces") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230314095956.62085-1-nbd@nbd.name Signed-off-by: Johannes Berg commit 923bf981eb6ecc027227716e30701bdcc1845fbf Author: Johannes Berg Date: Fri Mar 17 10:53:25 2023 +0100 wifi: iwlwifi: mvm: protect TXQ list manipulation Some recent upstream debugging uncovered the fact that in iwlwifi, the TXQ list manipulation is racy. Introduce a new state bit for when the TXQ is completely ready and can be used without locking, and if that's not set yet acquire the lock to check everything correctly. Reviewed-by: Benjamin Berg Tested-by: Jose Ignacio Tornos Martinez Signed-off-by: Johannes Berg commit b58e3d4311b54b6dd0e37165277965da0c9eb21d Author: Johannes Berg Date: Fri Mar 17 10:53:24 2023 +0100 wifi: iwlwifi: mvm: fix mvmtxq->stopped handling This could race if the queue is redirected while full, then the flushing internally would start it while it's not yet usable again. Fix it by using two state bits instead of just one. Reviewed-by: Benjamin Berg Tested-by: Jose Ignacio Tornos Martinez Signed-off-by: Johannes Berg commit 66a1c22b709178e7b823d44465d0c2e5ed7492fb Author: Geert Uytterhoeven Date: Tue Mar 21 09:30:59 2023 +0100 mm/slab: Fix undefined init_cache_node_node() for NUMA and !SMP sh/migor_defconfig: mm/slab.c: In function ‘slab_memory_callback’: mm/slab.c:1127:23: error: implicit declaration of function ‘init_cache_node_node’; did you mean ‘drain_cache_node_node’? [-Werror=implicit-function-declaration] 1127 | ret = init_cache_node_node(nid); | ^~~~~~~~~~~~~~~~~~~~ | drain_cache_node_node The #ifdef condition protecting the definition of init_cache_node_node() no longer matches the conditions protecting the (multiple) users. Fix this by syncing the conditions. Fixes: 76af6a054da40553 ("mm/migrate: add CPU hotplug to demotion #ifdef") Reported-by: Randy Dunlap Link: https://lore.kernel.org/r/b5bdea22-ed2f-3187-6efe-0c72330270a4@infradead.org Signed-off-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Acked-by: Randy Dunlap Cc: Signed-off-by: Vlastimil Babka commit aa01c67de5926fdb276793180564f172c55fb0d7 Author: Caleb Sander Date: Mon Mar 20 09:57:36 2023 -0600 nvme-tcp: fix nvme_tcp_term_pdu to match spec The FEI field of C2HTermReq/H2CTermReq is 4 bytes but not 4-byte-aligned in the NVMe/TCP specification (it is located at offset 10 in the PDU). Split it into two 16-bit integers in struct nvme_tcp_term_pdu so no padding is inserted. There should also be 10 reserved bytes after. There are currently no users of this type. Fixes: fc221d05447aa6db ("nvme-tcp: Add protocol header") Reported-by: Geert Uytterhoeven Signed-off-by: Caleb Sander Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit def84ab600b71ea3fcc422a876d5d0d0daa7d4f3 Author: Martin George Date: Thu Mar 16 17:20:09 2023 +0530 nvme: send Identify with CNS 06h only to I/O controllers Identify CNS 06h (I/O Command Set Specific Identify Controller data structure) is supported only on i/o controllers. But nvme_init_non_mdts_limits() currently invokes this on all controllers. Correct this by ensuring this is sent to I/O controllers only. Signed-off-by: Martin George Signed-off-by: Christoph Hellwig commit 0eee5ae1025699ea93d44fdb6ef2365505082103 Author: Petr Tesarik Date: Tue Mar 21 09:31:27 2023 +0100 swiotlb: fix slot alignment checks Explicit alignment and page alignment are used only to calculate the stride, not when checking actual slot physical address. Originally, only page alignment was implemented, and that worked, because the whole SWIOTLB is allocated on a page boundary, so aligning the start index was sufficient to ensure a page-aligned slot. When commit 1f221a0d0dbf ("swiotlb: respect min_align_mask") added support for min_align_mask, the index could be incremented in the search loop, potentially finding an unaligned slot if minimum device alignment is between IO_TLB_SIZE and PAGE_SIZE. The bug could go unnoticed, because the slot size is 2 KiB, and the most common page size is 4 KiB, so there is no alignment value in between. IIUC the intention has been to find a slot that conforms to all alignment constraints: device minimum alignment, an explicit alignment (given as function parameter) and optionally page alignment (if allocation size is >= PAGE_SIZE). The most restrictive mask can be trivially computed with logical AND. The rest can stay. Fixes: 1f221a0d0dbf ("swiotlb: respect min_align_mask") Fixes: e81e99bacc9f ("swiotlb: Support aligned swiotlb buffers") Signed-off-by: Petr Tesarik Signed-off-by: Christoph Hellwig commit 39e7d2ab6ea9fd6b389091ec223d566934fe7be5 Author: Petr Tesarik Date: Tue Mar 21 09:31:26 2023 +0100 swiotlb: use wrap_area_index() instead of open-coding it No functional change, just use an existing helper. Signed-off-by: Petr Tesarik Signed-off-by: Christoph Hellwig commit 4107b8746d93ace135b8c4da4f19bbae81db785f Author: Zhang Changzhong Date: Tue Mar 21 14:45:43 2023 +1100 net/sonic: use dma_mapping_error() for error check The DMA address returned by dma_map_single() should be checked with dma_mapping_error(). Fix it accordingly. Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") Signed-off-by: Zhang Changzhong Tested-by: Stan Johnson Signed-off-by: Finn Thain Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/6645a4b5c1e364312103f48b7b36783b94e197a2.1679370343.git.fthain@linux-m68k.org Signed-off-by: Jakub Kicinski commit 82463d9dbb5b90a64eb186afda47d703716d02a9 Merge: 8e50ed774554f 5291099e0f61a Author: Jakub Kicinski Date: Tue Mar 21 21:27:12 2023 -0700 Merge branch 'fix-trainwreck-with-ocelot-switch-statistics-counters' Vladimir Oltean says: ==================== Fix trainwreck with Ocelot switch statistics counters While testing the patch set for preemptible traffic classes with some controlled traffic and measuring counter deltas: https://lore.kernel.org/netdev/20230220122343.1156614-1-vladimir.oltean@nxp.com/ I noticed that in the output of "ethtool -S swp0 --groups eth-mac eth-phy eth-ctrl rmon -- --src emac | grep -v ': 0'", the TX counters were off. Quickly I realized that their values were permutated by 1 compared to their names, and that for example tx-rmon-etherStatsPkts64to64Octets was incrementing when tx-rmon-etherStatsPkts65to127Octets should have. Initially I suspected something having to do with the bulk reading logic, and indeed I found a bug there (fixed as 1/3), but that was not the source of the problems. Instead it revealed other problems. While dumping the regions created by the driver on my switch, I figured out that it sees a discontinuity which shouldn't have existed between reg 0x278 and reg 0x280. Discontinuity between last reg 0x0 and new reg 0x0, creating new region Discontinuity between last reg 0x108 and new reg 0x200, creating new region Discontinuity between last reg 0x278 and new reg 0x280, creating new region Discontinuity between last reg 0x2b0 and new reg 0x400, creating new region region of 67 contiguous counters starting with SYS:STAT:CNT[0x000] region of 31 contiguous counters starting with SYS:STAT:CNT[0x080] region of 13 contiguous counters starting with SYS:STAT:CNT[0x0a0] region of 18 contiguous counters starting with SYS:STAT:CNT[0x100] That is where TX_MM_HOLD should have been, and that was the bug, since it was missing. After adding it, the regions look like this and the off-by-one issue is resolved: Discontinuity between last reg 0x000000 and new reg 0x000000, creating new region Discontinuity between last reg 0x000108 and new reg 0x000200, creating new region Discontinuity between last reg 0x0002b0 and new reg 0x000400, creating new region region of 67 contiguous counters starting with SYS:STAT:CNT[0x000] region of 45 contiguous counters starting with SYS:STAT:CNT[0x080] region of 18 contiguous counters starting with SYS:STAT:CNT[0x100] However, as I am thinking out loud, it should have not reported the other counters as off by one even when skipping TX_MM_HOLD... after all, on Ocelot/Seville, there are more counters which need to be skipped. Which is when I investigated and noticed the bug solved in 2/3. I've validated that both on native VSC9959 (which uses ocelot_mm_stats_layout) as well as by faking the other switches by making VSC9959 use the plain ocelot_stats_layout. To summarize: on all Ocelot switches, the TX counters and drop counters are completely broken. The RX counters are mostly fine. With this occasion, I have collected more cleanup patches in this area, which I'm going to submit after the net -> net-next merge. ==================== Link: https://lore.kernel.org/r/20230321010325.897817-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 5291099e0f61a4a1f4d2e11ac2af8123ece17e0e Author: Vladimir Oltean Date: Tue Mar 21 03:03:25 2023 +0200 net: mscc: ocelot: add TX_MM_HOLD to ocelot_mm_stats_layout The lack of a definition for this counter is what initially prompted me to investigate a problem which really manifested itself as the previous change, "net: mscc: ocelot: fix transfer from region->buf to ocelot->stats". When TX_MM_HOLD is defined in enum ocelot_stat but not in struct ocelot_stat_layout ocelot_mm_stats_layout, this creates a hole, which due to the aforementioned bug, makes all counters following TX_MM_HOLD be recorded off by one compared to their correct position. So for example, a non-zero TX_PMAC_OCTETS would be reported as TX_MERGE_FRAGMENTS, TX_PMAC_UNICAST would be reported as TX_PMAC_OCTETS, TX_PMAC_64 would be reported as TX_PMAC_PAUSE, etc etc. This is because the size of the hole (1) is much smaller than the size of the region, so the phenomenon where the stats are off-by-one, rather than lost, prevails. However, the phenomenon where stats are lost can be seen too, for example with DROP_LOCAL, which is at the beginning of its own region (offset 0x000400 vs the previous 0x0002b0 constitutes a discontinuity). This is also reported as off by one and saved to TX_PMAC_1527_MAX, but that counter is not reported to the unstructured "ethtool -S", as opposed to DROP_LOCAL which is (as "drop_local"). Fixes: ab3f97a9610a ("net: mscc: ocelot: export ethtool MAC Merge stats for Felix VSC9959") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 17dfd210459837b453c2a3c20406ee12082f151c Author: Vladimir Oltean Date: Tue Mar 21 03:03:24 2023 +0200 net: mscc: ocelot: fix transfer from region->buf to ocelot->stats To understand the problem, we need some definitions. The driver is aware of multiple counters (enum ocelot_stat), yet not all switches supported by the driver implement all counters. There are 2 statistics layouts: ocelot_stats_layout and ocelot_mm_stats_layout, the latter having 36 counters more than the former. ocelot->stats[] is not a compact array, i.e. there are elements within it which are not going to be populated for ocelot_stats_layout. On the other hand, ocelot->stats[] is easily indexable, for example "tx_octets" for port 3 can be found at ocelot->stats[3 * OCELOT_NUM_STATS + OCELOT_STAT_TX_OCTETS], and that is why we keep it sparse. Regions, as created by ocelot_prepare_stats_regions(), are compact (every element from region->buf will correspond to a counter that is present in this switch's layout) but are not easily indexable. Let's define holes as the ranges of values of enum ocelot_stat for which ocelot_stats_layout doesn't have a "reg" defined. For example, there is a hole between OCELOT_STAT_RX_GREEN_PRIO_7 and OCELOT_STAT_TX_OCTETS which is of 23 elements that are only present on ocelot_mm_stats_layout, and as such, they are also present in enum ocelot_stat. Let's define the left extremity of the hole - the last enum ocelot_stat still defined - as A (in this case OCELOT_STAT_RX_GREEN_PRIO_7) and the right extremity - the first enum ocelot_stat that is defined after a series of undefined ones - as B (in this case OCELOT_STAT_TX_OCTETS). There is a bug in the procedure which transfers stats from region->buf[] to ocelot->stats[]. For each hole in the ocelot_stats_layout, the logic transfers the stats starting with enum ocelot_stat B to ocelot->stats[] index A + 1. So all stats after a hole are saved to a position which is off by B - A + 1 elements. This causes 2 kinds of issues: (a) counters which shouldn't increment increment (b) counters which should increment don't Holes in the ocelot_stat_layout automatically imply the end of a region and the beginning of a new one; however the reverse is not necessarily true. For example, for ocelot_mm_stat_layout, there could be multiple regions (which indicate discontinuities in register addresses) while there is no hole (which indicates discontinuities in enum ocelot_stat values). In the example above, the stats from the second region->buf[] are not transferred to ocelot->stats starting with index "port * OCELOT_NUM_STATS + OCELOT_STAT_TX_OCTETS" as they should, but rather, starting with element "port * OCELOT_NUM_STATS + OCELOT_STAT_RX_GREEN_PRIO_7 + 1". That stats[] array element is not reported to user space for switches that use ocelot_stat_layout, and that is how issue (b) occurs. However, if the length of the second region is larger than the hole, then some stats will start to be transferred to the ocelot->stats[] indices which *are* reported to user space, but those indices contain wrong values (corresponding to unexpected counters). This is how issue (a) occurs. The procedure, as it was introduced in commit d87b1c08f38a ("net: mscc: ocelot: use bulk reads for stats"), was not buggy, because there were no holes in the struct ocelot_stat_layout instances at that time. The problem is that when those holes were introduced, the function was not updated to take them into consideration. To update the procedure, we need to know, for each region, which enum ocelot_stat corresponds to its region->base. We have no way of deducing that based on the contents of struct ocelot_stats_region, so we need to add this information. Fixes: ab3f97a9610a ("net: mscc: ocelot: export ethtool MAC Merge stats for Felix VSC9959") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 6acc72a43eac78a309160d0a7512bbc59bcdd757 Author: Vladimir Oltean Date: Tue Mar 21 03:03:23 2023 +0200 net: mscc: ocelot: fix stats region batching The blamed commit changed struct ocelot_stat_layout :: "u32 offset" to "u32 reg". However, "u32 reg" is not quite a register address, but an enum ocelot_reg, which in itself encodes an enum ocelot_target target in the upper bits, and an index into the ocelot->map[target][] array in the lower bits. So, whereas the previous code comparison between stats_layout[i].offset and last + 1 was correct (because those "offsets" at the time were 32-bit relative addresses), the new code, comparing layout[i].reg to last + 4 is not correct, because the "reg" here is an enum/index, not an actual register address. What we want to compare are indeed register addresses, but to do that, we need to actually go through the same motions as __ocelot_bulk_read_ix() itself. With this bug, all statistics counters are deemed by ocelot_prepare_stats_regions() as constituting their own region. (Truncated) log on VSC9959 (Felix) below (prints added by me): Before: region of 1 contiguous counters starting with SYS:STAT:CNT[0x000] region of 1 contiguous counters starting with SYS:STAT:CNT[0x001] region of 1 contiguous counters starting with SYS:STAT:CNT[0x002] ... region of 1 contiguous counters starting with SYS:STAT:CNT[0x041] region of 1 contiguous counters starting with SYS:STAT:CNT[0x042] region of 1 contiguous counters starting with SYS:STAT:CNT[0x080] region of 1 contiguous counters starting with SYS:STAT:CNT[0x081] ... region of 1 contiguous counters starting with SYS:STAT:CNT[0x0ac] region of 1 contiguous counters starting with SYS:STAT:CNT[0x100] region of 1 contiguous counters starting with SYS:STAT:CNT[0x101] ... region of 1 contiguous counters starting with SYS:STAT:CNT[0x111] After: region of 67 contiguous counters starting with SYS:STAT:CNT[0x000] region of 45 contiguous counters starting with SYS:STAT:CNT[0x080] region of 18 contiguous counters starting with SYS:STAT:CNT[0x100] Since commit d87b1c08f38a ("net: mscc: ocelot: use bulk reads for stats") intended bulking as a performance improvement, and since now, with trivial-sized regions, performance is even worse than without bulking at all, this could easily qualify as a performance regression. Fixes: d4c367650704 ("net: mscc: ocelot: keep ocelot_stat_layout by reg address, not offset") Signed-off-by: Vladimir Oltean Acked-by: Colin Foster Tested-by: Colin Foster Signed-off-by: Jakub Kicinski commit 8e50ed774554f93d55426039b27b1e38d7fa64d8 Author: Eric Dumazet Date: Mon Mar 20 16:34:27 2023 +0000 erspan: do not use skb_mac_header() in ndo_start_xmit() Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit(). Use skb_network_offset() and skb_transport_offset() which better describe what is needed in erspan_fb_xmit() and ip6erspan_tunnel_xmit() syzbot reported: WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline] WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Modules linked in: CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 <0f> 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00 RSP: 0018:ffffc90003b2f830 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003 RBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00 R13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000 FS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __netdev_start_xmit include/linux/netdevice.h:4900 [inline] netdev_start_xmit include/linux/netdevice.h:4914 [inline] __dev_direct_xmit+0x504/0x730 net/core/dev.c:4300 dev_direct_xmit include/linux/netdevice.h:3088 [inline] packet_xmit+0x20a/0x390 net/packet/af_packet.c:285 packet_snd net/packet/af_packet.c:3075 [inline] packet_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0xde/0x190 net/socket.c:747 __sys_sendto+0x23a/0x340 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f123aaa1039 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0 R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 Fixes: 1baf5ebf8954 ("erspan: auto detect truncated packets.") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230320163427.8096-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4fe3c88552a3fbe1944426a4506a18cdeb457b5a Author: Li Zetao Date: Mon Mar 20 14:33:18 2023 +0000 atm: idt77252: fix kmemleak when rmmod idt77252 There are memory leaks reported by kmemleak: unreferenced object 0xffff888106500800 (size 128): comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380 [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0 [<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252] [<000000006efb048e>] local_pci_probe+0xeb/0x1a0 ... unreferenced object 0xffff888106500b00 (size 128): comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s) hex dump (first 32 bytes): 00 20 3d 01 80 88 ff ff 00 20 3d 01 80 88 ff ff . =...... =..... f0 23 3d 01 80 88 ff ff 00 20 3d 01 00 00 00 00 .#=...... =..... backtrace: [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380 [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0 [<00000000f451c5be>] alloc_scq.constprop.0+0x4a/0x400 [idt77252] [<00000000e6313849>] idt77252_init_one+0x28cf/0x3c90 [idt77252] The root cause is traced to the vc_maps which alloced in open_card_oam() are not freed in close_card_oam(). The vc_maps are used to record open connections, so when close a vc_map in close_card_oam(), the memory should be freed. Moreover, the ubr0 is not closed when close a idt77252 device, leading to the memory leak of vc_map and scq_info. Fix them by adding kfree in close_card_oam() and implementing new close_card_ubr0() to close ubr0. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Li Zetao Reviewed-by: Francois Romieu Link: https://lore.kernel.org/r/20230320143318.2644630-1-lizetao1@huawei.com Signed-off-by: Jakub Kicinski commit 968b66ffeb7956acc72836a7797aeb7b2444ec51 Author: Frank Crawford Date: Sat Mar 18 19:05:42 2023 +1100 hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs Fix voltage scaling for chips that have 10.9mV ADCs, where scaling was not performed. Fixes: ead8080351c9 ("hwmon: (it87) Add support for IT8732F") Signed-off-by: Frank Crawford Link: https://lore.kernel.org/r/20230318080543.1226700-2-frank@crawford.emu.id.au [groeck: Update subject and description to focus on bug fix] Signed-off-by: Guenter Roeck commit 3ced71d273f8edf07bf01a831a49ca6b988e06b3 Author: Kevin Locke Date: Tue Mar 21 15:39:22 2023 -0600 kbuild: deb-pkg: set version for linux-headers paths As a result of the switch to dh_listpackages, $version is no longer set when install_kernel_headers() is called. This causes files in the linux-headers deb package to be installed to a path with an empty $version (e.g. /usr/src/linux-headers-/scripts/sign-file rather than /usr/src/linux-headers-6.3.0-rc3/scripts/sign-file). To avoid this, while continuing to use the version information from dh_listpackages, pass $version from $package as the second argument of install_kernel_headers(). Fixes: 36862e14e316 ("kbuild: deb-pkg: use dh_listpackages to know enabled packages") Signed-off-by: Kevin Locke Signed-off-by: Masahiro Yamada commit 032a954061afd4b7426c3eb6bfd2952ef1e9a384 Author: Álvaro Fernández Rojas Date: Sun Mar 19 10:55:40 2023 +0100 net: dsa: tag_brcm: legacy: fix daisy-chained switches When BCM63xx internal switches are connected to switches with a 4-byte Broadcom tag, it does not identify the packet as VLAN tagged, so it adds one based on its PVID (which is likely 0). Right now, the packet is received by the BCM63xx internal switch and the 6-byte tag is properly processed. The next step would to decode the corresponding 4-byte tag. However, the internal switch adds an invalid VLAN tag after the 6-byte tag and the 4-byte tag handling fails. In order to fix this we need to remove the invalid VLAN tag after the 6-byte tag before passing it to the 4-byte tag decoding. Fixes: 964dbf186eaa ("net: dsa: tag_brcm: add support for legacy tags") Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Michal Swiatkowski Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230319095540.239064-1-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 9a801afd3eb95e1a89aba17321062df06fb49d98 Author: Dylan Jhong Date: Mon Mar 13 11:49:06 2023 +0800 riscv: mm: Fix incorrect ASID argument when flushing TLB Currently, we pass the CONTEXTID instead of the ASID to the TLB flush function. We should only take the ASID field to prevent from touching the reserved bit field. Fixes: 3f1e782998cd ("riscv: add ASID-based tlbflushing methods") Signed-off-by: Dylan Jhong Reviewed-by: Sergey Matyukevich Link: https://lore.kernel.org/r/20230313034906.2401730-1-dylan@andestech.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit a1effab7a3a35a837dd9d2b974a1bc4939df1ad5 Merge: a2eaf246f5732 4928f67bc911e Author: Linus Torvalds Date: Tue Mar 21 15:46:39 2023 -0700 Merge tag 'vfio-v6.3-rc4' of https://github.com/awilliam/linux-vfio Pull VFIO fix from Alex Williamson: - Fix dirty size reporting for pre-copy in mlx5 variant driver (Yishai Hadas) * tag 'vfio-v6.3-rc4' of https://github.com/awilliam/linux-vfio: vfio/mlx5: Fix the report of dirty_bytes upon pre-copy commit a2eaf246f5732519f3dcc34e18fd41909e226284 Merge: 2faac9a98f010 27c934dd8832d Author: Linus Torvalds Date: Tue Mar 21 14:48:38 2023 -0700 Merge tag 'nfsd-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Fix a crash during NFS READs from certain client implementations - Address a minor kbuild regression in v6.3 * tag 'nfsd-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: don't replace page in rq_pages if it's a continuation of last page NFS & NFSD: Update GSS dependencies commit 640fcdbcf27fc62de9223f958ceb4e897a00e791 Author: Dan Carpenter Date: Mon Feb 27 14:16:10 2023 +0300 net/mlx5: E-Switch, Fix an Oops in error handling code The error handling dereferences "vport". There is nothing we can do if it is an error pointer except returning the error code. Fixes: 133dcfc577ea ("net/mlx5: E-Switch, Alloc and free unique metadata for match") Signed-off-by: Dan Carpenter Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 44d553188c38ac74b799dfdcebafef2f7bb70942 Author: Maher Sanalla Date: Wed Mar 15 11:04:38 2023 +0200 net/mlx5: Read the TC mapping of all priorities on ETS query When ETS configurations are queried by the user to get the mapping assignment between packet priority and traffic class, only priorities up to maximum TCs are queried from QTCT register in FW to retrieve their assigned TC, leaving the rest of the priorities mapped to the default TC #0 which might be misleading. Fix by querying the TC mapping of all priorities on each ETS query, regardless of the maximum number of TCs configured in FW. Fixes: 820c2c5e773d ("net/mlx5e: Read ETS settings directly from firmware") Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 7e3fce82d945cf6e7f99034b113ff2d250d7524d Author: Emeel Hakim Date: Mon Mar 20 13:13:55 2023 +0200 net/mlx5e: Overcome slow response for first macsec ASO WQE First ASO WQE poll causes a cache miss in hardware hence the resut is delayed. It causes to the situation where such WQE is polled earlier than it is needed. Add logic to retry ASO CQ polling operation. Fixes: 739cfa34518e ("net/mlx5: Make ASO poll CQ usable in atomic context")  Signed-off-by: Emeel Hakim Reviewed-by: Leon Romanovsky Reviewed-by: Raed Salem Signed-off-by: Saeed Mahameed commit 6e9d51b1a5cb8d750c3daf89db4f4cdfd1051819 Author: Roy Novich Date: Wed Mar 1 15:47:11 2023 +0200 net/mlx5e: Initialize link speed to zero mlx5e_port_max_linkspeed does not guarantee value assignment for speed. Avoid cases where link_speed might be used uninitialized. In case mlx5e_port_max_linkspeed fails, a default link speed of 50000 will be used for the calculations. Fixes: 3f6d08d196b2 ("net/mlx5e: Add RSS support for hairpin") Signed-off-by: Roy Novich Reviewed-by: Tariq Toukan Reviewed-by: Aya Levin Signed-off-by: Saeed Mahameed commit 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 Author: Lama Kayal Date: Tue Jan 31 14:07:03 2023 +0200 net/mlx5: Fix steering rules cleanup vport's mc, uc and multicast rules are not deleted in teardown path when EEH happens. Since the vport's promisc settings(uc, mc and all) in firmware are reset after EEH, mlx5 driver will try to delete the above rules in the initialization path. This cause kernel crash because these software rules are no longer valid. Fix by nullifying these rules right after delete to avoid accessing any dangling pointers. Call Trace: __list_del_entry_valid+0xcc/0x100 (unreliable) tree_put_node+0xf4/0x1b0 [mlx5_core] tree_remove_node+0x30/0x70 [mlx5_core] mlx5_del_flow_rules+0x14c/0x1f0 [mlx5_core] esw_apply_vport_rx_mode+0x10c/0x200 [mlx5_core] esw_update_vport_rx_mode+0xb4/0x180 [mlx5_core] esw_vport_change_handle_locked+0x1ec/0x230 [mlx5_core] esw_enable_vport+0x130/0x260 [mlx5_core] mlx5_eswitch_enable_sriov+0x2a0/0x2f0 [mlx5_core] mlx5_device_enable_sriov+0x74/0x440 [mlx5_core] mlx5_load_one+0x114c/0x1550 [mlx5_core] mlx5_pci_resume+0x68/0xf0 [mlx5_core] eeh_report_resume+0x1a4/0x230 eeh_pe_dev_traverse+0x98/0x170 eeh_handle_normal_event+0x3e4/0x640 eeh_handle_event+0x4c/0x370 eeh_event_handler+0x14c/0x210 kthread+0x168/0x1b0 ret_from_kernel_thread+0x5c/0x84 Fixes: a35f71f27a61 ("net/mlx5: E-Switch, Implement promiscuous rx modes vf request handling") Signed-off-by: Huy Nguyen Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 662404b24a4c4d839839ed25e3097571f5938b9b Author: Gavin Li Date: Thu Feb 9 12:48:52 2023 +0200 net/mlx5e: Block entering switchdev mode with ns inconsistency Upon entering switchdev mode, VF/SF representors are spawned in the devlink instance's net namespace, whereas the PF net device transforms into the uplink representor, remaining in the net namespace the PF net device was in. Therefore, if a PF net device's namespace is different from its parent devlink net namespace, entering switchdev mode can create an illegal situation where all representors sharing the same core device are NOT in the same net namespace. To avoid this issue, block entering switchdev mode for devices whose child netdev net namespace has diverged from the parent devlink's. Fixes: 7768d1971de6 ("net/mlx5: E-Switch, Add control for encapsulation") Signed-off-by: Gavin Li Reviewed-by: Gavi Teitz Signed-off-by: Saeed Mahameed commit c83172b0639c8a005c0dd3b36252dc22ddd9f19c Author: Gavin Li Date: Fri Nov 25 04:15:40 2022 +0200 net/mlx5e: Set uplink rep as NETNS_LOCAL Previously, NETNS_LOCAL was not set for uplink representors, inconsistent with VF representors, and allowed the uplink representor to be moved between net namespaces and separated from the VF representors it shares the core device with. Such usage would break the isolation model of namespaces, as devices in different namespaces would have access to shared memory. To solve this issue, set NETNS_LOCAL for uplink representors if eswitch is in switchdev mode. Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") Signed-off-by: Gavin Li Reviewed-by: Gavi Teitz Signed-off-by: Saeed Mahameed commit 10ec8ca8ec1a2f04c4ed90897225231c58c124a7 Author: Daniel Borkmann Date: Mon Mar 20 15:37:25 2023 +0100 bpf: Adjust insufficient default bpf_jit_limit We've seen recent AWS EKS (Kubernetes) user reports like the following: After upgrading EKS nodes from v20230203 to v20230217 on our 1.24 EKS clusters after a few days a number of the nodes have containers stuck in ContainerCreating state or liveness/readiness probes reporting the following error: Readiness probe errored: rpc error: code = Unknown desc = failed to exec in container: failed to start exec "4a11039f730203ffc003b7[...]": OCI runtime exec failed: exec failed: unable to start container process: unable to init seccomp: error loading seccomp filter into kernel: error loading seccomp filter: errno 524: unknown However, we had not been seeing this issue on previous AMIs and it only started to occur on v20230217 (following the upgrade from kernel 5.4 to 5.10) with no other changes to the underlying cluster or workloads. We tried the suggestions from that issue (sysctl net.core.bpf_jit_limit=452534528) which helped to immediately allow containers to be created and probes to execute but after approximately a day the issue returned and the value returned by cat /proc/vmallocinfo | grep bpf_jit | awk '{s+=$2} END {print s}' was steadily increasing. I tested bpf tree to observe bpf_jit_charge_modmem, bpf_jit_uncharge_modmem their sizes passed in as well as bpf_jit_current under tcpdump BPF filter, seccomp BPF and native (e)BPF programs, and the behavior all looks sane and expected, that is nothing "leaking" from an upstream perspective. The bpf_jit_limit knob was originally added in order to avoid a situation where unprivileged applications loading BPF programs (e.g. seccomp BPF policies) consuming all the module memory space via BPF JIT such that loading of kernel modules would be prevented. The default limit was defined back in 2018 and while good enough back then, we are generally seeing far more BPF consumers today. Adjust the limit for the BPF JIT pool from originally 1/4 to now 1/2 of the module memory space to better reflect today's needs and avoid more users running into potentially hard to debug issues. Fixes: fdadd04931c2 ("bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K") Reported-by: Stephen Haynes Reported-by: Lefteris Alexakis Signed-off-by: Daniel Borkmann Link: https://github.com/awslabs/amazon-eks-ami/issues/1179 Link: https://github.com/awslabs/amazon-eks-ami/issues/1219 Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230320143725.8394-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit fbaa38214cd9e150764ccaa82e04ecf42cc1140c Author: Lukas Wunner Date: Sat Mar 11 15:40:01 2023 +0100 cxl/pci: Fix CDAT retrieval on big endian The CDAT exposed in sysfs differs between little endian and big endian arches: On big endian, every 4 bytes are byte-swapped. PCI Configuration Space is little endian (PCI r3.0 sec 6.1). Accessors such as pci_read_config_dword() implicitly swap bytes on big endian. That way, the macros in include/uapi/linux/pci_regs.h work regardless of the arch's endianness. For an example of implicit byte-swapping, see ppc4xx_pciex_read_config(), which calls in_le32(), which uses lwbrx (Load Word Byte-Reverse Indexed). DOE Read/Write Data Mailbox Registers are unlike other registers in Configuration Space in that they contain or receive a 4 byte portion of an opaque byte stream (a "Data Object" per PCIe r6.0 sec 7.9.24.5f). They need to be copied to or from the request/response buffer verbatim. So amend pci_doe_send_req() and pci_doe_recv_resp() to undo the implicit byte-swapping. The CXL_DOE_TABLE_ACCESS_* and PCI_DOE_DATA_OBJECT_DISC_* macros assume implicit byte-swapping. Byte-swap requests after constructing them with those macros and byte-swap responses before parsing them. Change the request and response type to __le32 to avoid sparse warnings. Per a request from Jonathan, replace sizeof(u32) with sizeof(__le32) for consistency. Fixes: c97006046c79 ("cxl/port: Read CDAT table") Tested-by: Ira Weiny Signed-off-by: Lukas Wunner Reviewed-by: Dan Williams Cc: stable@vger.kernel.org # v6.0+ Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/3051114102f41d19df3debbee123129118fc5e6d.1678543498.git.lukas@wunner.de Signed-off-by: Dan Williams commit 2faac9a98f010cf5b342fa89ac489c4586364e6e Merge: 17214b70a159c 3584c1dbfffda Author: Linus Torvalds Date: Tue Mar 21 11:38:58 2023 -0700 Merge tag 'keys-fixes-20230321' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull keyrings fixes from David Howells: - Fix request_key() so that it doesn't cache a looked up key on the current thread if that thread is a kernel thread. The cache is cleared during notify_resume - but that doesn't happen in kernel threads. This is causing cifs DNS keys to be un-invalidateable. - Fix a wrapper check in verify_pefile() to not round up the length. - Change asymmetric_keys code to log errors to make it easier for users to work out why failures occurred. * tag 'keys-fixes-20230321' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: asymmetric_keys: log on fatal failures in PE/pkcs7 verify_pefile: relax wrapper length check keys: Do not cache key in task struct if key is requested from kernel thread commit c672297bbc0e86dbf88396b8053e2fbb173f16ff Author: Radoslaw Tyl Date: Mon Mar 13 15:07:33 2023 +0100 i40e: fix flow director packet filter programming Initialize to zero structures to build a valid Tx Packet used for the filter programming. Fixes: a9219b332f52 ("i40e: VLAN field for flow director") Signed-off-by: Radoslaw Tyl Reviewed-by: Michal Swiatkowski Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 4e264be98b88a6d6f476c11087fe865696e8bef5 Author: Stefan Assmann Date: Mon Mar 13 17:06:45 2023 +0100 iavf: fix hang on reboot with ice When a system with E810 with existing VFs gets rebooted the following hang may be observed. Pid 1 is hung in iavf_remove(), part of a network driver: PID: 1 TASK: ffff965400e5a340 CPU: 24 COMMAND: "systemd-shutdow" #0 [ffffaad04005fa50] __schedule at ffffffff8b3239cb #1 [ffffaad04005fae8] schedule at ffffffff8b323e2d #2 [ffffaad04005fb00] schedule_hrtimeout_range_clock at ffffffff8b32cebc #3 [ffffaad04005fb80] usleep_range_state at ffffffff8b32c930 #4 [ffffaad04005fbb0] iavf_remove at ffffffffc12b9b4c [iavf] #5 [ffffaad04005fbf0] pci_device_remove at ffffffff8add7513 #6 [ffffaad04005fc10] device_release_driver_internal at ffffffff8af08baa #7 [ffffaad04005fc40] pci_stop_bus_device at ffffffff8adcc5fc #8 [ffffaad04005fc60] pci_stop_and_remove_bus_device at ffffffff8adcc81e #9 [ffffaad04005fc70] pci_iov_remove_virtfn at ffffffff8adf9429 #10 [ffffaad04005fca8] sriov_disable at ffffffff8adf98e4 #11 [ffffaad04005fcc8] ice_free_vfs at ffffffffc04bb2c8 [ice] #12 [ffffaad04005fd10] ice_remove at ffffffffc04778fe [ice] #13 [ffffaad04005fd38] ice_shutdown at ffffffffc0477946 [ice] #14 [ffffaad04005fd50] pci_device_shutdown at ffffffff8add58f1 #15 [ffffaad04005fd70] device_shutdown at ffffffff8af05386 #16 [ffffaad04005fd98] kernel_restart at ffffffff8a92a870 #17 [ffffaad04005fda8] __do_sys_reboot at ffffffff8a92abd6 #18 [ffffaad04005fee0] do_syscall_64 at ffffffff8b317159 #19 [ffffaad04005ff08] __context_tracking_enter at ffffffff8b31b6fc #20 [ffffaad04005ff18] syscall_exit_to_user_mode at ffffffff8b31b50d #21 [ffffaad04005ff28] do_syscall_64 at ffffffff8b317169 #22 [ffffaad04005ff50] entry_SYSCALL_64_after_hwframe at ffffffff8b40009b RIP: 00007f1baa5c13d7 RSP: 00007fffbcc55a98 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1baa5c13d7 RDX: 0000000001234567 RSI: 0000000028121969 RDI: 00000000fee1dead RBP: 00007fffbcc55ca0 R8: 0000000000000000 R9: 00007fffbcc54e90 R10: 00007fffbcc55050 R11: 0000000000000202 R12: 0000000000000005 R13: 0000000000000000 R14: 00007fffbcc55af0 R15: 0000000000000000 ORIG_RAX: 00000000000000a9 CS: 0033 SS: 002b During reboot all drivers PM shutdown callbacks are invoked. In iavf_shutdown() the adapter state is changed to __IAVF_REMOVE. In ice_shutdown() the call chain above is executed, which at some point calls iavf_remove(). However iavf_remove() expects the VF to be in one of the states __IAVF_RUNNING, __IAVF_DOWN or __IAVF_INIT_FAILED. If that's not the case it sleeps forever. So if iavf_shutdown() gets invoked before iavf_remove() the system will hang indefinitely because the adapter is already in state __IAVF_REMOVE. Fix this by returning from iavf_remove() if the state is __IAVF_REMOVE, as we already went through iavf_shutdown(). Fixes: 974578017fc1 ("iavf: Add waiting so the port is initialized in remove") Fixes: a8417330f8a5 ("iavf: Fix race condition between iavf_shutdown and iavf_remove") Reported-by: Marius Cornea Signed-off-by: Stefan Assmann Reviewed-by: Michal Kubiak Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit cdce67099117ece371582f706c6eff7d3a65326d Author: Yoshihiro Shimoda Date: Fri Mar 10 21:34:58 2023 +0900 PCI: dwc: Fix PORT_LINK_CONTROL update when CDM check enabled If CDM_CHECK is enabled (by the DT "snps,enable-cdm-check" property), 'val' is overwritten by PCIE_PL_CHK_REG_CONTROL_STATUS initialization. Commit ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists") did not account for further usage of 'val', so we wrote improper values to PCIE_PORT_LINK_CONTROL when the CDM check is enabled. Move the PCIE_PORT_LINK_CONTROL update to be completely after the PCIE_PL_CHK_REG_CONTROL_STATUS register initialization. [bhelgaas: commit log adapted from Serge's version] Fixes: ec7b952f453c ("PCI: dwc: Always enable CDM check if "snps,enable-cdm-check" exists") Link: https://lore.kernel.org/r/20230310123510.675685-2-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Yoshihiro Shimoda Signed-off-by: Bjorn Helgaas Reviewed-by: Serge Semin commit 632e04739c8f45c2d9ca4d4c5bd18d80c2ac9296 Author: Alexander Stein Date: Fri Mar 10 08:49:40 2023 +0100 clk: rs9: Fix suspend/resume Disabling the cache in commit 2ff4ba9e3702 ("clk: rs9: Fix I2C accessors") without removing cache synchronization in resume path results in a kernel panic as map->cache_ops is unset, due to REGCACHE_NONE. Enable flat cache again to support resume again. num_reg_defaults_raw is necessary to read the cache defaults from hardware. Some registers are strapped in hardware and cannot be provided in software. Fixes: 2ff4ba9e3702 ("clk: rs9: Fix I2C accessors") Signed-off-by: Alexander Stein Link: https://lore.kernel.org/r/20230310074940.3475703-1-alexander.stein@ew.tq-group.com Signed-off-by: Stephen Boyd commit 7d46c0e670d5f646879b52bacc387bf48ff0e7f1 Author: Michal Swiatkowski Date: Mon Mar 13 13:09:15 2023 +0100 ice: remove filters only if VSI is deleted Filters shouldn't be removed in VSI rebuild path. Removing them on PF VSI results in no rule for PF MAC after changing for example queues amount. Remove all filters only in the VSI remove flow. As unload should also cause the filter to be removed introduce, a new function ice_stop_eth(). It will unroll ice_start_eth(), so remove filters and close VSI. Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Signed-off-by: Michal Swiatkowski Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 83b49e7f63da88a1544cba2b2e40bfabb24bd203 Author: Michal Swiatkowski Date: Fri Mar 10 12:33:44 2023 +0100 ice: check if VF exists before mode check Setting trust on VF should return EINVAL when there is no VF. Move checking for switchdev mode after checking if VF exists. Fixes: c54d209c78b8 ("ice: Wait for VF to be reset/ready before configuration") Signed-off-by: Michal Swiatkowski Signed-off-by: Kalyan Kodamagula Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit 387d42ae6df76d2ae813432d05630535a5480038 Author: Piotr Raczynski Date: Thu Mar 9 13:38:56 2023 -0800 ice: fix rx buffers handling for flow director packets Adding flow director filters stopped working correctly after commit 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side"). As a result, only first flow director filter can be added, adding next filter leads to NULL pointer dereference attached below. Rx buffer handling and reallocation logic has been optimized, however flow director specific traffic was not accounted for. As a result driver handled those packets incorrectly since new logic was based on ice_rx_ring::first_desc which was not set in this case. Fix this by setting struct ice_rx_ring::first_desc to next_to_clean for flow director received packets. [ 438.544867] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 438.551840] #PF: supervisor read access in kernel mode [ 438.556978] #PF: error_code(0x0000) - not-present page [ 438.562115] PGD 7c953b2067 P4D 0 [ 438.565436] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 438.569794] CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.2.0-net-bug #1 [ 438.577531] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [ 438.588470] RIP: 0010:ice_clean_rx_irq+0x2b9/0xf20 [ice] [ 438.593860] Code: 45 89 f7 e9 ac 00 00 00 8b 4d 78 41 31 4e 10 41 09 d5 4d 85 f6 0f 84 82 00 00 00 49 8b 4e 08 41 8b 76 1c 65 8b 3d 47 36 4a 3f <48> 8b 11 48 c1 ea 36 39 d7 0f 85 a6 00 00 00 f6 41 08 02 0f 85 9c [ 438.612605] RSP: 0018:ff8c732640003ec8 EFLAGS: 00010082 [ 438.617831] RAX: 0000000000000800 RBX: 00000000000007ff RCX: 0000000000000000 [ 438.624957] RDX: 0000000000000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 438.632089] RBP: ff4ed275a2158200 R08: 00000000ffffffff R09: 0000000000000020 [ 438.639222] R10: 0000000000000000 R11: 0000000000000020 R12: 0000000000001000 [ 438.646356] R13: 0000000000000000 R14: ff4ed275d0daffe0 R15: 0000000000000000 [ 438.653485] FS: 0000000000000000(0000) GS:ff4ed2738fa00000(0000) knlGS:0000000000000000 [ 438.661563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 438.667310] CR2: 0000000000000000 CR3: 0000007c9f0d6006 CR4: 0000000000771ef0 [ 438.674444] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 438.681573] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 438.688697] PKRU: 55555554 [ 438.691404] Call Trace: [ 438.693857] [ 438.695877] ? profile_tick+0x17/0x80 [ 438.699542] ice_msix_clean_ctrl_vsi+0x24/0x50 [ice] [ 438.702571] ice 0000:b1:00.0: VF 1: ctrl_vsi irq timeout [ 438.704542] __handle_irq_event_percpu+0x43/0x1a0 [ 438.704549] handle_irq_event+0x34/0x70 [ 438.704554] handle_edge_irq+0x9f/0x240 [ 438.709901] iavf 0000:b1:01.1: Failed to add Flow Director filter with status: 6 [ 438.714571] __common_interrupt+0x63/0x100 [ 438.714580] common_interrupt+0xb4/0xd0 [ 438.718424] iavf 0000:b1:01.1: Rule ID: 127 dst_ip: 0.0.0.0 src_ip 0.0.0.0 UDP: dst_port 4 src_port 0 [ 438.722255] [ 438.722257] [ 438.722257] asm_common_interrupt+0x22/0x40 [ 438.722262] RIP: 0010:cpuidle_enter_state+0xc8/0x430 [ 438.722267] Code: 6e e9 25 ff e8 f9 ef ff ff 8b 53 04 49 89 c5 0f 1f 44 00 00 31 ff e8 d7 f1 24 ff 45 84 ff 0f 85 57 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 85 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d [ 438.722269] RSP: 0018:ffffffff86003e50 EFLAGS: 00000246 [ 438.784108] RAX: ff4ed2738fa00000 RBX: ffbe72a64fc01020 RCX: 0000000000000000 [ 438.791234] RDX: 0000000000000000 RSI: ffffffff858d84de RDI: ffffffff85893641 [ 438.798365] RBP: 0000000000000002 R08: 0000000000000002 R09: 000000003158af9d [ 438.805490] R10: 0000000000000008 R11: 0000000000000354 R12: ffffffff862365a0 [ 438.812622] R13: 000000661b472a87 R14: 0000000000000002 R15: 0000000000000000 [ 438.819757] cpuidle_enter+0x29/0x40 [ 438.823333] do_idle+0x1b6/0x230 [ 438.826566] cpu_startup_entry+0x19/0x20 [ 438.830492] rest_init+0xcb/0xd0 [ 438.833717] arch_call_rest_init+0xa/0x30 [ 438.837731] start_kernel+0x776/0xb70 [ 438.841396] secondary_startup_64_no_verify+0xe5/0xeb [ 438.846449] Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Signed-off-by: Piotr Raczynski Acked-by: Maciej Fijalkowski Reviewed-by: Simon Horman Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 3584c1dbfffdabf8e3dc1dd25748bb38dd01cd43 Author: Robbie Harwood Date: Mon Feb 20 12:12:54 2023 -0500 asymmetric_keys: log on fatal failures in PE/pkcs7 These particular errors can be encountered while trying to kexec when secureboot lockdown is in place. Without this change, even with a signed debug build, one still needs to reboot the machine to add the appropriate dyndbg parameters (since lockdown blocks debugfs). Accordingly, upgrade all pr_debug() before fatal error into pr_warn(). Signed-off-by: Robbie Harwood Signed-off-by: David Howells cc: Jarkko Sakkinen cc: Eric Biederman cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org cc: kexec@lists.infradead.org Link: https://lore.kernel.org/r/20230220171254.592347-3-rharwood@redhat.com/ # v2 commit 4fc5c74dde69a7eda172514aaeb5a7df3600adb3 Author: Robbie Harwood Date: Mon Feb 20 12:12:53 2023 -0500 verify_pefile: relax wrapper length check The PE Format Specification (section "The Attribute Certificate Table (Image Only)") states that `dwLength` is to be rounded up to 8-byte alignment when used for traversal. Therefore, the field is not required to be an 8-byte multiple in the first place. Accordingly, pesign has not performed this alignment since version 0.110. This causes kexec failure on pesign'd binaries with "PEFILE: Signature wrapper len wrong". Update the comment and relax the check. Signed-off-by: Robbie Harwood Signed-off-by: David Howells cc: Jarkko Sakkinen cc: Eric Biederman cc: Herbert Xu cc: keyrings@vger.kernel.org cc: linux-crypto@vger.kernel.org cc: kexec@lists.infradead.org Link: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-attribute-certificate-table-image-only Link: https://github.com/rhboot/pesign Link: https://lore.kernel.org/r/20230220171254.592347-2-rharwood@redhat.com/ # v2 commit 47f9e4c924025c5be87959d3335e66fcbb7f6b5c Author: David Howells Date: Tue Mar 14 15:15:18 2023 +0000 keys: Do not cache key in task struct if key is requested from kernel thread The key which gets cached in task structure from a kernel thread does not get invalidated even after expiry. Due to which, a new key request from kernel thread will be served with the cached key if it's present in task struct irrespective of the key validity. The change is to not cache key in task_struct when key requested from kernel thread so that kernel thread gets a valid key on every key request. The problem has been seen with the cifs module doing DNS lookups from a kernel thread and the results getting pinned by being attached to that kernel thread's cache - and thus not something that can be easily got rid of. The cache would ordinarily be cleared by notify-resume, but kernel threads don't do that. This isn't seen with AFS because AFS is doing request_key() within the kernel half of a user thread - which will do notify-resume. Fixes: 7743c48e54ee ("keys: Cache result of request_key*() temporarily in task_struct") Signed-off-by: Bharath SM Signed-off-by: David Howells Reviewed-by: Jarkko Sakkinen cc: Shyam Prasad N cc: Steve French cc: keyrings@vger.kernel.org cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@mail.gmail.com/ commit b69245126a48e50882021180fa5d264dc7149ccc Author: Masami Hiramatsu (Google) Date: Wed Mar 15 22:54:08 2023 +0900 bootconfig: Fix testcase to increase max node Since commit 6c40624930c5 ("bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support") increased the max number of bootconfig node to 8192, the bootconfig testcase of the max number of nodes fails. To fix this issue, we can not simply increase the number in the test script because the test bootconfig file becomes too big (>32KB). To fix that, we can use a combination of three alphabets (26^3 = 17576). But with that, we can not express the 8193 (just one exceed from the limitation) because it also exceeds the max size of bootconfig. So, the first 26 nodes will just use one alphabet. With this fix, test-bootconfig.sh passes all tests. Link: https://lore.kernel.org/all/167888844790.791176.670805252426835131.stgit@devnote2/ Reported-by: Heinz Wiesinger Link: https://lore.kernel.org/all/2463802.XAFRqVoOGU@amaterasu.liwjatan.org Fixes: 6c40624930c5 ("bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support") Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 4dd52392b5d75d88acf0d16eb69fe30d0de8c225 Merge: 840525415bdb2 735e7b30a53a1 Author: Greg Kroah-Hartman Date: Tue Mar 21 16:36:45 2023 +0100 Merge tag 'coresight-fixes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-linus Suzuki writes: coresight: Fixes for v6.3 Fixes for coresight subsystem includes: - Fix etm4_enable_hw to program all the address comparator pairs (instead of half of them) - Do not access TRCIDR1 register without OSLK cleared in etm4_probe for mmio access. Signed-off-by: Suzuki K Poulose * tag 'coresight-fixes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux: coresight: etm4x: Do not access TRCIDR1 for identification coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug commit 813cc94c7847ae4a17e9f744fb4dbdf7df6bd732 Author: Tianyi Jing Date: Sat Mar 18 22:38:51 2023 +0800 hwmon: (xgene) Fix ioremap and memremap leak Smatch reports: drivers/hwmon/xgene-hwmon.c:757 xgene_hwmon_probe() warn: 'ctx->pcc_comm_addr' from ioremap() not released on line: 757. This is because in drivers/hwmon/xgene-hwmon.c:701 xgene_hwmon_probe(), ioremap and memremap is not released, which may cause a leak. To fix this, ioremap and memremap is modified to devm_ioremap and devm_memremap. Signed-off-by: Tianyi Jing Reviewed-by: Dongliang Mu Link: https://lore.kernel.org/r/20230318143851.2191625-1-jingfelix@hust.edu.cn [groeck: Fixed formatting and subject] Signed-off-by: Guenter Roeck commit 2315332efcbe7124252f080e03b57d3d2f1f4771 Author: Phinex Hung Date: Tue Mar 21 14:02:23 2023 +0800 hwmon: fix potential sensor registration fail if of_node is missing It is not sufficient to check of_node in current device. In some cases, this would cause the sensor registration to fail. This patch looks for device's ancestors to find a valid of_node if any. Fixes: d560168b5d0f ("hwmon: (core) New hwmon registration API") Signed-off-by: Phinex Hung Link: https://lore.kernel.org/r/20230321060224.3819-1-phinex@realtek.com Signed-off-by: Guenter Roeck commit 2b91c4a870c9830eaf95e744454c9c218cccb736 Author: Iwona Winiarska Date: Tue Mar 21 10:04:10 2023 +0100 hwmon: (peci/cputemp) Fix miscalculated DTS for SKX For Skylake, DTS temperature of the CPU is reported in S10.6 format instead of S8.8. Reported-by: Paul Fertser Link: https://lore.kernel.org/lkml/ZBhHS7v+98NK56is@home.paul.comp/ Signed-off-by: Iwona Winiarska Link: https://lore.kernel.org/r/20230321090410.866766-1-iwona.winiarska@intel.com Signed-off-by: Guenter Roeck commit 97fd768e501fd5d377cb0bf46a35bad2cd21c153 Author: Ard Biesheuvel Date: Tue Mar 21 15:17:57 2023 +0100 efi/libstub: zboot: Add compressed image to make targets Avoid needlessly rebuilding the compressed image by adding the file 'vmlinuz' to the 'targets' Kbuild make variable. Signed-off-by: Ard Biesheuvel commit b416514054810cf2d2cc348ae477cea619b64da7 Author: Frederic Weisbecker Date: Wed Mar 15 19:43:43 2023 +0000 entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up RCU sometimes needs to perform a delayed wake up for specific kthreads handling offloaded callbacks (RCU_NOCB). These wakeups are performed by timers and upon entry to idle (also to guest and to user on nohz_full). However the delayed wake-up on kernel exit is actually performed after the thread flags are fetched towards the fast path check for work to do on exit to user. As a result, and if there is no other pending work to do upon that kernel exit, the current task will resume to userspace with TIF_RESCHED set and the pending wake up ignored. Fix this with fetching the thread flags _after_ the delayed RCU-nocb kthread wake-up. Fixes: 47b8ff194c1f ("entry: Explicitly flush pending rcuog wakeup before last rescheduling point") Signed-off-by: Frederic Weisbecker Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes (Google) Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230315194349.10798-3-joel@joelfernandes.org commit 263f5ecaf7080513efc248ec739b6d9e00f4129f Author: Breno Leitao Date: Tue Mar 21 04:33:38 2023 -0700 perf/x86/amd/core: Always clear status for idx The variable 'status' (which contains the unhandled overflow bits) is not being properly masked in some cases, displaying the following warning: WARNING: CPU: 156 PID: 475601 at arch/x86/events/amd/core.c:972 amd_pmu_v2_handle_irq+0x216/0x270 This seems to be happening because the loop is being continued before the status bit being unset, in case x86_perf_event_set_period() returns 0. This is also causing an inconsistency because the "handled" counter is incremented, but the status bit is not cleaned. Move the bit cleaning together above, together when the "handled" counter is incremented. Fixes: 7685665c390d ("perf/x86/amd/core: Add PerfMonV2 overflow handling") Signed-off-by: Breno Leitao Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Sandipan Das Link: https://lore.kernel.org/r/20230321113338.1669660-1-leitao@debian.org commit a53ce18cacb477dd0513c607f187d16f0fa96f71 Author: Vincent Guittot Date: Fri Mar 17 17:08:10 2023 +0100 sched/fair: Sanitize vruntime of entity being migrated Commit 829c1651e9c4 ("sched/fair: sanitize vruntime of entity being placed") fixes an overflowing bug, but ignore a case that se->exec_start is reset after a migration. For fixing this case, we delay the reset of se->exec_start after placing the entity which se->exec_start to detect long sleeping task. In order to take into account a possible divergence between the clock_task of 2 rqs, we increase the threshold to around 104 days. Fixes: 829c1651e9c4 ("sched/fair: sanitize vruntime of entity being placed") Originally-by: Zhang Qiao Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Tested-by: Zhang Qiao Link: https://lore.kernel.org/r/20230317160810.107988-1-vincent.guittot@linaro.org commit 735e7b30a53a1679c050cddb73f5e5316105d2e3 Author: Suzuki K Poulose Date: Tue Mar 21 10:45:30 2023 +0000 coresight: etm4x: Do not access TRCIDR1 for identification CoreSight ETM4x architecture clearly provides ways to identify a device via registers in the "Management" class, TRCDEVARCH and TRCDEVTYPE. These registers can be accessed without the Trace domain being powered on. We additionally added TRCIDR1 as fallback in order to cover for any ETMs that may not have implemented TRCDEVARCH. So far, nobody has reported hitting a WARNING we placed to catch such systems. Also, more importantly it is problematic to access TRCIDR1, which is a "Trace" register via MMIO access, without clearing the OSLK. But we cannot mess with the OSLK until we know for sure that this is an ETMv4 device. Thus, this kind of creates a chicken and egg problem unnecessarily for systems "which are compliant" to the ETMv4 architecture. Let us remove the TRCIDR1 fall back check and rely only on TRCDEVARCH. Fixes: 8b94db1edaee ("coresight: etm4x: Use TRCDEVARCH for component discovery") Cc: stable@vger.kernel.org Reported-by: Steve Clevenger Link: https://lore.kernel.org/all/143540e5623d4c7393d24833f2b80600d8d745d2.1677881753.git.scclevenger@os.amperecomputing.com/ Cc: Mike Leach Cc: James Clark Reviewed-by: Mike Leach Reviewed-by: Anshuman Khandual Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20230321104530.1547136-1-suzuki.poulose@arm.com commit bf84937e882009075f57fd213836256fc65d96bc Author: Steve Clevenger Date: Mon Feb 27 16:54:32 2023 -0700 coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug In etm4_enable_hw, fix for() loop range to represent address comparator pairs. Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") Cc: stable@vger.kernel.org Signed-off-by: Steve Clevenger Reviewed-by: James Clark Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/4a4ee61ce8ef402615a4528b21a051de3444fb7b.1677540079.git.scclevenger@os.amperecomputing.com commit f87d28673b71b35b248231a2086f9404afbb7f28 Author: Josh Poimboeuf Date: Sat Feb 25 16:01:36 2023 -0800 entry: Fix noinstr warning in __enter_from_user_mode() __enter_from_user_mode() is triggering noinstr warnings with CONFIG_DEBUG_PREEMPT due to its call of preempt_count_add() via ct_state(). The preemption disable isn't needed as interrupts are already disabled. And the context_tracking_enabled() check in ct_state() also isn't needed as that's already being done by the CT_WARN_ON(). Just use __ct_state() instead. Fixes the following warnings: vmlinux.o: warning: objtool: enter_from_user_mode+0xba: call to preempt_count_add() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode+0xf9: call to preempt_count_add() leaves .noinstr.text section vmlinux.o: warning: objtool: syscall_enter_from_user_mode_prepare+0xc7: call to preempt_count_add() leaves .noinstr.text section vmlinux.o: warning: objtool: irqentry_enter_from_user_mode+0xba: call to preempt_count_add() leaves .noinstr.text section Fixes: 171476775d32 ("context_tracking: Convert state to atomic_t") Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/d8955fa6d68dc955dda19baf13ae014ae27926f5.1677369694.git.jpoimboe@kernel.org commit 03aecb1acbcd7a660f97d645ca6c09d9de27ff9d Author: Hans de Goede Date: Wed Mar 1 10:52:18 2023 +0100 drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F Like the Windows Lenovo Yoga Book X91F/L the Android Lenovo Yoga Book X90F/L has a portrait 1200x1920 screen used in landscape mode, add a quirk for this. When the quirk for the X91F/L was initially added it was written to also apply to the X90F/L but this does not work because the Android version of the Yoga Book uses completely different DMI strings. Also adjust the X91F/L quirk to reflect that it only applies to the X91F/L models. Signed-off-by: Hans de Goede Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20230301095218.28457-1-hdegoede@redhat.com commit 8c721c53dda512fdd48eb24d6d99e56deee57898 Author: Takashi Iwai Date: Mon Mar 20 15:28:38 2023 +0100 ALSA: usb-audio: Fix recursive locking at XRUN during syncing The recent support of low latency playback in USB-audio driver made the snd_usb_queue_pending_output_urbs() function to be called via PCM ack ops. In the new code path, the function is performed already in the PCM stream lock. The problem is that, when an XRUN is detected, the function calls snd_pcm_xrun() to notify, but snd_pcm_xrun() is supposed to be called only outside the stream lock. As a result, it leads to a deadlock of PCM stream locking. For avoiding such a recursive locking, this patch adds an additional check to the code paths in PCM core that call the ack callback; now it checks the error code from the callback, and if it's -EPIPE, the XRUN is handled in the PCM core side gracefully. Along with it, the USB-audio driver code is changed to follow that, i.e. -EPIPE is returned instead of the explicit snd_pcm_xrun() call when the function is performed already in the stream lock. Fixes: d5f871f89e21 ("ALSA: usb-audio: Improved lowlatency playback support") Reported-and-tested-by: John Keeping Link: https://lore.kernel.org/r/20230317195128.3911155-1-john@metanate.com Reviewed-by: Jaroslav Kysela Reviewed-by; Takashi Sakamoto Link: https://lore.kernel.org/r/20230320142838.494-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b871cb971c683f7f212e7ca3c9a6709a75785116 Author: Takashi Iwai Date: Mon Mar 20 15:09:54 2023 +0100 ALSA: hda/conexant: Partial revert of a quirk for Lenovo The recent commit f83bb2592482 ("ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model") introduced a quirk for the device with 17aa:3977, but this caused a regression on another model (Lenovo Ideadpad U31) with the very same PCI SSID. And, through skimming over the net, it seems that this PCI SSID is used for multiple different models, so it's no good idea to apply the quirk with the SSID. Although we may take a different ID check (e.g. the codec SSID instead of the PCI SSID), unfortunately, the original patch author couldn't identify the hardware details any longer as the machine was returned, and we can't develop the further proper fix. In this patch, instead, we partially revert the change so that the quirk won't be applied as default for addressing the regression. Meanwhile, the quirk function itself is kept, and it's now made to be applicable via the explicit model=lenovo-20149 option. Fixes: f83bb2592482 ("ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model") Reported-by: Jetro Jormalainen Link: https://lore.kernel.org/r/20230308215009.4d3e58a6@mopti Cc: Link: https://lore.kernel.org/r/20230320140954.31154-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit f038f3917baf04835ba2b7bcf2a04ac93fbf8a9c Author: Jiasheng Jiang Date: Fri Mar 17 14:43:37 2023 +0800 octeontx2-vf: Add missing free for alloc_percpu Add the free_percpu for the allocated "vf->hw.lmt_info" in order to avoid memory leak, same as the "pf->hw.lmt_info" in `drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c`. Fixes: 5c0512072f65 ("octeontx2-pf: cn10k: Use runtime allocated LMTLINE region") Signed-off-by: Jiasheng Jiang Reviewed-by: Michal Swiatkowski Acked-by: Geethasowjanya Akula Link: https://lore.kernel.org/r/20230317064337.18198-1-jiasheng@iscas.ac.cn Signed-off-by: Jakub Kicinski commit 74e2e17ee1f8d8a0928b90434ad7e2df70f8483e Author: Jens Axboe Date: Mon Mar 20 11:13:49 2023 -0600 io_uring/net: avoid sending -ECONNABORTED on repeated connection requests Since io_uring does nonblocking connect requests, if we do two repeated ones without having a listener, the second will get -ECONNABORTED rather than the expected -ECONNREFUSED. Treat -ECONNABORTED like a normal retry condition if we're nonblocking, if we haven't already seen it. Cc: stable@vger.kernel.org Fixes: 3fb1bd688172 ("io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT") Link: https://github.com/axboe/liburing/issues/828 Reported-by: Hui, Chunyang Signed-off-by: Jens Axboe commit 9d2789ac9d60c049d26ef6d3005d9c94c5a559e9 Author: Jens Axboe Date: Mon Mar 20 20:01:25 2023 -0600 block/io_uring: pass in issue_flags for uring_cmd task_work handling io_uring_cmd_done() currently assumes that the uring_lock is held when invoked, and while it generally is, this is not guaranteed. Pass in the issue_flags associated with it, so that we have IO_URING_F_UNLOCKED available to be able to lock the CQ ring appropriately when completing events. Cc: stable@vger.kernel.org Fixes: ee692a21e9bf ("fs,io_uring: add infrastructure for uring-cmd") Signed-off-by: Jens Axboe commit 05107edc910135d27fe557267dc45be9630bf3dd Author: Nick Desaulniers Date: Wed Mar 8 11:59:33 2023 -0800 selftests: sigaltstack: fix -Wuninitialized Building sigaltstack with clang via: $ ARCH=x86 make LLVM=1 -C tools/testing/selftests/sigaltstack/ produces the following warning: warning: variable 'sp' is uninitialized when used here [-Wuninitialized] if (sp < (unsigned long)sstack || ^~ Clang expects these to be declared at global scope; we've fixed this in the kernel proper by using the macro `current_stack_pointer`. This is defined in different headers for different target architectures, so just create a new header that defines the arch-specific register names for the stack pointer register, and define it for more targets (at least the ones that support current_stack_pointer/ARCH_HAS_CURRENT_STACK_POINTER). Reported-by: Linux Kernel Functional Testing Link: https://lore.kernel.org/lkml/CA+G9fYsi3OOu7yCsMutpzKDnBMAzJBCPimBp86LhGBa0eCnEpA@mail.gmail.com/ Signed-off-by: Nick Desaulniers Reviewed-by: Kees Cook Tested-by: Linux Kernel Functional Testing Tested-by: Anders Roxell Signed-off-by: Shuah Khan commit 17214b70a159c6547df9ae204a6275d983146f6b Merge: 4f1e308df88ad a075bacde257f Author: Linus Torvalds Date: Mon Mar 20 15:20:33 2023 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity fixes from Eric Biggers: "Fix two significant performance issues with fsverity" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY fsverity: Remove WQ_UNBOUND from fsverity read workqueue commit 4f1e308df88ad25c88ab4240161cbac45ba2d78e Merge: 7d31677bb7b19 4bcf6f827a79c Author: Linus Torvalds Date: Mon Mar 20 15:12:55 2023 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt fix from Eric Biggers: "Fix a bug where when a filesystem was being unmounted, the fscrypt keyring was destroyed before inodes have been released by the Landlock LSM. This bug was found by syzbot" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: check for NULL keyring in fscrypt_put_master_key_activeref() fscrypt: improve fscrypt_destroy_keyring() documentation fscrypt: destroy keyring after security_sb_delete() commit 88b170088ad2c3e27086fe35769aa49f8a512564 Author: Damien Le Moal Date: Mon Mar 20 22:49:15 2023 +0900 zonefs: Fix error message in zonefs_file_dio_append() Since the expected write location in a sequential file is always at the end of the file (append write), when an invalid write append location is detected in zonefs_file_dio_append(), print the invalid written location instead of the expected write location. Fixes: a608da3bd730 ("zonefs: Detect append writes at invalid locations") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Reviewed-by: Himanshu Madhani commit d7e673c2a900206bea3461a4b4ecc74ea930f80e Author: Damien Le Moal Date: Mon Mar 20 15:35:06 2023 +0900 zonefs: Prevent uninitialized symbol 'size' warning In zonefs_file_dio_append(), initialize the variable size to 0 to prevent compilation and static code analizers warning such as: New smatch warnings: fs/zonefs/file.c:441 zonefs_file_dio_append() error: uninitialized symbol 'size'. The warning is a false positive as size is never actually used uninitialized. No functional change. Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202303191227.GL8Dprbi-lkp@intel.com/ Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Himanshu Madhani commit f420f47e56c67587d9bc8f94267327b6fb214c1d Author: Oleksij Rempel Date: Fri Mar 10 17:45:23 2023 +0100 clk: imx6ul: fix "failed to get parent" error On some configuration we may get following error: [ 0.000000] imx:clk-gpr-mux: failed to get parent (-EINVAL) This happens if selector is configured to not supported value. To avoid this warnings add dummy parents for not supported values. Fixes: 4e197ee880c2 ("clk: imx6ul: add ethernet refclock mux support") Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20230310164523.534571-1-o.rempel@pengutronix.de Tested-by: Stefan Wahren Reported-by: Stefan Wahren Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 7d31677bb7b1944ac89e9155110dc1b9acbb3895 Author: Arnd Bergmann Date: Fri Jan 27 23:14:00 2023 +0100 gpu: host1x: fix uninitialized variable use The error handling for platform_get_irq() failing no longer works after a recent change, clang now points this out with a warning: drivers/gpu/host1x/dev.c:520:6: error: variable 'syncpt_irq' is uninitialized when used here [-Werror,-Wuninitialized] if (syncpt_irq < 0) ^~~~~~~~~~ Fix this by removing the variable and checking the correct error status. Fixes: 625d4ffb438c ("gpu: host1x: Rewrite syncpoint interrupt handling") Signed-off-by: Arnd Bergmann Reviewed-by: Jon Hunter Reviewed-by: Nick Desaulniers Reviewed-by: Mikko Perttunen Reviewed-by: Nathan Chancellor Signed-off-by: Linus Torvalds commit 5e7a3bf65db57461d0f47955248fcadf37321a74 Author: Hans de Goede Date: Mon Mar 20 16:59:46 2023 +0100 ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG The Acer Aspire 3830TG predates Windows 8, so it defaults to using acpi_video# for backlight control, but this is non functional on this model. Add a DMI quirk to use the native backlight interface which does work properly. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 3d3699bde4b043eea17993e4e76804a8128f0fdb Merge: e8d018dd0257f 21fd9e8700de8 Author: Linus Torvalds Date: Mon Mar 20 10:52:10 2023 -0700 Merge tag 'nfs-for-6.3-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: - Fix /proc/PID/io read_bytes accounting - Fix setting NLM file_lock start and end during decoding testargs - Fix timing for setting access cache timestamps * tag 'nfs-for-6.3-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Correct timing for assigning access cache timestamp lockd: set file_lock start and end when decoding nlm4 testargs NFS: Fix /proc/PID/io read_bytes for buffered reads commit 58cdfe6f58b35f17f56386f5fcf937168a423ad1 Author: Tom Rix Date: Wed Mar 15 18:04:50 2023 -0400 thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit cppcheck reports drivers/thunderbolt/nhi.c:74:7: style: Local variable 'bit' shadows outer variable [shadowVariable] int bit; ^ drivers/thunderbolt/nhi.c:66:6: note: Shadowed declaration int bit = ring_interrupt_index(ring) & 31; ^ drivers/thunderbolt/nhi.c:74:7: note: Shadow variable int bit; ^ For readablity rename the outer to interrupt_bit and the innner to auto_clear_bit. Fixes: 468c49f44759 ("thunderbolt: Disable interrupt auto clear for ring") Cc: stable@vger.kernel.org Signed-off-by: Tom Rix Signed-off-by: Mika Westerberg commit b7c994f8c35e916e27c60803bb21457bc1373500 Author: Frank Crawford Date: Sat Mar 18 20:14:41 2023 +1100 platform/x86 (gigabyte-wmi): Add support for A320M-S2H V2 Add support for A320M-S2H V2. Tested using module force_load option. Signed-off-by: Frank Crawford Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20230318091441.1240921-1-frank@crawford.emu.id.au Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 840525415bdb2cb9873c6faea1984303efa65008 Merge: e8d018dd0257f 00f4bc5184c19 Author: Greg Kroah-Hartman Date: Mon Mar 20 13:54:01 2023 +0100 Merge tag 'counter-fixes-6.3a' of git://git.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: First set of Counter driver fixes for 6.3 This set consists of two fixes for the 104-quad-8 driver: - fix a read race condition between the FLAG and CNTR registers (as a result 25-bit count values are no longer supported) - invert condition check to report correct Index Synapse action * tag 'counter-fixes-6.3a' of git://git.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: 104-quad-8: Fix Synapse action reported for Index signals counter: 104-quad-8: Fix race condition between FLAG and CNTR reads commit 8d13d50b157655247cdb3a69aca7836b58ff8735 Author: Dongliang Mu Date: Thu Mar 9 12:01:06 2023 +0800 platform/x86/intel: tpmi: Revise the comment of intel_vsec_add_aux intel_vsec_add_aux() is resource managed including res and feature_vsec_dev memory. Fix this by revising the comment of intel_vsec_add_aux since res variable will also be freed in the intel_vsec_add_aux. Signed-off-by: Dongliang Mu Link: https://lore.kernel.org/r/20230309040107.534716-3-dzm91@hust.edu.cn Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 4d5a2a7d2c97dbd658533eea5f79dab1ad5dc0ee Author: Dongliang Mu Date: Thu Mar 9 12:01:05 2023 +0800 platform/x86/intel: tpmi: Fix double free in tpmi_create_device() The previous commit 6a192c0cbf38 ("platform/x86/intel/tpmi: Fix double free reported by Smatch") incorrectly handle the deallocation of res variable. As shown in the comment, intel_vsec_add_aux handles all the deallocation of res and feature_vsec_dev. Therefore, kfree(res) can still cause double free if intel_vsec_add_aux returns error. Fix this by adjusting the error handling part in tpmi_create_device, following the function intel_vsec_add_dev. Fixes: 6a192c0cbf38 ("platform/x86/intel/tpmi: Fix double free reported by Smatch") Signed-off-by: Dongliang Mu Link: https://lore.kernel.org/r/20230309040107.534716-2-dzm91@hust.edu.cn Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit da0ba0ccce54059d6c6b788a75099bfce95126da Author: Dongliang Mu Date: Thu Mar 9 12:01:07 2023 +0800 platform/x86/intel: vsec: Fix a memory leak in intel_vsec_add_aux The first error handling code in intel_vsec_add_aux misses the deallocation of intel_vsec_dev->resource. Fix this by adding kfree(intel_vsec_dev->resource) in the error handling code. Reviewed-by: David E. Box Signed-off-by: Dongliang Mu Link: https://lore.kernel.org/r/20230309040107.534716-4-dzm91@hust.edu.cn Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6bd1bca858f1734a75572a788213d1e1143f2f0a Author: Cheng Xu Date: Mon Mar 20 16:46:52 2023 +0800 RDMA/erdma: Defer probing if netdevice can not be found ERDMA device may be probed before its associated netdevice, returning -EPROBE_DEFER allows OS try to probe erdma device later. Fixes: d55e6fb4803c ("RDMA/erdma: Add the erdma module") Signed-off-by: Cheng Xu Link: https://lore.kernel.org/r/20230320084652.16807-5-chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky commit 0dd83a4d7756713f81990d6c5547500f212a1190 Author: Cheng Xu Date: Mon Mar 20 16:46:51 2023 +0800 RDMA/erdma: Inline mtt entries into WQE if supported The max inline mtt count supported is ERDMA_MAX_INLINE_MTT_ENTRIES. When mr->mem.mtt_nents == ERDMA_MAX_INLINE_MTT_ENTRIES, inline mtt is also supported, fix it. Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Signed-off-by: Cheng Xu Link: https://lore.kernel.org/r/20230320084652.16807-4-chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky commit 6256aa9ae955d10ec73a434533ca62034eff1b76 Author: Cheng Xu Date: Mon Mar 20 16:46:50 2023 +0800 RDMA/erdma: Update default EQ depth to 4096 and max_send_wr to 8192 Max EQ depth of hardware is 32K, the current default EQ depth is too small for some applications, so change the default depth to 4096. Max send WRs the hardware can support is 8K, but the driver limits the value to 4K. Remove this limitation. Fixes: be3cff0f242d ("RDMA/erdma: Add the hardware related definitions") Fixes: db23ae64caac ("RDMA/erdma: Add verbs header file") Signed-off-by: Cheng Xu Link: https://lore.kernel.org/r/20230320084652.16807-3-chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky commit 3fe26c0493e4c2da4b7d8ba8c975a6f48fb75ec2 Author: Cheng Xu Date: Mon Mar 20 16:46:49 2023 +0800 RDMA/erdma: Fix some typos FAA is short for atomic fetch and add, not FAD. Fix this. Fixes: 0ca9c2e2844a ("RDMA/erdma: Implement atomic operations support") Signed-off-by: Cheng Xu Link: https://lore.kernel.org/r/20230320084652.16807-2-chengyou@linux.alibaba.com Signed-off-by: Leon Romanovsky commit 22aa20e4c5dcbe6fdc480eb4fb27039b1f43217f Author: Ashutosh Dixit Date: Sun Mar 19 07:03:00 2023 -0700 Revert "drm/i915/hwmon: Enable PL1 power limit" This reverts commit ee892ea83d99610fa33bea612de058e0955eec3a. It was accidentally picked up for backporting. Revert. Cc: Jani Nikula Cc: Rodrigo Vivi Signed-off-by: Ashutosh Dixit Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230319140300.2892032-1-ashutosh.dixit@intel.com commit f36fa5581bcace4e1054347c46ca67f2664fba33 Merge: 7d722c9802d4b bebe933d35a63 Author: David S. Miller Date: Mon Mar 20 10:20:40 2023 +0000 Merge branch 'ps3_gelic_net-fixes' Geoff Levand says: ==================== net/ps3_gelic_net: DMA related fixes v9: Make rx_skb_size local to gelic_descr_prepare_rx. v8: Add more cpu_to_be32 calls. v7: Remove all cleanups, sync to spider net. v6: Reworked and cleaned up patches. v5: Some additional patch cleanups. v4: More patch cleanups. v3: Cleaned up patches as requested. ==================== Signed-off-by: David S. Miller commit bebe933d35a63d4f042fbf4dce4f22e689ba0fcd Author: Geoff Levand Date: Sat Mar 18 17:39:16 2023 +0000 net/ps3_gelic_net: Use dma_mapping_error The current Gelic Etherenet driver was checking the return value of its dma_map_single call, and not using the dma_mapping_error() routine. Fixes runtime problems like these: DMA-API: ps3_gelic_driver sb_05: device driver failed to check map error WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:1027 .check_unmap+0x888/0x8dc Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") Reviewed-by: Alexander Duyck Signed-off-by: Geoff Levand Signed-off-by: David S. Miller commit 19b3bb51c3bc288b3f2c6f8c4450b0f548320625 Author: Geoff Levand Date: Sat Mar 18 17:39:16 2023 +0000 net/ps3_gelic_net: Fix RX sk_buff length The Gelic Ethernet device needs to have the RX sk_buffs aligned to GELIC_NET_RXBUF_ALIGN, and also the length of the RX sk_buffs must be a multiple of GELIC_NET_RXBUF_ALIGN. The current Gelic Ethernet driver was not allocating sk_buffs large enough to allow for this alignment. Also, correct the maximum and minimum MTU sizes, and add a new preprocessor macro for the maximum frame size, GELIC_NET_MAX_FRAME. Fixes various randomly occurring runtime network errors. Fixes: 02c1889166b4 ("ps3: gigabit ethernet driver for PS3, take3") Signed-off-by: Geoff Levand Signed-off-by: David S. Miller commit 7d722c9802d4bd61a1f1614e07413b6a5fac382d Author: Tom Rix Date: Sat Mar 18 09:13:42 2023 -0400 usb: plusb: remove unused pl_clear_QuickLink_features function clang with W=1 reports drivers/net/usb/plusb.c:65:1: error: unused function 'pl_clear_QuickLink_features' [-Werror,-Wunused-function] pl_clear_QuickLink_features(struct usbnet *dev, int val) ^ This static function is not used, so remove it. Signed-off-by: Tom Rix Signed-off-by: David S. Miller commit 7f247f5a2c18b3f21206cdd51193df4f38e1b9f5 Author: Szymon Heidrich Date: Sat Mar 18 10:25:52 2023 +0100 net: usb: lan78xx: Limit packet length to skb->len Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the network stack will leak kernel memory contents. Additionally prevent integer underflow when size is less than ETH_FCS_LEN. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Signed-off-by: Szymon Heidrich Signed-off-by: David S. Miller commit 6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75 Author: Zheng Wang Date: Sat Mar 18 16:05:26 2023 +0800 net: qcom/emac: Fix use after free bug in emac_remove due to race condition In emac_probe, &adpt->work_thread is bound with emac_work_thread. Then it will be started by timeout handler emac_tx_timeout or a IRQ handler emac_isr. If we remove the driver which will call emac_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: Fix it by finishing the work before cleanup in the emac_remove and disable timeout response. CPU0 CPU1 |emac_work_thread emac_remove | free_netdev | kfree(netdev); | |emac_reinit_locked |emac_mac_down |//use netdev Fixes: b9b17debc69d ("net: emac: emac gigabit ethernet controller driver") Signed-off-by: Zheng Wang Signed-off-by: David S. Miller commit a8eff03545d4cef12ae66a1905627c1818a0f81a Author: Vladimir Oltean Date: Sat Mar 18 01:19:00 2023 +0200 net: dsa: report rx_bytes unadjusted for ETH_HLEN We collect the software statistics counters for RX bytes (reported to /proc/net/dev and to ethtool -S $dev | grep 'rx_bytes: ") at a time when skb->len has already been adjusted by the eth_type_trans() -> skb_pull_inline(skb, ETH_HLEN) call to exclude the L2 header. This means that when connecting 2 DSA interfaces back to back and sending 1 packet with length 100, the sending interface will report tx_bytes as incrementing by 100, and the receiving interface will report rx_bytes as incrementing by 86. Since accounting for that in scripts is quirky and is something that would be DSA-specific behavior (requiring users to know that they are running on a DSA interface in the first place), the proposal is that we treat it as a bug and fix it. This design bug has always existed in DSA, according to my analysis: commit 91da11f870f0 ("net: Distributed Switch Architecture protocol support") also updates skb->dev->stats.rx_bytes += skb->len after the eth_type_trans() call. Technically, prior to Florian's commit a86d8becc3f0 ("net: dsa: Factor bottom tag receive functions"), each and every vendor-specific tagging protocol driver open-coded the same bug, until the buggy code was consolidated into something resembling what can be seen now. So each and every driver should have its own Fixes: tag, because of their different histories until the convergence point. I'm not going to do that, for the sake of simplicity, but just blame the oldest appearance of buggy code. There are 2 ways to fix the problem. One is the obvious way, and the other is how I ended up doing it. Obvious would have been to move dev_sw_netstats_rx_add() one line above eth_type_trans(), and below skb_push(skb, ETH_HLEN). But DSA processing is not as simple as that. We count the bytes after removing everything DSA-related from the packet, to emulate what the packet's length was, on the wire, when the user port received it. When eth_type_trans() executes, dsa_untag_bridge_pvid() has not run yet, so in case the switch driver requests this behavior - commit 412a1526d067 ("net: dsa: untag the bridge pvid from rx skbs") has the details - the obvious variant of the fix wouldn't have worked, because the positioning there would have also counted the not-yet-stripped VLAN header length, something which is absent from the packet as seen on the wire (there it may be untagged, whereas software will see it as PVID-tagged). Fixes: f613ed665bb3 ("net: dsa: Add support for 64-bit statistics") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 59ad01c786a4c94afacc7feb0ab97bf8d6672a46 Author: Ville Syrjälä Date: Sat Mar 11 01:58:25 2023 +0200 drm/i915: Update vblank timestamping stuff on seamless M/N change When we change the M/N values seamlessly during a fastset we should also update the vblank timestamping stuff to make sure the vblank timestamp corrections/guesstimations come out exact. Note that only crtc_clock and framedur_ns can actually end up changing here during fastsets. Everything else we touch can only change during full modesets. Technically we should try to do this exactly at the start of vblank, but that would require some kind of double buffering scheme. Let's skip that for now and just update things right after the commit has been submitted to the hardware. This means the information will be properly up to date when the vblank irq handler goes to work. Only if someone ends up querying some vblanky stuff in between the commit and start of vblank may we see a slight discrepancy. Also this same problem really exists for the DRRS downclocking stuff. But as that is supposed to be more or less transparent to the user, and it only drops to low gear after a long delay (1 sec currently) we probably don't have to worry about it. Any time something is actively submitting updates DRRS will remain in high gear and so the timestamping constants will match the hardware state. Reviewed-by: Jani Nikula Reviewed-by: Mitul Golani Fixes: e6f29923c048 ("drm/i915: Allow M/N change during fastset on bdw+") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230310235828.17439-1-ville.syrjala@linux.intel.com (cherry picked from commit 8cb1f95cca68421b08333175719fdd3615372ca8) Signed-off-by: Jani Nikula commit f8d62aa8d24d9883df738e450bfe6be396e11979 Author: Vinay Belgaumkar Date: Tue Mar 14 19:29:06 2023 -0700 drm/i915: Fix format for perf_limit_reasons Use hex format so that it is easier to decode. Fixes: fe5979665f64 ("drm/i915/debugfs: Add perf_limit_reasons in debugfs") Signed-off-by: Vinay Belgaumkar Reviewed-by: Ashutosh Dixit Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20230315022906.2467408-1-vinay.belgaumkar@intel.com (cherry picked from commit 5e008ba67cb80084e99b40ccd46f9029ae421632) Signed-off-by: Jani Nikula commit 150784f9285e656373cf3953ef4a7663f1e1a0f2 Author: Andrzej Hajda Date: Tue Mar 14 16:19:20 2023 +0100 drm/i915/gt: perform uc late init after probe error injection Probe pseudo errors should be injected only in places where real errors can be encountered, otherwise unwinding code can be broken. Placing intel_uc_init_late before i915_inject_probe_error violated this rule, resulting in following bug: __intel_gt_disable:655 GEM_BUG_ON(intel_gt_pm_is_awake(gt)) Fixes: 481d458caede ("drm/i915/guc: Add golden context to GuC ADS") Acked-by: Nirmoy Das Reviewed-by: Andi Shyti Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20230314151920.1065847-1-andrzej.hajda@intel.com (cherry picked from commit c4252a11131c7f27a158294241466e2a4e7ff94e) Signed-off-by: Jani Nikula commit e92eb246feb9019b0b137706c934b8891cdfe3c2 Author: Nirmoy Das Date: Tue Mar 14 15:29:14 2023 +0100 drm/i915/active: Fix missing debug object activation debug_active_activate() expected ref->count to be zero which is not true anymore as __i915_active_activate() calls debug_active_activate() after incrementing the count. v2: No need to check for "ref->count == 1" as __i915_active_activate() already make sure of that(Janusz). References: https://gitlab.freedesktop.org/drm/intel/-/issues/6733 Fixes: 04240e30ed06 ("drm/i915: Skip taking acquire mutex for no ref->active callback") Cc: Chris Wilson Cc: Tvrtko Ursulin Cc: Thomas Hellström Cc: Andi Shyti Cc: intel-gfx@lists.freedesktop.org Cc: Janusz Krzysztofik Cc: # v5.10+ Signed-off-by: Nirmoy Das Reviewed-by: Janusz Krzysztofik Reviewed-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20230313114613.9874-1-nirmoy.das@intel.com (cherry picked from commit bfad380c542438a9b642f8190b7fd37bc77e2723) Signed-off-by: Jani Nikula commit 8df23e4c4f72f4e201c28e6fb0a67e2dbf30628a Author: John Harrison Date: Fri Mar 10 22:37:12 2023 -0800 drm/i915/guc: Fix missing ecodes Error captures are tagged with an 'ecode'. This is a pseduo-unique magic number that is meant to distinguish similar seeming bugs with different underlying signatures. It is a combination of two ring state registers. Unfortunately, the register state being used is only valid in execlist mode. In GuC mode, the register state exists in a separate list of arbitrary register address/value pairs rather than the named entry structure. So, search through that list to find the two exciting registers and copy them over to the structure's named members. v2: if else if instead of if if (Alan) Signed-off-by: John Harrison Reviewed-by: Alan Previn Fixes: a6f0f9cf330a ("drm/i915/guc: Plumb GuC-capture into gpu_coredump") Cc: Alan Previn Cc: Umesh Nerlige Ramappa Cc: Lucas De Marchi Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: Matt Roper Cc: Aravind Iddamsetty Cc: Michael Cheng Cc: Matthew Brost Cc: Bruce Chang Cc: Daniele Ceraolo Spurio Cc: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20230311063714.570389-2-John.C.Harrison@Intel.com (cherry picked from commit 9724ecdbb9ddd6da3260e4a442574b90fc75188a) Signed-off-by: Jani Nikula commit 088a422c3fa3ee9268d400078626b0c202cfe9dd Author: Badal Nilawar Date: Fri Mar 10 11:43:39 2023 +0530 drm/i915/mtl: Disable MC6 for MTL A step The Wa_14017073508 require to send Media Busy/Idle mailbox while accessing Media tile. As of now it is getting handled while __gt_unpark, __gt_park. But there are various corner cases where forcewakes are taken without __gt_unpark i.e. without sending Busy Mailbox especially during register reads. Forcewakes are taken without busy mailbox leads to GPU HANG. So bringing mailbox calls under forcewake calls are no feasible option as forcewake calls are atomic and mailbox calls are blocking. The issue already fixed in B step so disabling MC6 on A step and reverting previous commit which handles Wa_14017073508 Fixes: 8f70f1ec587d ("drm/i915/mtl: Add Wa_14017073508 for SAMedia") Cc: Rodrigo Vivi Signed-off-by: Badal Nilawar Reviewed-by: Rodrigo Vivi Signed-off-by: Anshuman Gupta Link: https://patchwork.freedesktop.org/patch/msgid/20230310061339.2495416-2-badal.nilawar@intel.com (cherry picked from commit 038a24835ab68f341eaa7a0e3bcc6ce0f9b22e17) Signed-off-by: Jani Nikula commit 3a84f2c6c9558c554a90ec26ad25df92fc5e05b7 Author: Ville Syrjälä Date: Thu Feb 23 17:20:48 2023 +0200 drm/i915: Preserve crtc_state->inherited during state clearing intel_crtc_prepare_cleared_state() is unintentionally losing the "inherited" flag. This will happen if intel_initial_commit() is forced to go through the full modeset calculations for whatever reason. Afterwards the first real commit from userspace will not get forced to the full modeset path, and thus eg. audio state may not get recomputed properly. So if the monitor was already enabled during boot audio will not work until userspace itself does an explicit full modeset. Cc: stable@vger.kernel.org Tested-by: Lee Shawn C Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230223152048.20878-1-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar (cherry picked from commit 2553bacaf953b48c59357f5a622282bc0c45adae) Signed-off-by: Jani Nikula commit ed00eba03474adbf525ff03d69705d8c78b76456 Author: Tejas Upadhyay Date: Wed Mar 1 12:10:52 2023 -0800 drm/i915/fbdev: lock the fbdev obj before vma pin lock the fbdev obj before calling into i915_vma_pin_iomap(). This helps to solve below : <7>[ 93.563308] i915 0000:00:02.0: [drm:intelfb_create [i915]] no BIOS fb, allocating a new one <4>[ 93.581844] ------------[ cut here ]------------ <4>[ 93.581855] WARNING: CPU: 12 PID: 625 at drivers/gpu/drm/i915/gem/i915_gem_pages.c:424 i915_gem_object_pin_map+0x152/0x1c0 [i915] Fixes: f0b6b01b3efe ("drm/i915: Add ww context to intel_dpt_pin, v2.") Cc: Chris Wilson Cc: Matthew Auld Cc: Maarten Lankhorst Signed-off-by: Tejas Upadhyay Signed-off-by: Radhakrishna Sripada Reviewed-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20230301201053.928709-5-radhakrishna.sripada@intel.com (cherry picked from commit 561b31acfd65502a2cda2067513240fc57ccdbdc) Signed-off-by: Jani Nikula commit 364ac7863fc161841e86388884bb7d5f4048031a Author: Radhakrishna Sripada Date: Wed Mar 1 12:10:49 2023 -0800 drm/i915/mtl: Fix Wa_16015201720 implementation The commit 2357f2b271ad ("drm/i915/mtl: Initial display workarounds") extended the workaround Wa_16015201720 to MTL. However the registers that the original WA implemented moved for MTL. Implement the workaround with the correct register. v3: Skip clock gating for pipe C, D DMC's and fix the title Fixes: 2357f2b271ad ("drm/i915/mtl: Initial display workarounds") Cc: Matt Atwood Cc: Lucas De Marchi Signed-off-by: Radhakrishna Sripada Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230301201053.928709-2-radhakrishna.sripada@intel.com (cherry picked from commit 0188be507b973e36f637ba010a369057c8cb7282) Signed-off-by: Jani Nikula commit 88c9483faf15ada14eca82714114656893063458 Author: Maher Sanalla Date: Thu Mar 16 15:40:49 2023 +0200 IB/mlx5: Add support for 400G_8X lane speed Currently, when driver queries PTYS to report which link speed is being used on its RoCE ports, it does not check the case of having 400Gbps transmitted over 8 lanes. Thus it fails to report the said speed and instead it defaults to report 10G over 4 lanes. Add a check for the said speed when querying PTYS and report it back correctly when needed. Fixes: 08e8676f1607 ("IB/mlx5: Add support for 50Gbps per lane link modes") Signed-off-by: Maher Sanalla Reviewed-by: Aya Levin Reviewed-by: Saeed Mahameed Link: https://lore.kernel.org/r/ec9040548d119d22557d6a4b4070d6f421701fd4.1678973994.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 468c49f44759720a312e52d44a71c3949ed63d7c Author: Mario Limonciello Date: Fri Mar 10 11:20:50 2023 -0600 thunderbolt: Disable interrupt auto clear for rings When interrupt auto clear is programmed, any read to the interrupt status register will clear all interrupts. If two interrupts have come in before one can be serviced then this will cause lost interrupts. On AMD USB4 routers this has manifested in odd problems particularly with long strings of control tranfers such as reading the DROM via bit banging. Instead of clearing interrupts automatically, clear the bit corresponding to the given ring's interrupt in the ISR. Fixes: 7a1808f82a37 ("thunderbolt: Handle ring interrupt by reading interrupt status register") Cc: Sanju Mehta Cc: stable@vger.kernel.org Tested-by: Anson Tsao Signed-off-by: Mario Limonciello Signed-off-by: Mika Westerberg commit 1716efdb07938bd6510e1127d02012799112c433 Author: Mario Limonciello Date: Fri Mar 10 11:20:49 2023 -0600 thunderbolt: Use const qualifier for `ring_interrupt_index` `ring_interrupt_index` doesn't change the data for `ring` so mark it as const. This is needed by the following patch that disables interrupt auto clear for rings. Cc: Sanju Mehta Cc: stable@vger.kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Mika Westerberg commit 754ff5060daf5a1cf4474eff9b4edeb6c17ef7ab Author: msizanoen Date: Sun Mar 19 23:02:56 2023 -0700 Input: alps - fix compatibility with -funsigned-char The AlpsPS/2 code previously relied on the assumption that `char` is a signed type, which was true on x86 platforms (the only place where this driver is used) before kernel 6.2. However, on 6.2 and later, this assumption is broken due to the introduction of -funsigned-char as a new global compiler flag. Fix this by explicitly specifying the signedness of `char` when sign extending the values received from the device. Fixes: f3f33c677699 ("Input: alps - Rushmore and v7 resolution support") Signed-off-by: msizanoen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230320045228.182259-1-msizanoen@qtmlabs.xyz Signed-off-by: Dmitry Torokhov commit 8980f190947ba29f23110408e712444884b74251 Author: Jason A. Donenfeld Date: Sun Mar 19 21:36:36 2023 -0700 Input: focaltech - use explicitly signed char type The recent change of -funsigned-char causes additions of negative numbers to become additions of large positive numbers, leading to wrong calculations of mouse movement. Change these casts to be explicitly signed, to take into account negative offsets. Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned") Signed-off-by: Jason A. Donenfeld Reviewed-by: Hans de Goede Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=217211 Link: https://lore.kernel.org/r/20230318133010.1285202-1-Jason@zx2c4.com Signed-off-by: Dmitry Torokhov commit ffa6206ebf8d39e83d87ac226df68dbbe155819a Author: Matthias Benkmann Date: Sun Mar 19 21:30:15 2023 -0700 Input: xpad - fix incorrectly applied patch for MAP_PROFILE_BUTTON When commit commit fff1011a26d6 ("Input: xpad - add X-Box Adaptive Profile button") was applied, one hunk ended up in the wrong function; move it to where it belongs. Fixes: fff1011a26d6 ("Input: xpad - add X-Box Adaptive Profile button") Signed-off-by: Matthias Benkmann Link: https://lore.kernel.org/r/20230318162106.0aef4ba5@ninja Signed-off-by: Dmitry Torokhov commit e8d018dd0257f744ca50a729e3d042cf2ec9da65 Author: Linus Torvalds Date: Sun Mar 19 13:27:55 2023 -0700 Linux 6.3-rc3 commit eaba52d63bfcf0047ce3a1bb011b35d4f066df8e Merge: 5cdfdd6da3231 71c7a30442b72 Author: Linus Torvalds Date: Sun Mar 19 10:46:02 2023 -0700 Merge tag 'trace-v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix setting affinity of hwlat threads in containers Using sched_set_affinity() has unwanted side effects when being called within a container. Use set_cpus_allowed_ptr() instead - Fix per cpu thread management of the hwlat tracer: - Do not start per_cpu threads if one is already running for the CPU - When starting per_cpu threads, do not clear the kthread variable as it may already be set to running per cpu threads - Fix return value for test_gen_kprobe_cmd() On error the return value was overwritten by being set to the result of the call from kprobe_event_delete(), which would likely succeed, and thus have the function return success - Fix splice() reads from the trace file that was broken by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") - Remove obsolete and confusing comment in ring_buffer.c The original design of the ring buffer used struct page flags for tricks to optimize, which was shortly removed due to them being tricks. But a comment for those tricks remained - Set local functions and variables to static * tag 'trace-v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr ring-buffer: remove obsolete comment for free_buffer_page() tracing: Make splice_read available again ftrace: Set direct_ops storage-class-specifier to static trace/hwlat: Do not start per-cpu thread if it is already running trace/hwlat: Do not wipe the contents of per-cpu thread data tracing/osnoise: set several trace_osnoise.c variables storage-class-specifier to static tracing: Fix wrong return in kprobe_event_gen_test.c commit 71c7a30442b724717a30d5e7d1662ba4904eb3d4 Author: Costa Shulyupin Date: Thu Mar 16 16:45:35 2023 +0200 tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr There is a problem with the behavior of hwlat in a container, resulting in incorrect output. A warning message is generated: "cpumask changed while in round-robin mode, switching to mode none", and the tracing_cpumask is ignored. This issue arises because the kernel thread, hwlatd, is not a part of the container, and the function sched_setaffinity is unable to locate it using its PID. Additionally, the task_struct of hwlatd is already known. Ultimately, the function set_cpus_allowed_ptr achieves the same outcome as sched_setaffinity, but employs task_struct instead of PID. Test case: # cd /sys/kernel/tracing # echo 0 > tracing_on # echo round-robin > hwlat_detector/mode # echo hwlat > current_tracer # unshare --fork --pid bash -c 'echo 1 > tracing_on' # dmesg -c Actual behavior: [573502.809060] hwlat_detector: cpumask changed while in round-robin mode, switching to mode none Link: https://lore.kernel.org/linux-trace-kernel/20230316144535.1004952-1-costa.shul@redhat.com Cc: Masami Hiramatsu Fixes: 0330f7aa8ee63 ("tracing: Have hwlat trace migrate across tracing_cpumask CPUs") Signed-off-by: Costa Shulyupin Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit a98151ad53b53f010ee364ec2fd06445b328578b Author: Vlastimil Babka Date: Wed Mar 15 15:24:46 2023 +0100 ring-buffer: remove obsolete comment for free_buffer_page() The comment refers to mm/slob.c which is being removed. It comes from commit ed56829cb319 ("ring_buffer: reset buffer page when freeing") and according to Steven the borrowed code was a page mapcount and mapping reset, which was later removed by commit e4c2ce82ca27 ("ring_buffer: allocate buffer page pointer"). Thus the comment is not accurate anyway, remove it. Link: https://lore.kernel.org/linux-trace-kernel/20230315142446.27040-1-vbabka@suse.cz Cc: Masami Hiramatsu Cc: Ingo Molnar Reported-by: Mike Rapoport Suggested-by: Steven Rostedt (Google) Fixes: e4c2ce82ca27 ("ring_buffer: allocate buffer page pointer") Signed-off-by: Vlastimil Babka Reviewed-by: Mukesh Ojha Signed-off-by: Steven Rostedt (Google) commit e400be674a1a40e9dcb2e95f84d6c1fd2d88f31d Author: Sung-hun Kim Date: Tue Mar 14 10:37:07 2023 +0900 tracing: Make splice_read available again Since the commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") is applied to the kernel, splice() and sendfile() calls on the trace file (/sys/kernel/debug/tracing /trace) return EINVAL. This patch restores these system calls by initializing splice_read in file_operations of the trace file. This patch only enables such functionalities for the read case. Link: https://lore.kernel.org/linux-trace-kernel/20230314013707.28814-1-sfoon.kim@samsung.com Cc: stable@vger.kernel.org Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") Signed-off-by: Sung-hun Kim Signed-off-by: Steven Rostedt (Google) commit 5cdfdd6da3231227611e0c24e005d6ea450bdc75 Merge: ce86beb43eb5f 18365ebf23f3e Author: Linus Torvalds Date: Sun Mar 19 10:09:58 2023 -0700 Merge tag 'tty-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are some small tty and serial driver fixes for 6.3-rc3 to resolve some reported issues. They include: - 8250 driver Kconfig issue pointed out by you that showed up in -rc1 - qcom-geni serial driver fixes - various 8250 driver fixes for reported problems - fsl_lpuart driver fixes - serdev fix for regression in -rc1 - vt.c bugfix All have been in linux-next for over a week with no reported problems" * tag 'tty-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: vt: protect KD_FONT_OP_GET_TALL from unbound access serial: qcom-geni: drop bogus uart_write_wakeup() serial: qcom-geni: fix mapping of empty DMA buffer serial: qcom-geni: fix DMA mapping leak on shutdown serial: qcom-geni: fix console shutdown hang serdev: Set fwnode for serdev devices tty: serial: fsl_lpuart: fix race on RX DMA shutdown serial: 8250_pci1xxxx: Disable SERIAL_8250_PCI1XXXX config by default serial: 8250_fsl: fix handle_irq locking serial: 8250_em: Fix UART port type serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency" commit ce86beb43eb5f801cb053abf763579f25d5276ab Merge: c46a7d047369b f551592f72563 Author: Linus Torvalds Date: Sun Mar 19 10:04:58 2023 -0700 Merge tag 'char-misc-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a few small char/misc/other driver subsystem patches to resolve reported problems for 6.3-rc3. Included in here are: - Interconnect driver fixes for reported problems - Memory driver fixes for reported problems - nvmem core fix - firmware driver fix for reported problem All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (23 commits) memory: tegra30-emc: fix interconnect registration race memory: tegra20-emc: fix interconnect registration race memory: tegra124-emc: fix interconnect registration race memory: tegra: fix interconnect registration race interconnect: exynos: drop redundant link destroy interconnect: exynos: fix registration race interconnect: exynos: fix node leak in probe PM QoS error path interconnect: qcom: msm8974: fix registration race interconnect: qcom: rpmh: fix registration race interconnect: qcom: rpmh: fix probe child-node error handling interconnect: qcom: rpm: fix registration race nvmem: core: return -ENOENT if nvmem cell is not found firmware: xilinx: don't make a sleepable memory allocation from an atomic context interconnect: qcom: rpm: fix probe child-node error handling interconnect: qcom: osm-l3: fix registration race interconnect: imx: fix registration race interconnect: fix provider registration API interconnect: fix icc_provider_del() error handling interconnect: fix mem leak when freeing nodes interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT ... commit e9b60c7f97130795c7aa81a649ae4b93a172a277 Author: Dave Chinner Date: Wed Mar 15 17:31:03 2023 -0700 pcpcntr: remove percpu_counter_sum_all() percpu_counter_sum_all() is now redundant as the race condition it was invented to handle is now dealt with by percpu_counter_sum() directly and all users of percpu_counter_sum_all() have been removed. Remove it. This effectively reverts the changes made in f689054aace2 ("percpu_counter: add percpu_counter_sum_all interface") except for the cpumask iteration that fixes percpu_counter_sum() made earlier in this series. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 7ba85fba47bd89618fdb7dc322bdf823b1b56efb Author: Dave Chinner Date: Wed Mar 15 17:31:03 2023 -0700 fork: remove use of percpu_counter_sum_all This effectively reverts the change made in commit f689054aace2 ("percpu_counter: add percpu_counter_sum_all interface") as the race condition percpu_counter_sum_all() was invented to avoid is now handled directly in percpu_counter_sum() and nobody needs to care about summing racing with cpu unplug anymore. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 8b57b11cca88f397035a95b9e12b03511847b0e8 Author: Dave Chinner Date: Wed Mar 15 17:31:02 2023 -0700 pcpcntrs: fix dying cpu summation race In commit f689054aace2 ("percpu_counter: add percpu_counter_sum_all interface") a race condition between a cpu dying and percpu_counter_sum() iterating online CPUs was identified. The solution was to iterate all possible CPUs for summation via percpu_counter_sum_all(). We recently had a percpu_counter_sum() call in XFS trip over this same race condition and it fired a debug assert because the filesystem was unmounting and the counter *should* be zero just before we destroy it. That was reported here: https://lore.kernel.org/linux-kernel/20230314090649.326642-1-yebin@huaweicloud.com/ likely as a result of running generic/648 which exercises filesystems in the presence of CPU online/offline events. The solution to use percpu_counter_sum_all() is an awful one. We use percpu counters and percpu_counter_sum() for accurate and reliable threshold detection for space management, so a summation race condition during these operations can result in overcommit of available space and that may result in filesystem shutdowns. As percpu_counter_sum_all() iterates all possible CPUs rather than just those online or even those present, the mask can include CPUs that aren't even installed in the machine, or in the case of machines that can hot-plug CPU capable nodes, even have physical sockets present in the machine. Fundamentally, this race condition is caused by the CPU being offlined being removed from the cpu_online_mask before the notifier that cleans up per-cpu state is run. Hence percpu_counter_sum() will not sum the count for a cpu currently being taken offline, regardless of whether the notifier has run or not. This is the root cause of the bug. The percpu counter notifier iterates all the registered counters, locks the counter and moves the percpu count to the global sum. This is serialised against other operations that move the percpu counter to the global sum as well as percpu_counter_sum() operations that sum the percpu counts while holding the counter lock. Hence the notifier is safe to run concurrently with sum operations, and the only thing we actually need to care about is that percpu_counter_sum() iterates dying CPUs. That's trivial to do, and when there are no CPUs dying, it has no addition overhead except for a cpumask_or() operation. This change makes percpu_counter_sum() always do the right thing in the presence of CPU hot unplug events and makes percpu_counter_sum_all() unnecessary. This, in turn, means that filesystems like XFS, ext4, and btrfs don't have to work out when they should use percpu_counter_sum() vs percpu_counter_sum_all() in their space accounting algorithms Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 1470afefc3c42df5d1662f87d079b46651bdc95b Author: Dave Chinner Date: Wed Mar 15 17:31:02 2023 -0700 cpumask: introduce for_each_cpu_or Equivalent of for_each_cpu_and, except it ORs the two masks together so it iterates all the CPUs present in either mask. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit c46a7d047369bb175bc689249c484a86616ee018 Merge: 80102f2ee715a 4783b9cb374af Author: Linus Torvalds Date: Sun Mar 19 09:57:53 2023 -0700 Merge tag 'ras_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS fix from Borislav Petkov: - Flush out logged errors immediately after MCA banks configuration changes over sysfs have been done instead of waiting until something else triggers the workqueue later - another error or the polling interval cycle is reached * tag 'ras_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Make sure logged MCEs are processed after sysfs update commit 3cfb9290da3d87a5877b03bda96c3d5d3ed9fcb0 Author: Darrick J. Wong Date: Thu Mar 16 09:31:20 2023 -0700 xfs: test dir/attr hash when loading module Back in the 6.2-rc1 days, Eric Whitney reported a fstests regression in ext4 against generic/454. The cause of this test failure was the unfortunate combination of setting an xattr name containing UTF8 encoded emoji, an xattr hash function that accepted a char pointer with no explicit signedness, signed type extension of those chars to an int, and the 6.2 build tools maintainers deciding to mandate -funsigned-char across the board. As a result, the ondisk extended attribute structure written out by 6.1 and 6.2 were not the same. This discrepancy, in fact, had been noticeable if a filesystem with such an xattr were moved between any two architectures that don't employ the same signedness of a raw "char" declaration. The only reason anyone noticed is that x86 gcc defaults to signed, and no such -funsigned-char update was made to e2fsprogs, so e2fsck immediately started reporting data corruption. After a day and a half of discussing how to handle this use case (xattrs with bit 7 set anywhere in the name) without breaking existing users, Linus merged his own patch and didn't tell the maintainer. None of the ext4 developers realized this until AUTOSEL announced that the commit had been backported to stable. In the end, this problem could have been detected much earlier if there had been any useful tests of hash function(s) in use inside ext4 to make sure that they always produce the same outputs given the same inputs. The XFS dirent/xattr name hash takes a uint8_t*, so I don't think it's vulnerable to this problem. However, let's avoid all this drama by adding our own self test to check that the da hash produces the same outputs for a static pile of inputs on various platforms. This enables us to fix any breakage that may result in a controlled fashion. The buffer and test data are identical to the patches submitted to xfsprogs. Link: https://lore.kernel.org/linux-ext4/Y8bpkm3jA3bDm3eL@debian-BULLSEYE-live-builder-AMD64/ Link: https://lore.kernel.org/linux-xfs/ZBUKCRR7xvIqPrpX@destitution/T/#md38272cc684e2c0d61494435ccbb91f022e8dee4 Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit e6fbb7167ed005783ac5aef3e75699f45ffe2af8 Author: Darrick J. Wong Date: Wed Mar 15 17:30:33 2023 -0700 xfs: add tracepoints for each of the externally visible allocators There are now five separate space allocator interfaces exposed to the rest of XFS for five different strategies to find space. Add tracepoints for each of them so that I can tell from a trace dump exactly which ones got called and what happened underneath them. Add a sixth so it's more obvious if an allocation actually happened. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 9eb775968b68d049fb3b00353f12cd10308527c7 Author: Darrick J. Wong Date: Wed Mar 15 17:30:33 2023 -0700 xfs: walk all AGs if TRYLOCK passed to xfs_alloc_vextent_iterate_ags Callers of xfs_alloc_vextent_iterate_ags that pass in the TRYLOCK flag want us to perform a non-blocking scan of the AGs for free space. There are no ordering constraints for non-blocking AGF lock acquisition, so the scan can freely start over at AG 0 even when minimum_agno > 0. This manifests fairly reliably on xfs/294 on 6.3-rc2 with the parent pointer patchset applied and the realtime volume enabled. I observed the following sequence as part of an xfs_dir_createname call: 0. Fragment the free space, then allocate nearly all the free space in all AGs except AG 0. 1. Create a directory in AG 2 and let it grow for a while. 2. Try to allocate 2 blocks to expand the dirent part of a directory. The space will be allocated out of AG 0, but the allocation will not be contiguous. This (I think) activates the LOWMODE allocator. 3. The bmapi call decides to convert from extents to bmbt format and tries to allocate 1 block. This allocation request calls xfs_alloc_vextent_start_ag with the inode number, which starts the scan at AG 2. We ignore AG 0 (with all its free space) and instead scrape AG 2 and 3 for more space. We find one block, but this now kicks t_highest_agno to 3. 4. The createname call decides it needs to split the dabtree. It tries to allocate even more space with xfs_alloc_vextent_start_ag, but now we're constrained to AG 3, and we don't find the space. The createname returns ENOSPC and the filesystem shuts down. This change fixes the problem by making the trylock scan wrap around to AG 0 if it doesn't like the AGs that it finds. Since the current transaction itself holds AGF 0, the trylock of AGF 0 will succeed, and we take space from the AG that has plenty. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 80102f2ee715ab07be476df443bba388d5458fd1 Merge: 4ac39c5910add fd0815f632c24 Author: Linus Torvalds Date: Sun Mar 19 09:47:55 2023 -0700 Merge tag 'perf_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Check whether sibling events have been deactivated before adding them to groups - Update the proper event time tracking variable depending on the event type - Fix a memory overwrite issue due to using the wrong function argument when outputting perf events * tag 'perf_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix check before add_event_to_groups() in perf_group_detach() perf: fix perf_event_context->time perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output commit 4ac39c5910add53e77aad356cc19721206c76ef7 Merge: 995bba436bc5c cbebd68f59f03 Author: Linus Torvalds Date: Sun Mar 19 09:43:41 2023 -0700 Merge tag 'x86_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: "There's a little bit more 'movement' in there for my taste but it needs to happen and should make the code better after it. - Check cmdline_find_option()'s return value before further processing - Clear temporary storage in the resctrl code to prevent access to an unexistent MSR - Add a simple throttling mechanism to protect the hypervisor from potentially malicious SEV guests issuing requests in rapid succession. In order to not jeopardize the sanity of everyone involved in maintaining this code, the request issuing side has received a cleanup, split in more or less trivial, small and digestible pieces. Otherwise, the code was threatening to become an unmaintainable mess. Therefore, that cleanup is marked indirectly also for stable so that there's no differences between the upstream code and the stable variant when it comes down to backporting more there" * tag 'x86_urgent_for_v6.3_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Fix use of uninitialized buffer in sme_enable() x86/resctrl: Clear staged_config[] before and after it is used virt/coco/sev-guest: Add throttling awareness virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case virt/coco/sev-guest: Do some code style cleanups virt/coco/sev-guest: Carve out the request issuing logic into a helper virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request() virt/coco/sev-guest: Simplify extended guest request handling virt/coco/sev-guest: Check SEV_SNP attribute at probe time commit 995bba436bc5c6a200510828a09cd404a7f2a129 Merge: a3671bd86a977 70e42feab2e20 Author: Linus Torvalds Date: Sun Mar 19 09:38:26 2023 -0700 Merge tag 'ext4_for_linus_urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fix from Ted Ts'o: "Fix a double unlock bug on an error path in ext4, found by smatch and syzkaller" * tag 'ext4_for_linus_urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix possible double unlock when moving a directory commit 8732565549011cabbea08329a1aefd78a68d96c7 Author: Tom Rix Date: Sat Mar 11 08:51:13 2023 -0500 ftrace: Set direct_ops storage-class-specifier to static smatch reports this warning kernel/trace/ftrace.c:2594:19: warning: symbol 'direct_ops' was not declared. Should it be static? The variable direct_ops is only used in ftrace.c, so it should be static Link: https://lore.kernel.org/linux-trace-kernel/20230311135113.711824-1-trix@redhat.com Signed-off-by: Tom Rix Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 08697bca9bbba15f2058fdbd9f970bd5f6a8a2e8 Author: Tero Kristo Date: Fri Mar 10 12:04:51 2023 +0200 trace/hwlat: Do not start per-cpu thread if it is already running The hwlatd tracer will end up starting multiple per-cpu threads with the following script: #!/bin/sh cd /sys/kernel/debug/tracing echo 0 > tracing_on echo hwlat > current_tracer echo per-cpu > hwlat_detector/mode echo 100000 > hwlat_detector/width echo 200000 > hwlat_detector/window echo 1 > tracing_on To fix the issue, check if the hwlatd thread for the cpu is already running, before starting a new one. Along with the previous patch, this avoids running multiple instances of the same CPU thread on the system. Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/ Link: https://lkml.kernel.org/r/20230310100451.3948583-3-tero.kristo@linux.intel.com Cc: stable@vger.kernel.org Fixes: f46b16520a087 ("trace/hwlat: Implement the per-cpu mode") Signed-off-by: Tero Kristo Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4c42f5f0d1dd20bddd9f940beb1e6ccad60c4498 Author: Tero Kristo Date: Fri Mar 10 12:04:50 2023 +0200 trace/hwlat: Do not wipe the contents of per-cpu thread data Do not wipe the contents of the per-cpu kthread data when starting the tracer, as this will completely forget about already running instances and can later start new additional per-cpu threads. Link: https://lore.kernel.org/all/20230302113654.2984709-1-tero.kristo@linux.intel.com/ Link: https://lkml.kernel.org/r/20230310100451.3948583-2-tero.kristo@linux.intel.com Cc: stable@vger.kernel.org Fixes: f46b16520a087 ("trace/hwlat: Implement the per-cpu mode") Signed-off-by: Tero Kristo Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 7a025e066e0f0afd39cc88a089929ccb945ce9e8 Author: Tom Rix Date: Thu Mar 9 10:04:14 2023 -0500 tracing/osnoise: set several trace_osnoise.c variables storage-class-specifier to static smatch reports several similar warnings kernel/trace/trace_osnoise.c:220:1: warning: symbol '__pcpu_scope_per_cpu_osnoise_var' was not declared. Should it be static? kernel/trace/trace_osnoise.c:243:1: warning: symbol '__pcpu_scope_per_cpu_timerlat_var' was not declared. Should it be static? kernel/trace/trace_osnoise.c:335:14: warning: symbol 'interface_lock' was not declared. Should it be static? kernel/trace/trace_osnoise.c:2242:5: warning: symbol 'timerlat_min_period' was not declared. Should it be static? kernel/trace/trace_osnoise.c:2243:5: warning: symbol 'timerlat_max_period' was not declared. Should it be static? These variables are only used in trace_osnoise.c, so it should be static Link: https://lore.kernel.org/linux-trace-kernel/20230309150414.4036764-1-trix@redhat.com Signed-off-by: Tom Rix Acked-by: Masami Hiramatsu (Google) Acked-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit bc4f359b3b607daac0290d0038561237a86b38cb Author: Anton Gusev Date: Tue Jan 31 10:58:18 2023 +0300 tracing: Fix wrong return in kprobe_event_gen_test.c Overwriting the error code with the deletion result may cause the function to return 0 despite encountering an error. Commit b111545d26c0 ("tracing: Remove the useless value assignment in test_create_synth_event()") solves a similar issue by returning the original error code, so this patch does the same. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ru Signed-off-by: Anton Gusev Reviewed-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 6d206b1ea9f48433a96edec7028586db1d947911 Author: Ido Schimmel Date: Fri Mar 17 16:32:59 2023 +0100 mlxsw: core_thermal: Fix fan speed in maximum cooling state The cooling levels array is supposed to prevent the system fans from being configured below a 20% duty cycle as otherwise some of them get stuck at 0 RPM. Due to an off-by-one error, the last element in the array was not initialized, causing it to be set to zero, which in turn lead to fans being configured with a 0% duty cycle in maximum cooling state. Since commit 332fdf951df8 ("mlxsw: thermal: Fix out-of-bounds memory accesses") the contents of the array are static. Therefore, instead of fixing the initialization of the array, simply remove it and adjust thermal_cooling_device_ops::set_cur_state() so that the configured duty cycle is never set below 20%. Before: # cat /sys/class/thermal/thermal_zone0/cdev0/type mlxsw_fan # echo 10 > /sys/class/thermal/thermal_zone0/cdev0/cur_state # cat /sys/class/hwmon/hwmon0/name mlxsw # cat /sys/class/hwmon/hwmon0/pwm1 0 After: # cat /sys/class/thermal/thermal_zone0/cdev0/type mlxsw_fan # echo 10 > /sys/class/thermal/thermal_zone0/cdev0/cur_state # cat /sys/class/hwmon/hwmon0/name mlxsw # cat /sys/class/hwmon/hwmon0/pwm1 255 This bug was uncovered when the thermal subsystem repeatedly tried to configure the cooling devices to their maximum state due to another issue [1]. This resulted in the fans being stuck at 0 RPM, which eventually lead to the system undergoing thermal shutdown. [1] https://lore.kernel.org/netdev/ZA3CFNhU4AbtsP4G@shredder/ Fixes: a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels") Signed-off-by: Ido Schimmel Reviewed-by: Vadim Pasternak Signed-off-by: Petr Machata Signed-off-by: David S. Miller commit 04361b8bb81819efb68bf39c276025e2250ac537 Author: Russell King (Oracle) Date: Fri Mar 17 07:28:00 2023 +0000 net: sfp: fix state loss when updating state_hw_mask Andrew reports that the SFF modules on one of the ZII platforms do not indicate link up due to the SFP code believing that LOS indicating that there is no signal being received from the remote end, but in fact the LOS signal is showing that there is signal. What makes SFF modules different from SFPs is they typically have an inverted LOS, which uncovered this issue. When we read the hardware state, we mask it with state_hw_mask so we ignore anything we're not interested in. However, we don't re-read when state_hw_mask changes, leading to sfp->state being stale. Arrange for a software poll of the module state after we have parsed the EEPROM in sfp_sm_mod_probe() and updated state_*_mask. This will generate any necessary events for signal changes for the state machine as well as updating sfp->state. Reported-by: Andrew Lunn Tested-by: Andrew Lunn Fixes: 8475c4b70b04 ("net: sfp: re-implement soft state polling setup") Signed-off-by: Russell King (Oracle) Signed-off-by: David S. Miller commit 070246e4674b125860d311c18ce2623e73e2bd51 Author: Jochen Henneberg Date: Fri Mar 17 09:08:17 2023 +0100 net: stmmac: Fix for mismatched host/device DMA address width Currently DMA address width is either read from a RO device register or force set from the platform data. This breaks DMA when the host DMA address width is <=32it but the device is >32bit. Right now the driver may decide to use a 2nd DMA descriptor for another buffer (happens in case of TSO xmit) assuming that 32bit addressing is used due to platform configuration but the device will still use both descriptor addresses as one address. This can be observed with the Intel EHL platform driver that sets 32bit for addr64 but the MAC reports 40bit. The TX queue gets stuck in case of TCP with iptables NAT configuration on TSO packets. The logic should be like this: Whatever we do on the host side (memory allocation GFP flags) should happen with the host DMA width, whenever we decide how to set addresses on the device registers we must use the device DMA address width. This patch renames the platform address width field from addr64 (term used in device datasheet) to host_addr and uses this value exclusively for host side operations while all chip operations consider the device DMA width as read from the device register. Fixes: 7cfc4486e7ea ("stmmac: intel: Configure EHL PSE0 GbE and PSE1 GbE to 32 bits DMA addressing") Signed-off-by: Jochen Henneberg Signed-off-by: David S. Miller commit 543887d7a8f2309688a21e35831a292405c68e88 Merge: 4203d84032e28 30b605b8501e3 Author: David S. Miller Date: Sun Mar 19 10:48:35 2023 +0000 Merge branch 'mdiobus-module-owner' Florian Fainelli says: ==================== ACPI/DT mdiobus module owner fixes This patch series fixes wrong mdiobus module ownership for MDIO buses registered from DT or ACPI. Thanks Maxime for providing the first patch and making me see that ACPI also had the same issue. Changes in v2: - fixed missing kdoc in the first patch ==================== Signed-off-by: David S. Miller commit 30b605b8501e321f79e19c3238aa6ca31da6087c Author: Florian Fainelli Date: Thu Mar 16 16:33:17 2023 -0700 net: mdio: fix owner field for mdio buses registered using ACPI Bus ownership is wrong when using acpi_mdiobus_register() to register an mdio bus. That function is not inline, so when it calls mdiobus_register() the wrong THIS_MODULE value is captured. CC: Maxime Bizon Fixes: 803ca24d2f92 ("net: mdio: Add ACPI support code for mdio") Signed-off-by: Florian Fainelli Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 99669259f3361d759219811e670b7e0742668556 Author: Maxime Bizon Date: Thu Mar 16 16:33:16 2023 -0700 net: mdio: fix owner field for mdio buses registered using device-tree Bus ownership is wrong when using of_mdiobus_register() to register an mdio bus. That function is not inline, so when it calls mdiobus_register() the wrong THIS_MODULE value is captured. Signed-off-by: Maxime Bizon Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") [florian: fix kdoc, added Fixes tag] Signed-off-by: Florian Fainelli Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 4203d84032e28f893594a453bd8bc9c3b15c7334 Author: Florian Fainelli Date: Thu Mar 16 13:33:24 2023 -0700 net: phy: Ensure state transitions are processed from phy_stop() In the phy_disconnect() -> phy_stop() path, we will be forcibly setting the PHY state machine to PHY_HALTED. This invalidates the old_state != phydev->state condition in phy_state_machine() such that we will neither display the state change for debugging, nor will we invoke the link_change_notify() callback. Factor the code by introducing phy_process_state_change(), and ensure that we process the state change from phy_stop() as well. Fixes: 5c5f626bcace ("net: phy: improve handling link_change_notify callback") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 739cb49988afc1da85edce984212e5bbadbbf6ce Merge: e8d20c3ded59a 2b4cc3d3f4d8e Author: David S. Miller Date: Sun Mar 19 10:44:24 2023 +0000 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-16 (igb, igbvf, igc) This series contains updates to igb, igbvf, and igc drivers. Lin Ma removes rtnl_lock() when disabling SRIOV on remove which was causing deadlock on igb. Akihiko Odaki delays enabling of SRIOV on igb to prevent early messages that could get ignored and clears MAC address when PF returns nack on reset; indicating no MAC address was assigned for igbvf. Gaosheng Cui frees IRQs in error path for igbvf. Akashi Takahiro fixes logic on checking TAPRIO gate support for igc. ==================== Signed-off-by: David S. Miller commit e8d20c3ded59a092532513c9bd030d1ea66f5f44 Author: Zheng Wang Date: Fri Mar 17 00:15:26 2023 +0800 xirc2ps_cs: Fix use after free bug in xirc2ps_detach In xirc2ps_probe, the local->tx_timeout_task was bounded with xirc2ps_tx_timeout_task. When timeout occurs, it will call xirc_tx_timeout->schedule_work to start the work. When we call xirc2ps_detach to remove the driver, there may be a sequence as follows: Stop responding to timeout tasks and complete scheduled tasks before cleanup in xirc2ps_detach, which will fix the problem. CPU0 CPU1 |xirc2ps_tx_timeout_task xirc2ps_detach | free_netdev | kfree(dev); | | | do_reset | //use dev Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Wang Signed-off-by: David S. Miller commit e4522c097ec10f23ea0933e9e69d4fa9d8ae9441 Author: Tatyana Nikolova Date: Wed Mar 15 09:52:31 2023 -0500 RDMA/irdma: Add ipv4 check to irdma_find_listener() Add ipv4 check to irdma_find_listener(). Otherwise the function incorrectly finds and returns a listener with a different addr family for the zero IP addr, if a listener with a zero IP addr and the same port as the one searched for has already been created. Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") Signed-off-by: Tatyana Nikolova Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230315145231.931-5-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 8385a875c9eecc429b2f72970efcbb0e5cb5b547 Author: Mustafa Ismail Date: Wed Mar 15 09:52:30 2023 -0500 RDMA/irdma: Increase iWARP CM default rexmit count When running perftest with large number of connections in iWARP mode, the passive side could be slow to respond. Increase the rexmit counter default to allow scaling connections. Fixes: 146b9756f14c ("RDMA/irdma: Add connection manager") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230315145231.931-4-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit b69a6979dbaa2453675fe9c71bdc2497fedb11f9 Author: Mustafa Ismail Date: Wed Mar 15 09:52:29 2023 -0500 RDMA/irdma: Fix memory leak of PBLE objects On rmmod of irdma, the PBLE object memory is not being freed. PBLE object memory are not statically pre-allocated at function initialization time unlike other HMC objects. PBLEs objects and the Segment Descriptors (SD) for it can be dynamically allocated during scale up and SD's remain allocated till function deinitialization. Fix this leak by adding IRDMA_HMC_IW_PBLE to the iw_hmc_obj_types[] table and skip pbles in irdma_create_hmc_obj but not in irdma_del_hmc_objects(). Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230315145231.931-3-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 30ed9ee9a10a90ae719dcfcacead1d0506fa45ed Author: Mustafa Ismail Date: Wed Mar 15 09:52:28 2023 -0500 RDMA/irdma: Do not generate SW completions for NOPs Currently, artificial SW completions are generated for NOP wqes which can generate unexpected completions with wr_id = 0. Skip the generation of artificial completions for NOPs. Fixes: 81091d7696ae ("RDMA/irdma: Add SW mechanism to generate completions on error") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230315145231.931-2-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 25143b6a01d0cc5319edd3de22ffa2578b045550 Author: Daniil Tatianin Date: Thu Mar 16 13:29:21 2023 +0300 qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info We have to make sure that the info returned by the helper is valid before using it. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") Fixes: 733def6a04bf ("qed*: IOV link control") Signed-off-by: Daniil Tatianin Reviewed-by: Michal Swiatkowski Signed-off-by: David S. Miller commit b7a5822810c4398515300d614d988cf638adecad Author: Tim Crawford Date: Fri Mar 17 08:18:25 2023 -0600 ALSA: hda/realtek: Add quirks for some Clevo laptops Add the audio quirk for some of Clevo's latest RPL laptops: - NP50RNJS (ALC256) - NP70SNE (ALC256) - PD50SNE (ALC1220) - PE60RNE (ALC1220) Co-authored-by: Jeremy Soller Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20230317141825.11807-1-tcrawford@system76.com Signed-off-by: Takashi Iwai commit 4bcf6f827a79c59806c695dc280e763c5b6a6813 Author: Eric Biggers Date: Mon Mar 13 15:12:31 2023 -0700 fscrypt: check for NULL keyring in fscrypt_put_master_key_activeref() It is a bug for fscrypt_put_master_key_activeref() to see a NULL keyring. But it used to be possible due to the bug, now fixed, where fscrypt_destroy_keyring() was called before security_sb_delete(). To be consistent with how fscrypt_destroy_keyring() uses WARN_ON for the same issue, WARN and leak the fscrypt_master_key if the keyring is NULL instead of dereferencing the NULL pointer. This is a robustness improvement, not a fix. Link: https://lore.kernel.org/r/20230313221231.272498-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 43e5f1d5921128373743585e3275ed9044ef8b8f Author: Eric Biggers Date: Mon Mar 13 15:12:30 2023 -0700 fscrypt: improve fscrypt_destroy_keyring() documentation Document that fscrypt_destroy_keyring() must be called after all potentially-encrypted inodes have been evicted. Link: https://lore.kernel.org/r/20230313221231.272498-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a3671bd86a9770e34969522d29bb30a1b66fd88a Merge: 534293368afa1 29413f05fe34e Author: Linus Torvalds Date: Sat Mar 18 16:01:34 2023 -0700 Merge tag 'fbdev-for-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: "The majority of lines changed is due to a code style cleanup in the pnmtologo helper program. Arnd removed the omap1 osk driver and the SIS fb driver is now orphaned. Other than that it's the usual bunch of small fixes and cleanups, e.g. prevent possible divide-by-zero in various fb drivers if the pixclock is zero and various conversions to devm_platform*() and of_property*() functions: - Drop omap1 osk driver - Various potential divide by zero pixclock fixes - Add pixelclock and fb_check_var() to stifb - Code style cleanups and indenting fixes" * tag 'fbdev-for-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: Use of_property_present() for testing DT property presence fbdev: au1200fb: Fix potential divide by zero fbdev: lxfb: Fix potential divide by zero fbdev: intelfb: Fix potential divide by zero fbdev: nvidia: Fix potential divide by zero fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks fbdev: omapfb: remove omap1 osk driver fbdev: xilinxfb: Use devm_platform_get_and_ioremap_resource() fbdev: wm8505fb: Use devm_platform_ioremap_resource() fbdev: pxa3xx-gcu: Use devm_platform_get_and_ioremap_resource() fbdev: Use of_property_read_bool() for boolean properties fbdev: clps711x-fb: Use devm_platform_get_and_ioremap_resource() fbdev: tgafb: Fix potential divide by zero MAINTAINERS: orphan SIS FRAMEBUFFER DRIVER fbdev: omapfb: cleanup inconsistent indentation drivers: video: logo: add SPDX comment, remove GPL notice in pnmtologo.c drivers: video: logo: fix code style issues in pnmtologo.c commit 534293368afa1a953c283310b82e4dc58309d51e Merge: 2a3e75a7ab159 05e96e96a315f Author: Linus Torvalds Date: Sat Mar 18 11:49:48 2023 -0700 Merge tag 'kbuild-fixes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Exclude kallsyms_seqs_of_names from kallsyms to fix build error - Fix 'make kernelrelease' for external module builds - Get the Debian source package compilable again - Fix the wrong uname when Debian packages are built with the KDEB_PKGVERSION option - Fix superfluous CROSS_COMPILE when building Debian packages - Fix RPM package build error when KCONFIG_CONFIG is set - Use 'git archive' for creating source tarballs - Remove the scripts/list-gitignored tool * tag 'kbuild-fixes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: use git-archive for source package creation kbuild: rpm-pkg: move source components to rpmbuild/SOURCES kbuild: deb-pkg: use dh_listpackages to know enabled packages kbuild: deb-pkg: split image and debug objects staging out into functions kbuild: deb-pkg: set CROSS_COMPILE only when undefined kbuild: deb-pkg: do not take KERNELRELEASE from the source version kbuild: deb-pkg: make debian source package working again Makefile: Make kernelrelease target work with M= kconfig: Update config changed flag before calling callback kallsyms: add kallsyms_seqs_of_names to list of special symbols commit 2a3e75a7ab1590fdc015ed40ebeb074ffd092186 Merge: f900bffe2dac7 ab00709310eed Author: Linus Torvalds Date: Sat Mar 18 11:33:44 2023 -0700 Merge tag 'hwmon-for-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ltc2992, adm1266: Set missing can_sleep flag - tmp512/tmp513: Drop of_match_ptr for ID table to fix build with !CONFIG_OF - ucd90320: Fix back-to-back access problem - ina3221: Fix bad error return from probe function - xgene: Fix use-after-free bug in remove function - adt7475: Fix hysteresis register bit masks, and fix association of 'smoothing' attributes * tag 'hwmon-for-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip hwmon: (adm1266) Set `can_sleep` flag for GPIO chip hwmon: tmp512: drop of_match_ptr for ID table hwmon: (ucd90320) Add minimum delay between bus accesses hwmon: (ina3221) return prober error code hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition hwmon: (adt7475) Fix masking of hysteresis registers hwmon: (adt7475) Display smoothing attributes in correct order commit f900bffe2dac7eca800406b152da5acd05e92129 Merge: efbcbb12ee99f 5bc9e2d43f861 Author: Linus Torvalds Date: Sat Mar 18 11:25:39 2023 -0700 Merge tag 'ata-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fixes from Damien Le Moal: - Two fixes from Ondrej for the pata_parport driver to address an issue with error handling during drive connection and to fix memory leaks in case of errors during initialization and when disconnecting a device. * tag 'ata-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_parport: fix memory leaks ata: pata_parport: fix parport release without claim commit efbcbb12ee99f750c9f25c873b55ad774871de2a Author: Linus Torvalds Date: Fri Mar 17 13:51:17 2023 -0700 media: m5mols: fix off-by-one loop termination error The __find_restype() function loops over the m5mols_default_ffmt[] array, and the termination condition ends up being wrong: instead of stopping when the iterator becomes the size of the array it traverses, it stops after it has already overshot the array. Now, in practice this doesn't likely matter, because the code will always find the entry it looks for, and will thus return early and never hit that last extra iteration. But it turns out that clang will unroll the loop fully, because it has only two iterations (well, three due to the off-by-one bug), and then clang will end up just giving up in the middle of the loop unrolling when it notices that the code walks past the end of the array. And that made 'objtool' very unhappy indeed, because the generated code just falls off the edge of the universe, and ends up falling through to the next function, causing this warning: drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc() Fix the loop ending condition. Reported-by: Jens Axboe Analyzed-by: Miguel Ojeda Analyzed-by: Nick Desaulniers Link: https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@mail.gmail.com/ Fixes: bc125106f8af ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP") Cc: HeungJun, Kim Cc: Sylwester Nawrocki Cc: Kyungmin Park Cc: Mauro Carvalho Chehab Signed-off-by: Linus Torvalds commit 363c7dc72f79edd55bf1c4380e0fbf7f1bbc2c86 Author: Lars-Peter Clausen Date: Sun Mar 12 14:09:33 2023 -0700 iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip The ads7950 uses a mutex as well as SPI transfers in its GPIO callbacks. This means these callbacks can sleep and the `can_sleep` flag should be set. Having the flag set will make sure that warnings are generated when calling any of the callbacks from a potentially non-sleeping context. Fixes: c97dce792dc8 ("iio: adc: ti-ads7950: add GPIO support") Signed-off-by: Lars-Peter Clausen Acked-by: David Lechner Link: https://lore.kernel.org/r/20230312210933.2275376-1-lars@metafoo.de Cc: Signed-off-by: Jonathan Cameron commit 49f76c499d38bf67803438eee88c8300d0f6ce09 Author: Patrik Dahlström Date: Mon Mar 13 21:50:29 2023 +0100 iio: adc: palmas_gpadc: fix NULL dereference on rmmod Calling dev_to_iio_dev() on a platform device pointer is undefined and will make adc NULL. Signed-off-by: Patrik Dahlström Link: https://lore.kernel.org/r/20230313205029.1881745-1-risca@dalakolonin.se Signed-off-by: Jonathan Cameron commit 4985e7b2c002eb4c5c794a1d3acd91b82c89a0fd Author: Ming Lei Date: Sat Mar 18 22:12:31 2023 +0800 block: ublk_drv: mark device as LIVE before adding disk IO can be started before add_disk() returns, such as reading parititon table, then the monitor work should work for making forward progress. So mark device as LIVE before adding disk, meantime change to DEAD if add_disk() fails. Fixed: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: Ziyang Zhang Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230318141231.55562-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit ab327f8acdf8d06601fbf058859a539a9422afff Author: Álvaro Fernández Rojas Date: Fri Mar 17 11:20:04 2023 +0100 mips: bmips: BCM6358: disable RAC flush for TP1 RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1: [ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform [ 3.895011] Reserved instruction in kernel code[#1]: [ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0 [ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060 [ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0 [ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000 [ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa [ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470 [ 3.932848] $20 : 00000000 00000000 55590000 77d70000 [ 3.938251] $24 : 00000018 00000010 [ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc [ 3.949058] Hi : 00000000 [ 3.952013] Lo : 00000000 [ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c [ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c [ 3.965913] Status: 10008703 KERNEL EXL IE [ 3.970216] Cause : 00800028 (ExcCode 0a) [ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350) [ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common [ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8) [ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470 [ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74 [ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003 [ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000 [ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000 [ 4.044196] ... [ 4.046706] Call Trace: [ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c [ 4.054356] [<80015c70>] setup_frame+0xdc/0x124 [ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288 [ 4.064207] [<80011b50>] work_notifysig+0x10/0x18 [ 4.069036] [ 4.070538] Code: 8fc300b4 00001025 26240008 ac830004 3c048063 0c0228aa 24846a00 26240010 [ 4.080686] [ 4.082517] ---[ end trace 22a8edb41f5f983b ]--- [ 4.087374] Kernel panic - not syncing: Fatal exception [ 4.092753] Rebooting in 1 seconds.. Because the bootloader (CFE) is not initializing the Read-ahead cache properly on the second thread (TP1). Since the RAC was not initialized properly, we should avoid flushing it at the risk of corrupting the instruction stream as seen in the trace above. Fixes: d59098a0e9cb ("MIPS: bmips: use generic dma noncoherent ops") Signed-off-by: Álvaro Fernández Rojas Signed-off-by: Thomas Bogendoerfer commit 00f4bc5184c19cb33f468f1ea409d70d19f8f502 Author: William Breathitt Gray Date: Thu Mar 16 16:34:26 2023 -0400 counter: 104-quad-8: Fix Synapse action reported for Index signals Signal 16 and higher represent the device's Index lines. The priv->preset_enable array holds the device configuration for these Index lines. The preset_enable configuration is active low on the device, so invert the conditional check in quad8_action_read() to properly handle the logical state of preset_enable. Fixes: f1d8a071d45b ("counter: 104-quad-8: Add Generic Counter interface support") Cc: Link: https://lore.kernel.org/r/20230316203426.224745-1-william.gray@linaro.org/ Signed-off-by: William Breathitt Gray commit 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed Author: William Breathitt Gray Date: Sun Mar 12 19:15:49 2023 -0400 counter: 104-quad-8: Fix race condition between FLAG and CNTR reads The Counter (CNTR) register is 24 bits wide, but we can have an effective 25-bit count value by setting bit 24 to the XOR of the Borrow flag and Carry flag. The flags can be read from the FLAG register, but a race condition exists: the Borrow flag and Carry flag are instantaneous and could change by the time the count value is read from the CNTR register. Since the race condition could result in an incorrect 25-bit count value, remove support for 25-bit count values from this driver; hard-coded maximum count values are replaced by a LS7267_CNTR_MAX define for consistency and clarity. Fixes: 28e5d3bb0325 ("iio: 104-quad-8: Add IIO support for the ACCES 104-QUAD-8") Cc: # 6.1.x Cc: # 6.2.x Link: https://lore.kernel.org/r/20230312231554.134858-1-william.gray@linaro.org/ Signed-off-by: William Breathitt Gray commit 5ed213dd64681f84a01ceaa82fb336cf7d59ddcf Author: Hans de Goede Date: Tue Mar 14 13:31:03 2023 +0100 efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L Another Lenovo convertable which reports a landscape resolution of 1920x1200 with a pitch of (1920 * 4) bytes, while the actual framebuffer has a resolution of 1200x1920 with a pitch of (1200 * 4) bytes. Signed-off-by: Hans de Goede Reviewed-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit 3615c78673c332b69aaacefbcde5937c5c706686 Author: Hans de Goede Date: Tue Mar 14 13:31:02 2023 +0100 efi: sysfb_efi: Fix DMI quirks not working for simpledrm Commit 8633ef82f101 ("drivers/firmware: consolidate EFI framebuffer setup for all arches") moved the sysfb_apply_efi_quirks() call in sysfb_init() from before the [sysfb_]parse_mode() call to after it. But sysfb_apply_efi_quirks() modifies the global screen_info struct which [sysfb_]parse_mode() parses, so doing it later is too late. This has broken all DMI based quirks for correcting wrong firmware efifb settings when simpledrm is used. To fix this move the sysfb_apply_efi_quirks() call back to its old place and split the new setup of the efifb_fwnode (which requires the platform_device) into its own function and call that at the place of the moved sysfb_apply_efi_quirks(pd) calls. Fixes: 8633ef82f101 ("drivers/firmware: consolidate EFI framebuffer setup for all arches") Cc: stable@vger.kernel.org Cc: Javier Martinez Canillas Cc: Thomas Zimmermann Signed-off-by: Hans de Goede Reviewed-by: Javier Martinez Canillas Signed-off-by: Ard Biesheuvel commit f59a7ec1e69fc23946175b8c0d7e0fd21f94f8c9 Author: Ard Biesheuvel Date: Tue Feb 28 19:33:14 2023 +0100 efi/libstub: smbios: Drop unused 'recsize' parameter We no longer use the recsize argument for locating the string table in an SMBIOS record, so we can drop it from the internal API. Signed-off-by: Ard Biesheuvel commit eb684408f3ea4856639675d6465f0024e498e4b1 Author: Ard Biesheuvel Date: Tue Feb 28 17:00:49 2023 +0100 arm64: efi: Use SMBIOS processor version to key off Ampere quirk Instead of using the SMBIOS type 1 record 'family' field, which is often modified by OEMs, use the type 4 'processor ID' and 'processor version' fields, which are set to a small set of probe-able values on all known Ampere EFI systems in the field. Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") Tested-by: Andrea Righi Signed-off-by: Ard Biesheuvel commit 34343eb06afc04af9178a9883d9354dc12beede0 Author: Ard Biesheuvel Date: Tue Feb 28 19:23:09 2023 +0100 efi/libstub: smbios: Use length member instead of record struct size The type 1 SMBIOS record happens to always be the same size, but there are other record types which have been augmented over time, and so we should really use the length field in the header to decide where the string table starts. Fixes: 550b33cfd4452968 ("arm64: efi: Force the use of ...") Signed-off-by: Ard Biesheuvel commit e866f29a6ff1804efb5c9cfc1e354192615dfb64 Merge: 3dacc5bb81472 964290ff32d13 Author: Jakub Kicinski Date: Fri Mar 17 22:39:33 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-16 (iavf) This series contains updates to iavf driver only. Alex fixes incorrect check against Rx hash feature and corrects payload value for IPv6 UDP packet. Ahmed removes bookkeeping of VLAN 0 filter as it always exists and can cause a false max filter error message. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: do not track VLAN 0 filters iavf: fix non-tunneled IPv6 UDP packet type and hashing iavf: fix inverted Rx hash condition leading to disabled hash ==================== Link: https://lore.kernel.org/r/20230316155316.1554931-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3dacc5bb81472905a7f4f9879cb95477c22dc359 Author: Grygorii Strashko Date: Thu Mar 16 15:22:32 2023 +0530 net: ethernet: ti: am65-cpts: reset pps genf adj settings on enable The CPTS PPS GENf adjustment settings are invalid after it has been disabled for a while, so reset them. Fixes: eb9233ce6751 ("net: ethernet: ti: am65-cpts: adjust pps following ptp changes") Signed-off-by: Grygorii Strashko Signed-off-by: Siddharth Vadapalli Reviewed-by: Roger Quadros Reviewed-by: Michal Swiatkowski Link: https://lore.kernel.org/r/20230316095232.2002680-1-s-vadapalli@ti.com Signed-off-by: Jakub Kicinski commit ff821092cf02a70c2bccd2d19269f01e29aa52cf Author: Szymon Heidrich Date: Thu Mar 16 11:19:54 2023 +0100 net: usb: smsc95xx: Limit packet length to skb->len Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the network stack will leak kernel memory contents. Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") Signed-off-by: Szymon Heidrich Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20230316101954.75836-1-szymon.heidrich@gmail.com Signed-off-by: Jakub Kicinski commit 30796d0dcb6e41c6558a07950f2ce60c209da867 Author: Álvaro Fernández Rojas Date: Thu Mar 16 18:28:07 2023 +0100 net: dsa: b53: mmap: fix device tree support CPU port should also be enabled in order to get a working switch. Fixes: a5538a777b73 ("net: dsa: b53: mmap: Add device tree support") Signed-off-by: Álvaro Fernández Rojas Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20230316172807.460146-1-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 70e42feab2e20618ddd0cbfc4ab4b08628236ecd Author: Theodore Ts'o Date: Fri Mar 17 21:53:52 2023 -0400 ext4: fix possible double unlock when moving a directory Fixes: 0813299c586b ("ext4: Fix possible corruption when moving a directory") Link: https://lore.kernel.org/r/5efbe1b9-ad8b-4a4f-b422-24824d2b775c@kili.mountain Reported-by: Dan Carpenter Reported-by: syzbot+0c73d1d8b952c5f3d714@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o commit 1d3b7a788ca7435156809a6bd5b20c95b2370d45 Author: Max Filippov Date: Thu Mar 16 23:00:21 2023 -0700 xtensa: fix KASAN report for show_stack show_stack dumps raw stack contents which may trigger an unnecessary KASAN report. Fix it by copying stack contents to a temporary buffer with __memcpy and then printing that buffer instead of passing stack pointer directly to the print_hex_dump. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov commit fcdb1eda5302599045bb366e679cccb4216f3873 Author: Josh Don Date: Wed Mar 15 14:40:29 2023 -0700 cgroup: fix display of forceidle time at root We need to reset forceidle_sum to 0 when reading from root, since the bstat we accumulate into is stack allocated. To make this more robust, just replace the existing cputime reset with a memset of the overall bstat. Signed-off-by: Josh Don Fixes: 1fcf54deb767 ("sched/core: add forced idle accounting for cgroups") Cc: stable@vger.kernel.org # v6.0+ Signed-off-by: Tejun Heo commit 27c934dd8832dd40fd34776f916dc201e18b319b Author: Jeff Layton Date: Fri Mar 17 13:13:08 2023 -0400 nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn't cover the whole page. nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing fields -- the rq_respages and rq_next_page pointers themselves. If we've already added the page to the array in the last pass, don't add it to the array a second time when dealing with a splice continuation. This was originally handled properly in nfsd_splice_actor, but commit 91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check for it. Fixes: 91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") Cc: Al Viro Reported-by: Dario Lesca Tested-by: David Critch Link: https://bugzilla.redhat.com/show_bug.cgi?id=2150630 Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 478a351ce0d69cef2d2bf2a686a09b356b63a66c Merge: 8d3c682a5e3d9 f5e305e63b035 Author: Linus Torvalds Date: Fri Mar 17 13:31:16 2023 -0700 Merge tag 'net-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter, wifi and ipsec. A little more changes than usual, but it's pretty normal for us that the rc3/rc4 PRs are oversized as people start testing in earnest. Possibly an extra boost from people deploying the 6.1 LTS but that's more of an unscientific hunch. Current release - regressions: - phy: mscc: fix deadlock in phy_ethtool_{get,set}_wol() - virtio: vsock: don't use skbuff state to account credit - virtio: vsock: don't drop skbuff on copy failure - virtio_net: fix page_to_skb() miscalculating the memory size Current release - new code bugs: - eth: correct xdp_features after device reconfig - wifi: nl80211: fix the puncturing bitmap policy - net/mlx5e: flower: - fix raw counter initialization - fix missing error code - fix cloned flow attribute - ipa: - fix some register validity checks - fix a surprising number of bad offsets - kill FILT_ROUT_CACHE_CFG IPA register Previous releases - regressions: - tcp: fix bind() conflict check for dual-stack wildcard address - veth: fix use after free in XDP_REDIRECT when skb headroom is small - ipv4: fix incorrect table ID in IOCTL path - ipvlan: make skb->skb_iif track skb->dev for l3s mode - mptcp: - fix possible deadlock in subflow_error_report - fix UaFs when destroying unaccepted and listening sockets - dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 Previous releases - always broken: - tcp: tcp_make_synack() can be called from process context, don't assume preemption is disabled when updating stats - netfilter: correct length for loading protocol registers - virtio_net: add checking sq is full inside xdp xmit - bonding: restore IFF_MASTER/SLAVE flags on bond enslave Ethertype change - phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit number - eth: i40e: fix crash during reboot when adapter is in recovery mode - eth: ice: avoid deadlock on rtnl lock when auxiliary device plug/unplug meets bonding - dsa: mt7530: - remove now incorrect comment regarding port 5 - set PLL frequency and trgmii only when trgmii is used - eth: mtk_eth_soc: reset PCS state when changing interface types Misc: - ynl: another license adjustment - move the TCA_EXT_WARN_MSG attribute for tc action" * tag 'net-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) selftests: bonding: add tests for ether type changes bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change net: renesas: rswitch: Fix GWTSDIE register handling net: renesas: rswitch: Fix the output value of quote from rswitch_rx() ethernet: sun: add check for the mdesc_grab() net: ipa: fix some register validity checks net: ipa: kill FILT_ROUT_CACHE_CFG IPA register net: ipa: add two missing declarations net: ipa: reg: include net: xdp: don't call notifiers during driver init net/sched: act_api: add specific EXT_WARN_MSG for tc action Revert "net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy" net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795 ynl: make the tooling check the license ynl: broaden the license even more tools: ynl: make definitions optional again hsr: ratelimit only when errors are printed qed/qed_mng_tlv: correctly zero out ->min instead of ->hour selftests: net: devlink_port_split.py: skip test if no suitable device available ... commit 2f0e4f0342201fe2228fcc2301cc2b42ae04b8e3 Author: Shyam Prasad N Date: Thu Mar 16 10:45:12 2023 +0000 cifs: check only tcon status on tcon related functions We had a couple of checks for session in cifs_tree_connect and cifs_mark_open_files_invalid, which were unnecessary. And that was done with ses_lock. Changed that to tc_lock too. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 8d3c682a5e3d9dfc2448ecbb22f4cd48359b9e21 Merge: b7966a5a5cd00 8f0d196e4dc13 Author: Linus Torvalds Date: Fri Mar 17 11:20:27 2023 -0700 Merge tag 'block-6.3-2023-03-16' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A bit bigger than usual, as the NVMe pull request missed last weeks submission. In detail: - NVMe pull request via Christoph: - Avoid potential UAF in nvmet_req_complete (Damien Le Moal) - More quirks (Elmer Miroslav Mosher Golovin, Philipp Geulen) - Fix a memory leak in the nvme-pci probe teardown path (Irvin Cote) - Repair the MAINTAINERS entry (Lukas Bulwahn) - Fix handling single range discard request (Ming Lei) - Show more opcode names in trace events (Minwoo Im) - Fix nvme-tcp timeout reporting (Sagi Grimberg) - MD pull request via Song: - Two fixes for old issues (Neil) - Resource leak in device stopping (Xiao) - Bio based device stats fix (Yu) - Kill unused CONFIG_BLOCK_COMPAT (Lukas) - sunvdc missing mdesc_grab() failure check (Liang) - Fix for reversal of request ordering upon issue for certain cases (Jan) - null_blk timeout fixes (Damien) - Loop use-after-free fix (Bart) - blk-mq SRCU fix for BLK_MQ_F_BLOCKING devices (Chris)" * tag 'block-6.3-2023-03-16' of git://git.kernel.dk/linux: block: remove obsolete config BLOCK_COMPAT md: select BLOCK_LEGACY_AUTOLOAD block: count 'ios' and 'sectors' when io is done for bio-based device block: sunvdc: add check for mdesc_grab() returning NULL nvmet: avoid potential UAF in nvmet_req_complete() nvme-trace: show more opcode names nvme-tcp: add nvme-tcp pdu size build protection nvme-tcp: fix opcode reporting in the timeout handler nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 nvme-pci: fixing memory leak in probe teardown path nvme: fix handling single range discard request MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS block: null_blk: cleanup null_queue_rq() block: null_blk: Fix handling of fake timeout request blk-mq: fix "bad unlock balance detected" on q->srcu in __blk_mq_run_dispatch_ops loop: Fix use-after-free issues block: do not reverse request order when flushing plug list md: avoid signed overflow in slot_store() md: Free resources in __md_stop commit b7966a5a5cd009a682ccb0823e89f1e9fb719f27 Merge: 02ef7d39fd552 d2acf789088bb Author: Linus Torvalds Date: Fri Mar 17 11:12:07 2023 -0700 Merge tag 'io_uring-6.3-2023-03-16' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - When PF_NO_SETAFFINITY was removed for io-wq threads, we kind of forgot about the SQPOLL thread. Remove it there as well, there's even less of a reason to set it there (Michal) - Fixup a confusing 'ret' setting (Li) - When MSG_RING is used to send a direct descriptor to another ring, it's possible to have it allocate it on the target ring rather than provide a specific index for it. If this is done, return the chosen value in the CQE, like we would've done locally (Pavel) - Fix a regression in this series on huge page bvec collapsing (Pavel) * tag 'io_uring-6.3-2023-03-16' of git://git.kernel.dk/linux: io_uring/rsrc: fix folio accounting io_uring/msg_ring: let target know allocated index io_uring: rsrc: Optimize return value variable 'ret' io_uring/sqpoll: Do not set PF_NO_SETAFFINITY on sqpoll threads commit 02ef7d39fd552cf9e1de58a3003f77e743d1fb6b Merge: abb02a824555c 1fa9d47baa9e6 Author: Linus Torvalds Date: Fri Mar 17 11:02:26 2023 -0700 Merge tag 'pm-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an error code path issue in a cpuidle driver and make the sleepgraph utility more robust against unexpected input. Specifics: - Fix the psci_pd_init_topology() failure path in the PSCI cpuidle driver (Shawn Guo) - Modify the sleepgraph utility so it does not crash on binary data in device names (Todd Brandt)" * tag 'pm-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: pm-graph: sleepgraph: Avoid crashing on binary data in device names cpuidle: psci: Iterate backwards over list in psci_pd_remove() commit abb02a824555c160dccc316971cbb802b3ebf4f7 Merge: ba9c779190459 f36cc6cd65204 Author: Linus Torvalds Date: Fri Mar 17 10:57:09 2023 -0700 Merge tag 'acpi-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These add some new quirks, fix PPTT handling, fix an ACPI utility and correct a mistake in the ACPI documentation. Specifics: - Fix ACPI PPTT handling to avoid sleep in the atomic context when it is not present (Sudeep Holla) - Add 'backlight=native' DMI quirk for Dell Vostro 15 3535 to the ACPI video driver (Chia-Lin Kao) - Add ACPI quirks for I2C device enumeration on Lenovo Yoga Book X90 and Acer Iconia One 7 B1-750 (Hans de Goede) - Fix handling of invalid command line option values in the ACPI pfrut utility (Chen Yu) - Fix references to I2C device data type in the ACPI documentation for device enumeration (Andy Shevchenko)" * tag 'acpi-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750 ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 ACPI: docs: enumeration: Correct reference to the I²C device data type commit b771baf3988a094c5129b05f1e5eaa383f1ec185 Author: Yang Li Date: Tue Feb 14 09:03:44 2023 +0800 dmaengine: xilinx: xdma: Fix some kernel-doc comments Make the description of @xdma_chan to @xchan to silence the warnings: drivers/dma/xilinx/xdma.c:283: warning: Function parameter or member 'xchan' not described in 'xdma_xfer_start' drivers/dma/xilinx/xdma.c:283: warning: Excess function parameter 'xdma_chan' description in 'xdma_xfer_start' Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4051 Signed-off-by: Yang Li Acked-by: Peter Korsgaard Link: https://lore.kernel.org/r/20230214010344.5354-1-yang.lee@linux.alibaba.com Signed-off-by: Vinod Koul commit ba9c77919045943af677c03f04c778a1c16ae680 Merge: 0eb392ec095ee de7839ee02c65 Author: Linus Torvalds Date: Fri Mar 17 10:51:14 2023 -0700 Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat fweaks and fixes from Len Brown: "Leprechaun sized fixes and tweaks touching only turbostat. 'Keeping happy users happy since 2010'" * 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: version 2023.03.17 tools/power turbostat: fix decoding of HWP_STATUS tools/power turbostat: Introduce support for EMR tools/power turbostat: remove stray newlines from warn/warnx strings tools/power turbostat: Fix /dev/cpu_dma_latency warnings tools/power turbostat: Provide better debug messages for failed capabilities accesses tools/power turbostat: update dump of SECONDARY_TURBO_RATIO_LIMIT commit 0eb392ec095ee29b932985deefb43e6d86d8a463 Merge: cb80b960ce44e 7ad2c39860dc0 Author: Linus Torvalds Date: Fri Mar 17 10:45:49 2023 -0700 Merge tag 'for-linus-6.3-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - cleanup for xen time handling - enable the VGA console in a Xen PVH dom0 - cleanup in the xenfs driver * tag 'for-linus-6.3-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: remove unnecessary (void*) conversions x86/PVH: obtain VGA console info in Dom0 x86/xen/time: cleanup xen_tsc_safe_clocksource xen: update arch/x86/include/asm/xen/cpuid.h commit 91e78b2585348284ef7cdb6a8736fd21389914fe Author: Andy Shevchenko Date: Mon Feb 13 13:21:38 2023 +0200 dmaengine: Actually use devm_add_action_or_reset() It appears that the commit a1beaa50b583 ("dmaengine: Simplify dmaenginem_async_device_register() function") mentions devm_add_action_or_reset() the actual change utilised devm_add_action() call by mistake. Fix the issue by switching to devm_add_action_or_reset(). Fixes: a1beaa50b583 ("dmaengine: Simplify dmaenginem_async_device_register() function") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230213112138.32118-1-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul commit cb80b960ce44e3e4e90985bb65a84c1a10c450ee Merge: e50a80383e04a 47dd902aaee9b Author: Linus Torvalds Date: Fri Mar 17 10:33:33 2023 -0700 Merge tag 'riscv-for-linus-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - fixes to the ASID allocator to avoid leaking stale mappings between tasks - fix the vmalloc fault handler to tolerate huge pages * tag 'riscv-for-linus-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: mm: Support huge page in vmalloc_fault() riscv: asid: Fixup stale TLB entry cause application crash Revert "riscv: mm: notify remote harts about mmu cache updates" commit e50a80383e04a8e5a598a099979b52af7bfa7158 Merge: 17adaeaed05b8 d7a0bdbf17276 Author: Linus Torvalds Date: Fri Mar 17 10:15:53 2023 -0700 Merge tag 's390-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Update defconfigs - Fix early boot code by adding missing intersection check to prevent potential overwriting of the ipl report - Fix a use-after-free issue in s390-specific code related to PCI resources being retained after hot-unplugging individual functions, by removing the resources from the PCI bus's resource list and using the zpci_bar_struct's resource pointer directly * tag 's390-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: update defconfigs PCI: s390: Fix use-after-free of PCI resources with per-function hotplug s390/ipl: add missing intersection check to ipl_report handling commit 17adaeaed05b879964b1a72e4db87ebf3b2a38ba Merge: 2c50b0ca9082a f2c7e3562b4c4 Author: Linus Torvalds Date: Fri Mar 17 10:01:07 2023 -0700 Merge tag 'powerpc-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix false detection of read faults, introduced by execute-only support - Fix a build failure when GENERIC_ALLOCATOR is not selected Thanks to Russell Currey, Randy Dunlap, Michal Suchánek, Nathan Lynch, and Benjamin Gray. * tag 'powerpc-6.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm: Fix false detection of read faults powerpc/pseries: RTAS work area requires GENERIC_ALLOCATOR commit 2c50b0ca9082a2b92c8afdf6c2e1637d7d6185c8 Merge: 97eb2d981de3b 92771cdd90de6 Author: Linus Torvalds Date: Fri Mar 17 09:49:17 2023 -0700 Merge tag 'mmc-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - dw_mmc-starfive: Fix initialization of the prev_err variable - sdhci_am654: Lower power-on failed message severity * tag 'mmc-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: dw_mmc-starfive: Fix initialization of prev_err mmc: sdhci_am654: lower power-on failed message severity commit 97eb2d981de3b1173ab464e3253991425728b597 Merge: 2cf5a401c8717 98e5eb110095e Author: Linus Torvalds Date: Fri Mar 17 09:43:10 2023 -0700 Merge tag 'sound-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Nothing surprising, a collection of small device-specific fixes. The majority of changes are for ASoC Intel stuff, while a few other ASoC and HD-audio fixes are found" * tag 'sound-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (31 commits) ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() ALSA: asihpi: check pao in control_message() ASoC: hdmi-codec: only startup/shutdown on supported streams ASoC: da7219: Initialize jack_det_mutex ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform ALSA: hda: intel-dsp-config: add MTL PCI id ASoC: SOF: IPC4: update gain ipc msg definition to align with fw ASoC: SOF: sof-audio: don't squelch errors in WIDGET_SETUP phase ASoC: SOF: Intel: hda-ctrl: re-add sleep after entering and exiting reset ASoC: SOF: Intel: hda-dsp: harden D0i3 programming sequence ASoC: SOF: ipc4-topology: set dmic dai index from copier ASoC: SOF: sof-audio: Fix broken early bclk feature for SSP ASoC: SOF: Intel: pci-tng: revert invalid bar size setting ASoC: SOF: topology: Fix error handling in sof_widget_ready() ASoC: Intel: soc-acpi: fix copy-paste issue in topology names ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit ASoC: SOF: ipc3: Check for upper size limit for the received message ASOC: SOF: Intel: pci-tgl: Fix device description ... commit 2cf5a401c87178237c5b782c44578c26690a802b Merge: 7622976c8f4f2 c00133a9e87ea Author: Linus Torvalds Date: Fri Mar 17 09:35:40 2023 -0700 Merge tag 'drm-fixes-2023-03-17' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Seems like a pretty regular rc3, i915 and amdgpu with the usual selection of fixes, then a scattering of fixes across misc drivers and other areas: accel: - build fix for accel edid: - fix info leak in edid ttm: - fix NULL ptr deref - reference counting fix i915: - Fix hwmon PL1 power limit enabling - Fix audio ELD handling for DP MST - Fix PSR io and wake line calculations - Fix DG2 HDMI modes with 267.30 and 319.89 MHz pixel clocks - Fix SSEU subslice out-of-bounds access - Fix misuse of non-idle barriers as fence trackers amdgpu: - SMU 13 update - RDNA2 suspend/resume fix when overclocking is enabled - SRIOV VCN fixes - HDCP suspend/resume fix - Fix drm polling splat regression - Fix dirty rectangle tracking for PSR - Fix vangogh regression on certain BIOSes - Misc display fixes - Suspend/resume IOMMU regression fix amdkfd: - Fix BO offset for multi-VMA page migration - Fix a possible double free - Fix potential use after free - Fix process cleanup on module exit bridge: - fix returned array size name documentation fbdev: - ref-counting fix for fbdev deferred I/O virtio: - dma sync fix shmem-helper: - error path fix msm: - shrinker blocking fix panfrost: - shrinker rpm fix chipsfb: - fix error code meson: - fix 1px pink line - fix regulator interaction sun4i: - fix missing component unbind" * tag 'drm-fixes-2023-03-17' of git://anongit.freedesktop.org/drm/drm: (38 commits) drm/ttm: drop extra ttm_bo_put in ttm_bo_cleanup_refs drm/amdgpu: Don't resume IOMMU after incomplete init drm/amdkfd: Fixed kfd_process cleanup on module exit. drm/amd/display: disconnect MPCC only on OTG change drm/amd/display: Fix DP MST sinks removal issue drm/amd/display: Do not set DRR on pipe Commit drm/amd/display: Remove OTG DIV register write for Virtual signals. drm/meson: dw-hdmi: Fix devm_regulator_*get_enable*() conversion again drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc drm/amdgpu/vcn: Disable indirect SRAM on Vangogh broken BIOSes drm/amdgpu/nv: fix codec array for SR_IOV drm/amd/display: Write to correct dirty_rect drm/amdgpu: move poll enabled/disable into non DC path drm/amd/display: Fix HDCP failing to enable after suspend drm/amdkfd: fix potential kgd_mem UAFs drm/amdgpu/vcn: custom video info caps for sriov drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume drm/amd/pm: bump SMU 13.0.4 driver_if header version drm/amdkfd: fix a potential double free in pqm_create_queue drm/amdkfd: Get prange->offset after svm_range_vram_node_new ... commit 7622976c8f4f233fac251263e08adee27969abcd Merge: 38e04b3e4240a c6001025d53ab Author: Linus Torvalds Date: Fri Mar 17 09:30:57 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Ten patches, eight in drivers and two in the core, which correct a regression from directory removal and add a no VPD size quirk also to fix a regression. All pretty small" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: mcq: Use active_reqs to check busy in clock scaling scsi: core: Fix a procfs host directory removal regression scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() scsi: mpi3mr: Fix config page DMA memory leak scsi: mpi3mr: Fix throttle_groups memory leak scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() commit d2e53ceaf284eada83af176ccb45f13bfb3f4d83 Merge: 38557b2d6d213 d617808e3b832 Author: Arnd Bergmann Date: Fri Mar 17 17:10:30 2023 +0100 Merge tag 'scmi-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/fixes Arm SCMI fixes for v6.3 Few fixes addressing issues around validation of device tree SCMI node, allowing raw SCMI access even on systems which fail to probe the normal driver stack, duplicate header inclusion, clean up return statement using literal values instead of variable to simplify and use of devm_bitmap_zalloc instead of devm_kcalloc to improve semantic. * tag 'scmi-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Use the bitmap API to allocate bitmaps firmware: arm_scmi: Fix device node validation for mailbox transport firmware: arm_scmi: Fix raw coexistence mode behaviour on failure path firmware: arm_scmi: Remove duplicate include header inclusion firmware: arm_scmi: Return a literal instead of a variable firmware: arm_scmi: Clean up a return statement in scmi_probe Link: https://lore.kernel.org/r/20230315193557.1709241-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 1fa9d47baa9e61ff973e03f0ef26f5b78d545e37 Merge: 6fa7f537351c8 6b0313c2fa3d2 Author: Rafael J. Wysocki Date: Fri Mar 17 16:55:01 2023 +0100 Merge branch 'pm-cpuidle' Merge a PSCI cpuidle driver fix for 6.3-rc1: - Fix the psci_pd_init_topology() failure path in the PSCI cpuidle driver (Shawn Guo). * pm-cpuidle: cpuidle: psci: Iterate backwards over list in psci_pd_remove() commit f36cc6cd65204352815640a34e37ef39e56fbd42 Merge: 91d7b60a65d9f 89b0411481967 1a1e7540cf501 0bc23d8b2237a c29b97725c91a Author: Rafael J. Wysocki Date: Fri Mar 17 16:44:41 2023 +0100 Merge branches 'acpi-video', 'acpi-x86', 'acpi-tools' and 'acpi-docs' Merge a new ACPI backlight quirk, new ACPI quirks for I2C device enumeration on some platforms, a pfrut utility fix and an ACPI documentation fix for 6.3-rc3: - Add backlight=native DMI quirk for Dell Vostro 15 3535 to the ACPI video driver (Chia-Lin Kao). - Add ACPI quirks for I2C devices enumeration on Lenovo Yoga Book X90 and Acer Iconia One 7 B1-750 (Hans de Goede). - Fix handling of invalid command line option values in the ACPI pfrut utility (Chen Yu). - Fix references to I2C device data type in the ACPI documentation for device enumeration (Andy Shevchenko). * acpi-video: ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 * acpi-x86: ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750 ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper * acpi-tools: ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range * acpi-docs: ACPI: docs: enumeration: Correct reference to the I²C device data type commit de7839ee02c651335db6bf0af24cf5cac3cc4c72 Author: Len Brown Date: Fri Mar 17 11:34:10 2023 -0400 tools/power turbostat: version 2023.03.17 Happy St. Patrick's Day! Signed-off-by: Len Brown commit 92c25393586ac799b9b7d9e50434f3c44a7622c4 Author: Antti Laakso Date: Wed Jan 25 15:17:50 2023 +0200 tools/power turbostat: fix decoding of HWP_STATUS The "excursion to minimum" information is in bit2 in HWP_STATUS MSR. Fix the bitmask used for decoding the register. Signed-off-by: Antti Laakso Reviewed-by: Artem Bityutskiy Signed-off-by: Len Brown commit 93cac4150727dae0ee89f501dd75413b88eedec0 Author: Zhang Rui Date: Wed Jan 4 22:23:53 2023 +0800 tools/power turbostat: Introduce support for EMR Introduce support for EMR. Signed-off-by: Zhang Rui Reviewed-by: Artem Bityutskiy Tested-by: Artem Bityutskiy Signed-off-by: Len Brown commit 6cbfedc7afc93a7f06d4a2f7c4d4732b20adfc2b Author: Len Brown Date: Fri Mar 17 11:25:56 2023 -0400 tools/power turbostat: remove stray newlines from warn/warnx strings warn(3) terminates strings with newlines Signed-off-by: Len Brown commit 40aafc7d58d3544f152a863a0e9863014b6d5d8c Author: Prarit Bhargava Date: Thu Dec 15 10:18:16 2022 -0500 tools/power turbostat: Fix /dev/cpu_dma_latency warnings When running as non-root the following error is seen in turbostat: turbostat: fopen /dev/cpu_dma_latency : Permission denied turbostat and the man page have information on how to avoid other permission errors, so these can be fixed the same way. Provide better /dev/cpu_dma_latency warnings that provide instructions on how to avoid the error, and update the man page. Signed-off-by: Prarit Bhargava Cc: linux-pm@vger.kernel.org Signed-off-by: Len Brown commit 9c08581728ccadc6b9e4135b7b8d31948e814f6f Author: Prarit Bhargava Date: Tue Oct 18 15:23:37 2022 -0400 tools/power turbostat: Provide better debug messages for failed capabilities accesses turbostat reports some capabilities access errors and not others. Provide the same debug message for all errors. [lenb: remove extra quotes] Cc: David Arcari Signed-off-by: Prarit Bhargava Signed-off-by: Len Brown commit 884a1f956179b561e7e7f1d29fc331cf53233c89 Author: Len Brown Date: Thu Oct 13 12:42:29 2022 +0200 tools/power turbostat: update dump of SECONDARY_TURBO_RATIO_LIMIT cosmetic only (but useful if you copy/paste) Signed-off-by: Len Brown commit 38557b2d6d2133902bf071c78a6fe8d8f8c5aebb Merge: e5bd1002443dd b3cdf730486b0 Author: Arnd Bergmann Date: Fri Mar 17 15:37:11 2023 +0100 Merge tag 'imx-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc-fixes i.MX fixes for 6.3: - A couple of i.MX93 fixes from Alexander Stein to correct EQoS Ethernet properties. - Correct clock-names of FlexSPI device in imx8-ss-lsio DT. - Fix EQoS PHY reset GPIO by dropping the deprecated/wrong property and switch to the new bindings. - Fix an issue with imx-weim bus driver that branch condition evaluates to a garbage value. - Correct WM8960 clock name for imx8mm-nitrogen-r2 board. - Fix LCDIF2 clocks for i.MX8MP DT. - Add missing #sound-dai-cells properties to SAI nodes for i.MX8MN DT. - Revert LS1028A DT changes of getting MAC addresses from VPD, as the dependency on NVMEM device is not in place. - A series from Peng Fan to add missing pinctrl property for i.MX6SL based devices. * tag 'imx-fixes-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes bus: imx-weim: fix branch condition evaluates to a garbage value arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl arm64: dts: imx93: Fix eqos properties arm64: dts: imx8mp: Fix LCDIF2 node clock order arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio Revert "arm64: dts: ls1028a: sl28: get MAC addresses from VPD" arm64: dts: freescale: imx8-ss-lsio: Fix flexspi clock order Link: https://lore.kernel.org/r/20230315132814.GF143566@dragon Signed-off-by: Arnd Bergmann commit e5bd1002443dd9af31b799da97a71b53d1865486 Merge: 98dba5886b88d 4bb54c2ce48ff Author: Arnd Bergmann Date: Fri Mar 17 15:30:50 2023 +0100 Merge tag 'tegra-for-6.3-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc-fixes arm64: tegra: Device tree fixes for v6.3-rc1 This contains a fix for the CBB bus' ranges property on Tegra194 and Tegra234 that restores proper translation of PCI addresses. * tag 'tegra-for-6.3-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Bump CBB ranges property on Tegra194 and Tegra234 Link: https://lore.kernel.org/r/20230302094213.3874449-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 98dba5886b88d6d1f15cbe63e411409660dd568c Merge: fe15c26ee26ef f8502fba45bd3 Author: Arnd Bergmann Date: Fri Mar 17 15:30:24 2023 +0100 Merge tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee into soc-fixes AMDTEE fix race condition in amdtee_open_session() * tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: fix race condition in amdtee_open_session Link: https://lore.kernel.org/r/Y/5ZGX0lSTnZz27E@rayden Signed-off-by: Arnd Bergmann commit 205efd4619b860404ebb5882e5a119eb3b3b3716 Author: Ge-org Brohammer Date: Fri Mar 17 00:38:51 2023 +0200 ASoC: amd: yc: Add DMI entries to support Victus by HP Laptop 16-e1xxx (8A22) This model requires an additional detection quirk to enable the internal microphone. Tried to use git send-email this time. Signed-off-by: Ge-org Brohammer Link: https://lore.kernel.org/r/PAVP195MB2261322C220E95D7F4B2732ADABC9@PAVP195MB2261.EURP195.PROD.OUTLOOK.COM Signed-off-by: Mark Brown commit f8acb24aaf89fc46cd953229462ea8abe31b395f Author: Michael Kelley Date: Wed Mar 15 08:34:13 2023 -0700 x86/hyperv: Block root partition functionality in a Confidential VM Hyper-V should never specify a VM that is a Confidential VM and also running in the root partition. Nonetheless, explicitly block such a combination to guard against a compromised Hyper-V maliciously trying to exploit root partition functionality in a Confidential VM to expose Confidential VM secrets. No known bug is being fixed, but the attack surface for Confidential VMs on Hyper-V is reduced. Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1678894453-95392-1-git-send-email-mikelley@microsoft.com Signed-off-by: Wei Liu commit 8a0432bab6ea3203d220785da7ab3c7677f70ecb Author: Hans de Goede Date: Fri Mar 17 03:13:12 2023 -0700 Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table The Android Lenovo Yoga Book X90F / X90L uses the same goodix touchscreen with 9 bytes touch reports for its touch keyboard as the already supported Windows Lenovo Yoga Book X91F/L, add a DMI match for this to the nine_bytes_report DMI table. When the quirk for the X91F/L was initially added it was written to also apply to the X90F/L but this does not work because the Android version of the Yoga Book uses completely different DMI strings. Also adjust the X91F/L quirk to reflect that it only applies to the X91F/L models. Signed-off-by: Hans de Goede Reviewed-by: Bastien Nocera Link: https://lore.kernel.org/r/20230315134442.71787-1-hdegoede@redhat.com Signed-off-by: Dmitry Torokhov commit f5bad62f9107b701a6def7cac1f5f65862219b83 Author: Jonathan Denose Date: Fri Mar 17 03:19:51 2023 -0700 Input: i8042 - add quirk for Fujitsu Lifebook A574/H Fujitsu Lifebook A574/H requires the nomux option to properly probe the touchpad, especially when waking from sleep. Signed-off-by: Jonathan Denose Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20230303152623.45859-1-jdenose@google.com Signed-off-by: Dmitry Torokhov commit 984cfd55e0c99e80b2e5b1dc6b2bf98608af7ff9 Author: Dongliang Mu Date: Wed Mar 8 16:32:31 2023 +0800 net: ieee802154: remove an unnecessary null pointer check llsec_parse_seclevel has the null pointer check at its begining. Compared with nl802154_add_llsec_seclevel, nl802154_del_llsec_seclevel has a redundant null pointer check of info->attrs[NL802154_ATTR_SEC_LEVEL] before llsec_parse_seclevel. Fix this issue by removing the null pointer check in nl802154_del_llsec_seclevel. Signed-off-by: Dongliang Mu Link: https://lore.kernel.org/r/20230308083231.460015-1-dzm91@hust.edu.cn Signed-off-by: Stefan Schmidt commit 6eff38048944cadc3cddcf117acfa5199ec32490 Author: Rajnesh Kanwal Date: Fri Feb 10 14:27:11 2023 +0000 riscv/kvm: Fix VM hang in case of timer delta being zero. In case when VCPU is blocked due to WFI, we schedule the timer from `kvm_riscv_vcpu_timer_blocking()` to keep timer interrupt ticking. But in case when delta_ns comes to be zero, we never schedule the timer and VCPU keeps sleeping indefinitely until any activity is done with VM console. This is easily reproduce-able using kvmtool. ./lkvm-static run -c1 --console virtio -p "earlycon root=/dev/vda" \ -k ./Image -d rootfs.ext4 Also, just add a print in kvm_riscv_vcpu_vstimer_expired() to check the interrupt delivery and run `top` or similar auto-upating cmd from guest. Within sometime one can notice that print from timer expiry routine stops and the `top` cmd output will stop updating. This change fixes this by making sure we schedule the timer even with delta_ns being zero to bring the VCPU out of sleep immediately. Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension") Signed-off-by: Rajnesh Kanwal Reviewed-by: Atish Patra Signed-off-by: Anup Patel commit f5e305e63b035a1782a666a6535765f80bb2dca3 Merge: 53515a052adb4 222c94ec0ad48 Author: David S. Miller Date: Fri Mar 17 07:56:41 2023 +0000 Merge branch 'bonding-fixes' Nikolay Aleksandrov says: ==================== bonding: properly restore flags when bond changes ether type A bug was reported by syzbot[1] that causes a warning and a myriad of other potential issues if a bond, that is also a slave, fails to enslave a non-eth device. While fixing that bug I found that we have the same issues when such enslave passes and after that the bond changes back to ARPHRD_ETHER (again due to ether_setup). This set fixes all issues by extracting the ether_setup() sequence in a helper which does the right thing about bond flags when it needs to change back to ARPHRD_ETHER. It also adds selftests for these cases. Patch 01 adds the new bond_ether_setup helper and fixes the issues when a bond device changes its ether type due to successful enslave. Patch 02 fixes the issues when it changes its ether type due to an unsuccessful enslave. Note we need two patches because the bugs were introduced by different commits. Patch 03 adds the new selftests. Due to the comment adjustment and squash, could you please review patch 01 again? I've kept the other acks since there were no code changes. v3: squash the helper patch and the first fix, adjust the comment above it to be explicit about the bond device, no code changes v2: new set, all patches are new due to new approach of fixing these bugs [1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef ==================== Signed-off-by: David S. Miller commit 222c94ec0ad48b951f0f692a7cf5bcf7a6bcb6b1 Author: Nikolay Aleksandrov Date: Wed Mar 15 13:18:42 2023 +0200 selftests: bonding: add tests for ether type changes Add new network selftests for the bonding device which exercise the ether type changing call paths. They also test for the recent syzbot bug[1] which causes a warning and results in wrong device flags (IFF_SLAVE missing). The test adds three bond devices and a nlmon device, enslaves one of the bond devices to the other and then uses the nlmon device for successful and unsuccesful enslaves both of which change the bond ether type. Thus we can test for both MASTER and SLAVE flags at the same time. If the flags are properly restored we get: TEST: Change ether type of an enslaved bond device with unsuccessful enslave [ OK ] TEST: Change ether type of an enslaved bond device with successful enslave [ OK ] [1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef Signed-off-by: Nikolay Aleksandrov Reviewed-by: Michal Kubiak Acked-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: David S. Miller commit e667d469098671261d558be0cd93dca4d285ce1e Author: Nikolay Aleksandrov Date: Wed Mar 15 13:18:41 2023 +0200 bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails syzbot reported a warning[1] where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the error path when ether_setup() restores the bond device it also clears all flags. In my previous fix[2] I restored the IFF_MASTER flag, but I didn't consider the case that the bond device itself might also be a slave with IFF_SLAVE set, so we need to restore that flag as well. Use the bond_ether_setup helper which does the right thing and restores the bond's flags properly. Steps to reproduce using a nlmon dev: $ ip l add nlmon0 type nlmon $ ip l add bond1 type bond $ ip l add bond2 type bond $ ip l set bond1 master bond2 $ ip l set dev nlmon0 master bond1 $ ip -d l sh dev bond1 22: bond1: mtu 1500 qdisc noqueue master bond2 state DOWN mode DEFAULT group default qlen 1000 (now bond1's IFF_SLAVE flag is gone and we'll hit a warning[3] if we try to delete it) [1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef [2] commit 7d5cd2ce5292 ("bonding: correctly handle bonding type change on enslave failure") [3] example warning: [ 27.008664] bond1: (slave nlmon0): The slave device specified does not support setting the MAC address [ 27.008692] bond1: (slave nlmon0): Error -95 calling set_mac_address [ 32.464639] bond1 (unregistering): Released all slaves [ 32.464685] ------------[ cut here ]------------ [ 32.464686] WARNING: CPU: 1 PID: 2004 at net/core/dev.c:10829 unregister_netdevice_many+0x72a/0x780 [ 32.464694] Modules linked in: br_netfilter bridge bonding virtio_net [ 32.464699] CPU: 1 PID: 2004 Comm: ip Kdump: loaded Not tainted 5.18.0-rc3+ #47 [ 32.464703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 [ 32.464704] RIP: 0010:unregister_netdevice_many+0x72a/0x780 [ 32.464707] Code: 99 fd ff ff ba 90 1a 00 00 48 c7 c6 f4 02 66 96 48 c7 c7 20 4d 35 96 c6 05 fa c7 2b 02 01 e8 be 6f 4a 00 0f 0b e9 73 fd ff ff <0f> 0b e9 5f fd ff ff 80 3d e3 c7 2b 02 00 0f 85 3b fd ff ff ba 59 [ 32.464710] RSP: 0018:ffffa006422d7820 EFLAGS: 00010206 [ 32.464712] RAX: ffff8f6e077140a0 RBX: ffffa006422d7888 RCX: 0000000000000000 [ 32.464714] RDX: ffff8f6e12edbe58 RSI: 0000000000000296 RDI: ffffffff96d4a520 [ 32.464716] RBP: ffff8f6e07714000 R08: ffffffff96d63600 R09: ffffa006422d7728 [ 32.464717] R10: 0000000000000ec0 R11: ffffffff9698c988 R12: ffff8f6e12edb140 [ 32.464719] R13: dead000000000122 R14: dead000000000100 R15: ffff8f6e12edb140 [ 32.464723] FS: 00007f297c2f1740(0000) GS:ffff8f6e5d900000(0000) knlGS:0000000000000000 [ 32.464725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.464726] CR2: 00007f297bf1c800 CR3: 00000000115e8000 CR4: 0000000000350ee0 [ 32.464730] Call Trace: [ 32.464763] [ 32.464767] rtnl_dellink+0x13e/0x380 [ 32.464776] ? cred_has_capability.isra.0+0x68/0x100 [ 32.464780] ? __rtnl_unlock+0x33/0x60 [ 32.464783] ? bpf_lsm_capset+0x10/0x10 [ 32.464786] ? security_capable+0x36/0x50 [ 32.464790] rtnetlink_rcv_msg+0x14e/0x3b0 [ 32.464792] ? _copy_to_iter+0xb1/0x790 [ 32.464796] ? post_alloc_hook+0xa0/0x160 [ 32.464799] ? rtnl_calcit.isra.0+0x110/0x110 [ 32.464802] netlink_rcv_skb+0x50/0xf0 [ 32.464806] netlink_unicast+0x216/0x340 [ 32.464809] netlink_sendmsg+0x23f/0x480 [ 32.464812] sock_sendmsg+0x5e/0x60 [ 32.464815] ____sys_sendmsg+0x22c/0x270 [ 32.464818] ? import_iovec+0x17/0x20 [ 32.464821] ? sendmsg_copy_msghdr+0x59/0x90 [ 32.464823] ? do_set_pte+0xa0/0xe0 [ 32.464828] ___sys_sendmsg+0x81/0xc0 [ 32.464832] ? mod_objcg_state+0xc6/0x300 [ 32.464835] ? refill_obj_stock+0xa9/0x160 [ 32.464838] ? memcg_slab_free_hook+0x1a5/0x1f0 [ 32.464842] __sys_sendmsg+0x49/0x80 [ 32.464847] do_syscall_64+0x3b/0x90 [ 32.464851] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 32.464865] RIP: 0033:0x7f297bf2e5e7 [ 32.464868] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 32.464869] RSP: 002b:00007ffd96c824c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 32.464872] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f297bf2e5e7 [ 32.464874] RDX: 0000000000000000 RSI: 00007ffd96c82540 RDI: 0000000000000003 [ 32.464875] RBP: 00000000640f19de R08: 0000000000000001 R09: 000000000000007c [ 32.464876] R10: 00007f297bffabe0 R11: 0000000000000246 R12: 0000000000000001 [ 32.464877] R13: 00007ffd96c82d20 R14: 00007ffd96c82610 R15: 000055bfe38a7020 [ 32.464881] [ 32.464882] ---[ end trace 0000000000000000 ]--- Fixes: 7d5cd2ce5292 ("bonding: correctly handle bonding type change on enslave failure") Reported-by: syzbot+9dfc3f3348729cc82277@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef Signed-off-by: Nikolay Aleksandrov Reviewed-by: Michal Kubiak Acked-by: Jonathan Toppins Acked-by: Jay Vosburgh Signed-off-by: David S. Miller commit 9ec7eb60dcbcb6c41076defbc5df7bbd95ceaba5 Author: Nikolay Aleksandrov Date: Wed Mar 15 13:18:40 2023 +0200 bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change Add bond_ether_setup helper which is used to fix ether_setup() calls in the bonding driver. It takes care of both IFF_MASTER and IFF_SLAVE flags, the former is always restored and the latter only if it was set. If the bond enslaves non-ARPHRD_ETHER device (changes its type), then releases it and enslaves ARPHRD_ETHER device (changes back) then we use ether_setup() to restore the bond device type but it also resets its flags and removes IFF_MASTER and IFF_SLAVE[1]. Use the bond_ether_setup helper to restore both after such transition. [1] reproduce (nlmon is non-ARPHRD_ETHER): $ ip l add nlmon0 type nlmon $ ip l add bond2 type bond mode active-backup $ ip l set nlmon0 master bond2 $ ip l set nlmon0 nomaster $ ip l add bond1 type bond (we use bond1 as ARPHRD_ETHER device to restore bond2's mode) $ ip l set bond1 master bond2 $ ip l sh dev bond2 37: bond2: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether be:d7:c5:40:5b:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 1500 (notice bond2's IFF_MASTER is missing) Fixes: e36b9d16c6a6 ("bonding: clean muticast addresses when device changes type") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller commit 53515a052adb469f47330dab3eabf701f8a7d3d9 Merge: 90de546d9a0b3 2c59e993c86ad Author: David S. Miller Date: Fri Mar 17 07:50:51 2023 +0000 Merge branch 'net-renesas-rswitch-fixes' Yoshihiro Shimoda says: ==================== net: renesas: rswitch: Fix rx and timestamp I got reports locally about issues on the rswitch driver. So, fix the issues. ==================== Signed-off-by: David S. Miller commit 2c59e993c86ad57afde26eaf1beb35694da5fbfe Author: Yoshihiro Shimoda Date: Wed Mar 15 16:04:24 2023 +0900 net: renesas: rswitch: Fix GWTSDIE register handling Since the GWCA has the TX timestamp feature, this driver should not disable it if one of ports is opened. So, fix it. Reported-by: Phong Hoang Fixes: 33f5d733b589 ("net: renesas: rswitch: Improve TX timestamp accuracy") Signed-off-by: Yoshihiro Shimoda Signed-off-by: David S. Miller commit e05bb97d9c9dd4ba5739a27921044c935a7fb3be Author: Yoshihiro Shimoda Date: Wed Mar 15 16:04:23 2023 +0900 net: renesas: rswitch: Fix the output value of quote from rswitch_rx() If the RX descriptor doesn't have any data, the output value of quote from rswitch_rx() will be increased unexpectedily. So, fix it. Reported-by: Volodymyr Babchuk Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"") Signed-off-by: Yoshihiro Shimoda Signed-off-by: David S. Miller commit 90de546d9a0b3c771667af18bb3f80567eabb89b Author: Liang He Date: Wed Mar 15 14:00:21 2023 +0800 ethernet: sun: add check for the mdesc_grab() In vnet_port_probe() and vsw_port_probe(), we should check the return value of mdesc_grab() as it may return NULL which can caused NPD bugs. Fixes: 5d01fa0c6bd8 ("ldmvsw: Add ldmvsw.c driver code") Fixes: 43fdf27470b2 ("[SPARC64]: Abstract out mdesc accesses for better MD update handling.") Signed-off-by: Liang He Reviewed-by: Piotr Raczynski Signed-off-by: David S. Miller commit c00133a9e87ea5324d0b883d801eb6656f26739b Author: Christian König Date: Thu Mar 16 08:26:47 2023 +0100 drm/ttm: drop extra ttm_bo_put in ttm_bo_cleanup_refs That was accidentially left over when we switched to the delayed delete worker. Suggested-by: Matthew Auld Signed-off-by: Christian König Fixes: 9bff18d13473 ("drm/ttm: use per BO cleanup workers") Reported-by: Steven Rostedt (Google) Tested-by: Steven Rostedt (Google) Reviewed-by: Matthew Auld Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230316072647.406707-1-christian.koenig@amd.com commit c31a72dbbfe1162ee81c446cc8b5a5c561a4c0df Merge: 2a210e6a15dc5 f3921a9a64148 Author: Dave Airlie Date: Fri Mar 17 15:42:21 2023 +1000 Merge tag 'amd-drm-fixes-6.3-2023-03-15' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.3-2023-03-15: amdgpu: - SMU 13 update - RDNA2 suspend/resume fix when overclocking is enabled - SRIOV VCN fixes - HDCP suspend/resume fix - Fix drm polling splat regression - Fix dirty rectangle tracking for PSR - Fix vangogh regression on certain BIOSes - Misc display fixes - Suspend/resume IOMMU regression fix amdkfd: - Fix BO offset for multi-VMA page migration - Fix a possible double free - Fix potential use after free - Fix process cleanup on module exit Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230315224400.7558-1-alexander.deucher@amd.com commit 0c98b8bc48cf91bf8bdad123d6c07195341b0a81 Merge: 769639c1fe8a9 21e8aaca401ce Author: Jakub Kicinski Date: Thu Mar 16 21:33:20 2023 -0700 Merge branch 'net-ipa-minor-bug-fixes' Alex Elder says: ==================== net: ipa: minor bug fixes The four patches in this series fix some errors, though none of them cause any compile or runtime problems. The first changes the files included by "drivers/net/ipa/reg.h" to ensure everything it requires is included with the file. It also stops unnecessarily including another file. The prerequisites are apparently satisfied other ways, currently. The second adds two struct declarations to "gsi_reg.h", to ensure they're declared before they're used later in the file. Again, it seems these declarations are currently resolved wherever this file is included. The third removes register definitions that were added for IPA v5.0 that are not needed. And the last updates some validity checks for IPA v5.0 registers. No IPA v5.0 platforms are yet supported, so the issues resolved here were never harmful. Versions 2 and 3 of this series change the "Fixes" tags in patches so they supply legitimate commit hashes. ==================== Link: https://lore.kernel.org/r/20230316145136.1795469-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit 21e8aaca401ce2b45ece1d8fabd29d422de7b48e Author: Alex Elder Date: Thu Mar 16 09:51:36 2023 -0500 net: ipa: fix some register validity checks A recent commit defined HW_PARAM_4 as a GSI register ID but did not add it to gsi_reg_id_valid() to indicate it's valid (for IPA v5.0+). Add version checks for the HW_PARAM_2 and INTER_EE IRQ GSI registers there as well. IPA v5.0 supports up to 8 source and destination resource groups. Update the validity check (and the comments where the register IDs are defined) to reflect that. Similarly update comments and validity checks for the hash/cache-related registers. Note that this patch fixes an omission and constrains things further, but these don't technically represent bugs. Fixes: f651334e1ef5 ("net: ipa: add HW_PARAM_4 GSI register") Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 786bbe50e1d5777f0b6ec7b4c2de6189d6f7feb4 Author: Alex Elder Date: Thu Mar 16 09:51:35 2023 -0500 net: ipa: kill FILT_ROUT_CACHE_CFG IPA register A recent commit defined a few IPA registers used for IPA v5.0+. One of those was a mistake. Although the filter and router caches get *flushed* using a single register, they use distinct registers (ENDP_FILTER_CACHE_CFG and ENDP_ROUTER_CACHE_CFG) for configuration. And although there *exists* a FILT_ROUT_CACHE_CFG register, it is not needed in upstream code. So get rid of definitions related to FILT_ROUT_CACHE_CFG, because they are not needed. Fixes: 8ba59716d16a ("net: ipa: define IPA v5.0+ registers") Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 55c49e5c94411a82a0ba06dc615ed12b6387dec5 Author: Alex Elder Date: Thu Mar 16 09:51:34 2023 -0500 net: ipa: add two missing declarations When gsi_reg_init() got added, its declaration was added to "gsi_reg.h" without declaring the two struct pointer types it uses. Add these struct declarations to "gsi_reg.h". Fixes: 3c506add35c7 ("net: ipa: introduce gsi_reg_init()") Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit dd172d0c2cea3c14ca9d007eeab51bec7676ece7 Author: Alex Elder Date: Thu Mar 16 09:51:33 2023 -0500 net: ipa: reg: include When "reg.h" got created, it included calls to WARN() and WARN_ON(). Those macros are defined via . In addition, it uses is_power_of_2(), which is defined in . Include those files so IPA "reg.h" has access to all definitions it requires. Meanwhile, is included but nothing defined therein is required directly in "reg.h", so get rid of that. Fixes: 81772e444dbe ("net: ipa: start generalizing "ipa_reg"") Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 769639c1fe8a98129aa97c8ee981639db1e8955c Author: Jakub Kicinski Date: Thu Mar 16 15:02:34 2023 -0700 net: xdp: don't call notifiers during driver init Drivers will commonly perform feature setting during init, if they use the xdp_set_features_flag() helper they'll likely run into an ASSERT_RTNL() inside call_netdevice_notifiers_info(). Don't call the notifier until the device is actually registered. Nothing should be tracking the device until its registered and after its unregistration has started. Fixes: 4d5ab0ad964d ("net/mlx5e: take into account device reconfiguration for xdp_features flag") Link: https://lore.kernel.org/r/20230316220234.598091-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 85578fe4933f55fed2145e3cd2909a8e2e55c108 Merge: 5ae06327a3a5b 2f59823fe696c Author: Jakub Kicinski Date: Thu Mar 16 21:26:03 2023 -0700 Merge branch 'net-sched-fix-parsing-of-tca_ext_warn_msg-for-tc-action' Hangbin Liu says: ==================== net/sched: fix parsing of TCA_EXT_WARN_MSG for tc action In my previous commit 0349b8779cc9 ("sched: add new attr TCA_EXT_WARN_MSG to report tc extact message") I didn't notice the tc action use different enum with filter. So we can't use TCA_EXT_WARN_MSG directly for tc action. Let's rever the previous fix 923b2e30dc9c ("net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy") and add a new TCA_ROOT_EXT_WARN_MSG for tc action specifically. Here is the tdc test result: 1..1119 ok 1 d959 - Add cBPF action with valid bytecode ok 2 f84a - Add cBPF action with invalid bytecode ok 3 e939 - Add eBPF action with valid object-file ok 4 282d - Add eBPF action with invalid object-file ok 5 d819 - Replace cBPF bytecode and action control ok 6 6ae3 - Delete cBPF action ok 7 3e0d - List cBPF actions ok 8 55ce - Flush BPF actions ok 9 ccc3 - Add cBPF action with duplicate index ok 10 89c7 - Add cBPF action with invalid index [...] ok 1115 2348 - Show TBF class ok 1116 84a0 - Create TEQL with default setting ok 1117 7734 - Create TEQL with multiple device ok 1118 34a9 - Delete TEQL with valid handle ok 1119 6289 - Show TEQL stats ==================== Link: https://lore.kernel.org/r/20230316033753.2320557-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 2f59823fe696caa844249a90bb3f9aeda69cfe5c Author: Hangbin Liu Date: Thu Mar 16 11:37:53 2023 +0800 net/sched: act_api: add specific EXT_WARN_MSG for tc action In my previous commit 0349b8779cc9 ("sched: add new attr TCA_EXT_WARN_MSG to report tc extact message") I didn't notice the tc action use different enum with filter. So we can't use TCA_EXT_WARN_MSG directly for tc action. Let's add a TCA_ROOT_EXT_WARN_MSG for tc action specifically and put this param before going to the TCA_ACT_TAB nest. Fixes: 0349b8779cc9 ("sched: add new attr TCA_EXT_WARN_MSG to report tc extact message") Signed-off-by: Hangbin Liu Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit 8de2bd02439eb839a452a853c1004c2c45ff6fef Author: Hangbin Liu Date: Thu Mar 16 11:37:52 2023 +0800 Revert "net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy" This reverts commit 923b2e30dc9cd05931da0f64e2e23d040865c035. This is not a correct fix as TCA_EXT_WARN_MSG is not a hierarchy to TCA_ACT_TAB. I didn't notice the TC actions use different enum when adding TCA_EXT_WARN_MSG. To fix the difference I will add a new WARN enum in TCA_ROOT_MAX as Jamal suggested. Signed-off-by: Hangbin Liu Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit 5ae06327a3a5bad4ee246d81df203b1b00a7b390 Author: Marek Vasut Date: Thu Mar 16 01:19:16 2023 +0200 net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795 The blamed commit has replaced a ksz_write8() call to address REG_PORT_5_CTRL_6 (0x56) with a ksz_set_xmii() -> ksz_pwrite8() call to regs[P_XMII_CTRL_1], which is also defined as 0x56 for ksz8795_regs[]. The trouble is that, when compared to ksz_write8(), ksz_pwrite8() also adjusts the register offset with the port base address. So in reality, ksz_pwrite8(offset=0x56) accesses register 0x56 + 0x50 = 0xa6, which in this switch appears to be unmapped, and the RGMII delay configuration on the CPU port does nothing. So if the switch wasn't fine with the RGMII delay configuration done through pin strapping and relied on Linux to apply a different one in order to pass traffic, this is now broken. Using the offset translation logic imposed by ksz_pwrite8(), the correct value for regs[P_XMII_CTRL_1] should have been 0x6 on ksz8795_regs[], in order to really end up accessing register 0x56. Static code analysis shows that, despite there being multiple other accesses to regs[P_XMII_CTRL_1] in this driver, the only code path that is applicable to ksz8795_regs[] and ksz8_dev_ops is ksz_set_xmii(). Therefore, the problem is isolated to RGMII delays. In its current form, ksz8795_regs[] contains the same value for P_XMII_CTRL_0 and for P_XMII_CTRL_1, and this raises valid suspicions that writes made by the driver to regs[P_XMII_CTRL_0] might overwrite writes made to regs[P_XMII_CTRL_1] or vice versa. Again, static analysis shows that the only accesses to P_XMII_CTRL_0 from the driver are made from code paths which are not reachable with ksz8_dev_ops. So the accesses made by ksz_set_xmii() are safe for this switch family. [ vladimiroltean: rewrote commit message ] Fixes: c476bede4b0f ("net: dsa: microchip: ksz8795: use common xmii function") Signed-off-by: Marek Vasut Signed-off-by: Vladimir Oltean Acked-by: Arun Ramadoss Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230315231916.2998480-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 816b1e8c521ce7dd17ba8083e475f9c9efc6d7b0 Merge: 0d2be75ce7dca cfab77c0b5458 Author: Jakub Kicinski Date: Thu Mar 16 21:20:33 2023 -0700 Merge branch 'ynl-another-license-adjustment' Jakub Kicinski says: ==================== ynl: another license adjustment Hopefully the last adjustment to the licensing of the specs. I'm still the author so should be fine to do this. ==================== Link: https://lore.kernel.org/r/20230315230351.478320-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit cfab77c0b54583816faac5f9abdf588c13895a9d Author: Jakub Kicinski Date: Wed Mar 15 16:03:51 2023 -0700 ynl: make the tooling check the license The (only recently documented) expectation is that all specs are under a certain license, but we don't actually enforce it. What's worse we then go ahead and assume the license was right, outputting the expected license into generated files. Fixes: 37d9df224d1e ("ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause") Reviewed-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 4e16b6a748df52800c90f3ab181aef8129bd332f Author: Jakub Kicinski Date: Wed Mar 15 16:03:50 2023 -0700 ynl: broaden the license even more I relicensed Netlink spec code to GPL-2.0 OR BSD-3-Clause but we still put a slightly different license on the uAPI header than the rest of the code. Use the Linux-syscall-note on all the specs and all generated code. It's moot for kernel code, but should not hurt. This way the licenses match everywhere. Cc: Chuck Lever Fixes: 37d9df224d1e ("ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause") Reviewed-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 054abb515f346b8f30a0a11953d9f786d3e76813 Author: Jakub Kicinski Date: Wed Mar 15 16:03:49 2023 -0700 tools: ynl: make definitions optional again definitions are optional, commit in question breaks cli for ethtool. Fixes: 6517a60b0307 ("tools: ynl: move the enum classes to shared code") Reviewed-by: Chuck Lever Signed-off-by: Jakub Kicinski commit 0d2be75ce7dcaf3e1f2da0d522140e1031c5239f Merge: 1b0120e4db0bf c7b7c64ab5821 Author: Jakub Kicinski Date: Thu Mar 16 21:13:05 2023 -0700 Merge tag 'mlx5-fixes-2023-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-03-15 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: TC, Remove error message log print net/mlx5e: TC, fix cloned flow attribute net/mlx5e: TC, fix missing error code net/sched: TC, fix raw counter initialization net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites net/mlx5: Set BREAK_FW_WAIT flag first when removing driver net/mlx5e: kTLS, Fix missing error unwind on unsupported cipher type net/mlx5e: Fix cleanup null-ptr deref on encap lock net/mlx5: E-switch, Fix missing set of split_count when forward to ovs internal port net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules net/mlx5: Disable eswitch before waiting for VF pages net/mlx5: Fix setting ec_function bit in MANAGE_PAGES net/mlx5e: Don't cache tunnel offloads capability net/mlx5e: Fix macsec ASO context alignment ==================== Link: https://lore.kernel.org/r/20230315225847.360083-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 1b0120e4db0bf2838d1ce741195ce4b7cc100b91 Author: Matthieu Baerts Date: Wed Mar 15 21:25:17 2023 +0100 hsr: ratelimit only when errors are printed Recently, when automatically merging -net and net-next in MPTCP devel tree, our CI reported [1] a conflict in hsr, the same as the one reported by Stephen in netdev [2]. When looking at the conflict, I noticed it is in fact the v1 [3] that has been applied in -net and the v2 [4] in net-next. Maybe the v1 was applied by accident. As mentioned by Jakub Kicinski [5], the new condition makes more sense before the net_ratelimit(), not to update net_ratelimit's state which is unnecessary if we're not going to print either way. Here, this modification applies the v2 but in -net. Link: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/4423171069 [1] Link: https://lore.kernel.org/netdev/20230315100914.53fc1760@canb.auug.org.au/ [2] Link: https://lore.kernel.org/netdev/20230307133229.127442-1-koverskeid@gmail.com/ [3] Link: https://lore.kernel.org/netdev/20230309092302.179586-1-koverskeid@gmail.com/ [4] Link: https://lore.kernel.org/netdev/20230308232001.2fb62013@kernel.org/ [5] Fixes: 28e8cabe80f3 ("net: hsr: Don't log netdev_err message on unknown prp dst node") Signed-off-by: Matthieu Baerts Reviewed-by: Steen Hegelund Link: https://lore.kernel.org/r/20230315-net-20230315-hsr_framereg-ratelimit-v1-1-61d2ef176d11@tessares.net Signed-off-by: Jakub Kicinski commit 470efd68a4653d9819d391489886432cd31bcd0b Author: Daniil Tatianin Date: Wed Mar 15 22:46:18 2023 +0300 qed/qed_mng_tlv: correctly zero out ->min instead of ->hour This fixes an issue where ->hour would erroneously get zeroed out instead of ->min because of a bad copy paste. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: f240b6882211 ("qed: Add support for processing fcoe tlv request.") Signed-off-by: Daniil Tatianin Link: https://lore.kernel.org/r/20230315194618.579286-1-d-tatianin@yandex-team.ru Signed-off-by: Jakub Kicinski commit a13faca032acbf2699293587085293bdfaafc8ae Author: Yu Kuai Date: Wed Mar 15 14:21:54 2023 +0800 scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced object 0xffff88810b2c6980 (size 32): comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$............. backtrace: [<0000000098f3a26d>] alua_activate+0xb0/0x320 [<000000003b529641>] scsi_dh_activate+0xb2/0x140 [<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath] [<000000007adc9ace>] process_one_work+0x3c5/0x730 [<00000000c457a985>] worker_thread+0x93/0x650 [<00000000cb80e628>] kthread+0x1ba/0x210 [<00000000a1e61077>] ret_from_fork+0x22/0x30 Fix the problem by freeing 'qdata' in error path. Fixes: 625fe857e4fa ("scsi: scsi_dh_alua: Check scsi_device_get() return value") Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20230315062154.668812-1-yukuai1@huaweicloud.com Reviewed-by: Benjamin Block Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d3affdeb400f3adc925bd996f3839481f5291839 Author: Quinn Tran Date: Sun Mar 12 21:37:11 2023 -0700 scsi: qla2xxx: Synchronize the IOCB count to be in order A system hang was observed with the following call trace: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 PID: 86747 Comm: nvme Kdump: loaded Not tainted 6.2.0+ #1 Hardware name: Dell Inc. PowerEdge R6515/04F3CJ, BIOS 2.7.3 03/31/2022 RIP: 0010:__wake_up_common+0x55/0x190 Code: 41 f6 01 04 0f 85 b2 00 00 00 48 8b 43 08 4c 8d 40 e8 48 8d 43 08 48 89 04 24 48 89 c6\ 49 8d 40 18 48 39 c6 0f 84 e9 00 00 00 <49> 8b 40 18 89 6c 24 14 31 ed 4c 8d 60 e8 41 8b 18 f6 c3 04 75 5d RSP: 0018:ffffb05a82afbba0 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffff8f9b83a00018 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff8f9b83a00020 RDI: ffff8f9b83a00018 RBP: 0000000000000001 R08: ffffffffffffffe8 R09: ffffb05a82afbbf8 R10: 70735f7472617473 R11: 5f30307832616c71 R12: 0000000000000001 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f815cf4c740(0000) GS:ffff8f9eeed80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010633a000 CR4: 0000000000350ee0 Call Trace: __wake_up_common_lock+0x83/0xd0 qla_nvme_ls_req+0x21b/0x2b0 [qla2xxx] __nvme_fc_send_ls_req+0x1b5/0x350 [nvme_fc] nvme_fc_xmt_disconnect_assoc+0xca/0x110 [nvme_fc] nvme_fc_delete_association+0x1bf/0x220 [nvme_fc] ? nvme_remove_namespaces+0x9f/0x140 [nvme_core] nvme_do_delete_ctrl+0x5b/0xa0 [nvme_core] nvme_sysfs_delete+0x5f/0x70 [nvme_core] kernfs_fop_write_iter+0x12b/0x1c0 vfs_write+0x2a3/0x3b0 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_loop+0xd0/0x130 ? exit_to_user_mode_prepare+0xec/0x100 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f815cd3eb97 The IOCB counts are out of order and that would block any commands from going out and subsequently hang the system. Synchronize the IOCB count to be in correct order. Fixes: 5f63a163ed2f ("scsi: qla2xxx: Fix exchange oversubscription for management commands") Cc: stable@vger.kernel.org Signed-off-by: Quinn Tran Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20230313043711.13500-3-njavali@marvell.com Reviewed-by: Himanshu Madhani Reviewed-by: John Meneghini Tested-by: Lin Li Signed-off-by: Martin K. Petersen commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 Author: Nilesh Javali Date: Sun Mar 12 21:37:10 2023 -0700 scsi: qla2xxx: Perform lockless command completion in abort path While adding and removing the controller, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50 CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1 RIP: 0010:dma_free_attrs+0x33/0x50 Call Trace: qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] qla2x00_abort_srb+0x8e/0x250 [qla2xxx] ? ql_dbg+0x70/0x100 [qla2xxx] __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx] qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx] qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx] qla2x00_remove_one+0x364/0x400 [qla2xxx] pci_device_remove+0x36/0xa0 __device_release_driver+0x17a/0x230 device_release_driver+0x24/0x30 pci_stop_bus_device+0x68/0x90 pci_stop_and_remove_bus_device_locked+0x16/0x30 remove_store+0x75/0x90 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 ? do_user_addr_fault+0x1d8/0x680 ? do_syscall_64+0x69/0x80 ? exc_page_fault+0x62/0x140 ? asm_exc_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xae The command was completed in the abort path during driver unload with a lock held, causing the warning in abort path. Hence complete the command without any lock held. Reported-by: Lin Li Tested-by: Lin Li Cc: stable@vger.kernel.org Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20230313043711.13500-2-njavali@marvell.com Reviewed-by: Himanshu Madhani Reviewed-by: John Meneghini Signed-off-by: Martin K. Petersen commit a204b490595de71016b2360a1886ec8c12d0afac Author: Joel Selvaraj Date: Sun Mar 12 23:14:02 2023 -0500 scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR Xiaomi Poco F1 (qcom/sdm845-xiaomi-beryllium*.dts) comes with a SKhynix H28U74301AMR UFS. The sd_read_cpr() operation leads to a 120 second timeout, making the device bootup very slow: [ 121.457736] sd 0:0:0:1: [sdb] tag#23 timing out command, waited 120s Setting the BLIST_SKIP_VPD_PAGES allows the device to skip the failing sd_read_cpr operation and boot normally. Signed-off-by: Joel Selvaraj Link: https://lore.kernel.org/r/20230313041402.39330-1-joelselvaraj.oss@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Martin K. Petersen commit 2a210e6a15dc5c50b18e6d80aa5a58689586ecf7 Merge: bcd9d56f89b3a e0e6b416b25ee Author: Dave Airlie Date: Fri Mar 17 12:03:57 2023 +1000 Merge tag 'drm-intel-fixes-2023-03-15' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v6.3-rc3: - Fix hwmon PL1 power limit enabling - Fix audio ELD handling for DP MST - Fix PSR io and wake line calculations - Fix DG2 HDMI modes with 267.30 and 319.89 MHz pixel clocks - Fix SSEU subslice out-of-bounds access - Fix misuse of non-idle barriers as fence trackers Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87r0tq5nyn.fsf@intel.com commit bcd9d56f89b3aa878731d634c1782d1530fab511 Merge: eeac8ede17557 4028cbf867f70 Author: Dave Airlie Date: Fri Mar 17 11:01:20 2023 +1000 Merge tag 'drm-misc-fixes-2023-03-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Short summary of fixes pull: * fix info leak in edid * build fix for accel/ * ref-counting fix for fbdev deferred I/O * driver fixes Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230316143347.GA9246@linux-uq9g commit 24994513ad13ff2c47ba91d2b5df82c3d496c370 Author: Po-Hsu Lin Date: Thu Mar 16 00:53:53 2023 +0800 selftests: net: devlink_port_split.py: skip test if no suitable device available The `devlink -j port show` command output may not contain the "flavour" key, an example from Ubuntu 22.10 s390x LPAR(5.19.0-37-generic), with mlx4 driver and iproute2-5.15.0: {"port":{"pci/0001:00:00.0/1":{"type":"eth","netdev":"ens301"}, "pci/0001:00:00.0/2":{"type":"eth","netdev":"ens301d1"}, "pci/0002:00:00.0/1":{"type":"eth","netdev":"ens317"}, "pci/0002:00:00.0/2":{"type":"eth","netdev":"ens317d1"}}} This will cause a KeyError exception. Create a validate_devlink_output() to check for this "flavour" from devlink command output to avoid this KeyError exception. Also let it handle the check for `devlink -j dev show` output in main(). Apart from this, if the test was not started because the max lanes of the designated device is 0. The script will still return 0 and thus causing a false-negative test result. Use a found_max_lanes flag to determine if these tests were skipped due to this reason and return KSFT_SKIP to make it more clear. Link: https://bugs.launchpad.net/bugs/1937133 Fixes: f3348a82e727 ("selftests: net: Add port split test") Signed-off-by: Po-Hsu Lin Link: https://lore.kernel.org/r/20230315165353.229590-1-po-hsu.lin@canonical.com Signed-off-by: Jakub Kicinski commit f38373345c65529639a01fba3675eb8cb4c579c3 Author: Thomas Bogendoerfer Date: Wed Mar 15 14:41:17 2023 +0100 i825xx: sni_82596: use eth_hw_addr_set() netdev->dev_addr is now const, we can't write to it directly. Copy scrambled mac address octects into an array then eth_hw_addr_set(). Fixes: adeef3e32146 ("net: constify netdev->dev_addr") Signed-off-by: Thomas Bogendoerfer Reviewed-by: Michal Kubiak Link: https://lore.kernel.org/r/20230315134117.79511-1-tsbogend@alpha.franken.de Signed-off-by: Jakub Kicinski commit 3d87debb8ed2649608ff432699e7c961c0c6f03b Author: Alexandra Winter Date: Wed Mar 15 14:14:35 2023 +0100 net/iucv: Fix size of interrupt data iucv_irq_data needs to be 4 bytes larger. These bytes are not used by the iucv module, but written by the z/VM hypervisor in case a CPU is deconfigured. Reported as: BUG dma-kmalloc-64 (Not tainted): kmalloc Redzone overwritten ----------------------------------------------------------------------------- 0x0000000000400564-0x0000000000400567 @offset=1380. First byte 0x80 instead of 0xcc Allocated in iucv_cpu_prepare+0x44/0xd0 age=167839 cpu=2 pid=1 __kmem_cache_alloc_node+0x166/0x450 kmalloc_node_trace+0x3a/0x70 iucv_cpu_prepare+0x44/0xd0 cpuhp_invoke_callback+0x156/0x2f0 cpuhp_issue_call+0xf0/0x298 __cpuhp_setup_state_cpuslocked+0x136/0x338 __cpuhp_setup_state+0xf4/0x288 iucv_init+0xf4/0x280 do_one_initcall+0x78/0x390 do_initcalls+0x11a/0x140 kernel_init_freeable+0x25e/0x2a0 kernel_init+0x2e/0x170 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 Freed in iucv_init+0x92/0x280 age=167839 cpu=2 pid=1 __kmem_cache_free+0x308/0x358 iucv_init+0x92/0x280 do_one_initcall+0x78/0x390 do_initcalls+0x11a/0x140 kernel_init_freeable+0x25e/0x2a0 kernel_init+0x2e/0x170 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 Slab 0x0000037200010000 objects=32 used=30 fp=0x0000000000400640 flags=0x1ffff00000010200(slab|head|node=0|zone=0| Object 0x0000000000400540 @offset=1344 fp=0x0000000000000000 Redzone 0000000000400500: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400510: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400520: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400530: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Object 0000000000400540: 00 01 00 03 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object 0000000000400550: f3 86 81 f2 f4 82 f8 82 f0 f0 f0 f0 f0 f0 f0 f2 ................ Object 0000000000400560: 00 00 00 00 80 00 00 00 cc cc cc cc cc cc cc cc ................ Object 0000000000400570: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400580: cc cc cc cc cc cc cc cc ........ Padding 00000000004005d4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Padding 00000000004005e4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Padding 00000000004005f4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ CPU: 6 PID: 121030 Comm: 116-pai-crypto. Not tainted 6.3.0-20230221.rc0.git4.99b8246b2d71.300.fc37.s390x+debug #1 Hardware name: IBM 3931 A01 704 (z/VM 7.3.0) Call Trace: [<000000032aa034ec>] dump_stack_lvl+0xac/0x100 [<0000000329f5a6cc>] check_bytes_and_report+0x104/0x140 [<0000000329f5aa78>] check_object+0x370/0x3c0 [<0000000329f5ede6>] free_debug_processing+0x15e/0x348 [<0000000329f5f06a>] free_to_partial_list+0x9a/0x2f0 [<0000000329f5f4a4>] __slab_free+0x1e4/0x3a8 [<0000000329f61768>] __kmem_cache_free+0x308/0x358 [<000000032a91465c>] iucv_cpu_dead+0x6c/0x88 [<0000000329c2fc66>] cpuhp_invoke_callback+0x156/0x2f0 [<000000032aa062da>] _cpu_down.constprop.0+0x22a/0x5e0 [<0000000329c3243e>] cpu_device_down+0x4e/0x78 [<000000032a61dee0>] device_offline+0xc8/0x118 [<000000032a61e048>] online_store+0x60/0xe0 [<000000032a08b6b0>] kernfs_fop_write_iter+0x150/0x1e8 [<0000000329fab65c>] vfs_write+0x174/0x360 [<0000000329fab9fc>] ksys_write+0x74/0x100 [<000000032aa03a5a>] __do_syscall+0x1da/0x208 [<000000032aa177b2>] system_call+0x82/0xb0 INFO: lockdep is turned off. FIX dma-kmalloc-64: Restoring kmalloc Redzone 0x0000000000400564-0x0000000000400567=0xcc FIX dma-kmalloc-64: Object at 0x0000000000400540 not freed Fixes: 2356f4cb1911 ("[S390]: Rewrite of the IUCV base code, part 2") Signed-off-by: Alexandra Winter Link: https://lore.kernel.org/r/20230315131435.4113889-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 37d010399f7552add2b68e2b347901c83562dab8 Author: Toke Høiland-Jørgensen Date: Wed Mar 15 13:55:38 2023 +0100 net: atlantic: Fix crash when XDP is enabled but no program is loaded The aq_xdp_run_prog() function falls back to the XDP_ABORTED action handler (using a goto) if the operations for any of the other actions fail. The XDP_ABORTED handler in turn calls the bpf_warn_invalid_xdp_action() tracepoint. However, the function also jumps into the XDP_PASS helper if no XDP program is loaded on the device, which means the XDP_ABORTED handler can be run with a NULL program pointer. This results in a NULL pointer deref because the tracepoint dereferences the 'prog' pointer passed to it. This situation can happen in multiple ways: - If a packet arrives between the removal of the program from the interface and the static_branch_dec() in aq_xdp_setup() - If there are multiple devices using the same driver in the system and one of them has an XDP program loaded and the other does not. Fix this by refactoring the aq_xdp_run_prog() function to remove the 'goto pass' handling if there is no XDP program loaded. Instead, factor out the skb building in a separate small helper function. Fixes: 26efaef759a1 ("net: atlantic: Implement xdp data plane") Reported-by: Freysteinn Alfredsson Tested-by: Freysteinn Alfredsson Signed-off-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20230315125539.103319-1-toke@redhat.com Signed-off-by: Jakub Kicinski commit 43ffe6caccc7a1bb9d7442fbab521efbf6c1378c Author: Szymon Heidrich Date: Thu Mar 16 12:05:40 2023 +0100 net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull Packet length check needs to be located after size and align_count calculation to prevent kernel panic in skb_pull() in case rx_cmd_a & RX_CMD_A_RED evaluates to true. Fixes: d8b228318935 ("net: usb: smsc75xx: Limit packet length to skb->len") Signed-off-by: Szymon Heidrich Link: https://lore.kernel.org/r/20230316110540.77531-1-szymon.heidrich@gmail.com Signed-off-by: Jakub Kicinski commit 8a2618e14f81604a9b6ad305d57e0c8da939cd65 Author: Ido Schimmel Date: Wed Mar 15 14:40:09 2023 +0200 ipv4: Fix incorrect table ID in IOCTL path Commit f96a3d74554d ("ipv4: Fix incorrect route flushing when source address is deleted") started to take the table ID field in the FIB info structure into account when determining if two structures are identical or not. This field is initialized using the 'fc_table' field in the route configuration structure, which is not set when adding a route via IOCTL. The above can result in user space being able to install two identical routes that only differ in the table ID field of their associated FIB info. Fix by initializing the table ID field in the route configuration structure in the IOCTL path. Before the fix: # ip route add default via 192.0.2.2 # route add default gw 192.0.2.2 # ip -4 r show default # default via 192.0.2.2 dev dummy10 # default via 192.0.2.2 dev dummy10 After the fix: # ip route add default via 192.0.2.2 # route add default gw 192.0.2.2 SIOCADDRT: File exists # ip -4 r show default default via 192.0.2.2 dev dummy10 Audited the code paths to ensure there are no other paths that do not properly initialize the route configuration structure when installing a route. Fixes: 5a56a0b3a45d ("net: Don't delete routes in different VRFs") Fixes: f96a3d74554d ("ipv4: Fix incorrect route flushing when source address is deleted") Reported-by: gaoxingwang Link: https://lore.kernel.org/netdev/20230314144159.2354729-1-gaoxingwang1@huawei.com/ Tested-by: gaoxingwang Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230315124009.4015212-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 84770d124908ba5f5e38b4f732ac48fd8ff6c0c5 Merge: c782c7f11856a c276a706ea1f5 Author: Jakub Kicinski Date: Thu Mar 16 17:23:48 2023 -0700 Merge tag 'ipsec-2023-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2023-03-15 1) Fix an information leak when dumping algos and encap. From Herbert Xu 2) Allow transport-mode states with AF_UNSPEC selector to allow for nested transport-mode states. From Herbert Xu. * tag 'ipsec-2023-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: Allow transport-mode states with AF_UNSPEC selector xfrm: Zero padding when dumping algos and encap ==================== Link: https://lore.kernel.org/r/20230315105623.1396491-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit c782c7f11856a799afdc18c7200c009224f89e65 Merge: 04504793feec0 c6be7136afb22 Author: Jakub Kicinski Date: Thu Mar 16 17:14:02 2023 -0700 Merge branch 'net-renesas-set-mac_managed_pm-at-probe-time' Wolfram Sang says: ==================== net: renesas: set 'mac_managed_pm' at probe time When suspending/resuming an interface which was not up, we saw mdiobus related PM handling despite 'mac_managed_pm' being set for RAVB/SH_ETH. Heiner kindly suggested the fix to set this flag at probe time, not at init/open time. I implemented his suggestion and it works fine on these two Renesas drivers. ==================== Link: https://lore.kernel.org/r/20230315074115.3008-1-wsa+renesas@sang-engineering.com Signed-off-by: Jakub Kicinski commit c6be7136afb224a01d4cde2983ddebac8da98693 Author: Wolfram Sang Date: Wed Mar 15 08:41:15 2023 +0100 sh_eth: avoid PHY being resumed when interface is not up SH_ETH doesn't need mdiobus suspend/resume, that's why it sets 'mac_managed_pm'. However, setting it needs to be moved from init to probe, so mdiobus PM functions will really never be called (e.g. when the interface is not up yet during suspend/resume). Fixes: 6a1dbfefdae4 ("net: sh_eth: Fix PHY state warning splat during system resume") Suggested-by: Heiner Kallweit Signed-off-by: Wolfram Sang Reviewed-by: Michal Kubiak Reviewed-by: Sergey Shtylyov Signed-off-by: Jakub Kicinski commit 7f5ebf5dae42e710162f1c481ebcf28ab7b741c7 Author: Wolfram Sang Date: Wed Mar 15 08:41:14 2023 +0100 ravb: avoid PHY being resumed when interface is not up RAVB doesn't need mdiobus suspend/resume, that's why it sets 'mac_managed_pm'. However, setting it needs to be moved from init to probe, so mdiobus PM functions will really never be called (e.g. when the interface is not up yet during suspend/resume). Fixes: 4924c0cdce75 ("net: ravb: Fix PHY state warning splat during system resume") Suggested-by: Heiner Kallweit Signed-off-by: Wolfram Sang Reviewed-by: Michal Kubiak Reviewed-by: Sergey Shtylyov Reviewed-by: Florian Fainelli Signed-off-by: Jakub Kicinski commit 8c2e8ac8ad4be68409e806ce1cc78fc7a04539f3 Author: Marc Zyngier Date: Thu Mar 16 17:45:46 2023 +0000 KVM: arm64: Check for kvm_vma_mte_allowed in the critical section On page fault, we find about the VMA that backs the page fault early on, and quickly release the mmap_read_lock. However, using the VMA pointer after the critical section is pretty dangerous, as a teardown may happen in the meantime and the VMA be long gone. Move the sampling of the MTE permission early, and NULL-ify the VMA pointer after that, just to be on the safe side. Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230316174546.3777507-3-maz@kernel.org Signed-off-by: Oliver Upton commit e86fc1a3a3e9b4850fe74d738e3cfcf4297d8bba Author: Marc Zyngier Date: Thu Mar 16 17:45:45 2023 +0000 KVM: arm64: Disable interrupts while walking userspace PTs We walk the userspace PTs to discover what mapping size was used there. However, this can race against the userspace tables being freed, and we end-up in the weeds. Thankfully, the mm code is being generous and will IPI us when doing so. So let's implement our part of the bargain and disable interrupts around the walk. This ensures that nothing terrible happens during that time. We still need to handle the removal of the page tables before the walk. For that, allow get_user_mapping_size() to return an error, and make sure this error can be propagated all the way to the the exit handler. Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230316174546.3777507-2-maz@kernel.org Signed-off-by: Oliver Upton commit 47d43086531f10539470a63e8ad92803e686a3dd Author: Chunyan Zhang Date: Thu Mar 16 10:36:24 2023 +0800 clk: sprd: set max_register according to mapping range In sprd clock driver, regmap_config.max_register was set to a fixed value which is likely larger than the address range configured in device tree, when reading registers through debugfs it would cause access violation. Fixes: d41f59fd92f2 ("clk: sprd: Add common infrastructure") Signed-off-by: Chunyan Zhang Link: https://lore.kernel.org/r/20230316023624.758204-1-chunyan.zhang@unisoc.com Signed-off-by: Stephen Boyd commit 38e04b3e4240a6d8fb43129ebad41608db64bc6f Merge: 0ddc84d2dd43e 6284e46bdd477 Author: Linus Torvalds Date: Thu Mar 16 15:06:16 2023 -0700 Merge tag '6.3-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client fixes from Steve French: "Seven cifs/smb3 client fixes, all also for stable: - four DFS fixes - multichannel reconnect fix - fix smb1 stats for cancel command - fix for set file size error path" * tag '6.3-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: use DFS root session instead of tcon ses cifs: return DFS root session id in DebugData cifs: fix use-after-free bug in refresh_cache_worker() cifs: set DFS root session in cifs_get_smb_ses() cifs: generate signkey for the channel that's reconnecting cifs: Fix smb2_set_path_size() cifs: Move the in_send statistic to __smb_send_rqst() commit 92fbb6d1296f81f41f65effd7f5f8c0f74943d15 Author: Wei Chen Date: Tue Mar 14 16:54:21 2023 +0000 i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() The data->block[0] variable comes from user and is a number between 0-255. Without proper check, the variable may be very large to cause an out-of-bounds when performing memcpy in slimpro_i2c_blkwr. Fix this bug by checking the value of writelen. Fixes: f6505fbabc42 ("i2c: add SLIMpro I2C device driver on APM X-Gene platform") Signed-off-by: Wei Chen Cc: stable@vger.kernel.org Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit d98263512684a47e81bcb72a5408958ecd1e60b0 Author: Yicong Yang Date: Mon Mar 13 15:45:52 2023 +0800 i2c: hisi: Only use the completion interrupt to finish the transfer The controller will always generate a completion interrupt when the transfer is finished normally or not. Currently we use either error or completion interrupt to finish, this may result the completion interrupt unhandled and corrupt the next transfer, especially at low speed mode. Since on error case, the error interrupt will come first then is the completion interrupt. So only use the completion interrupt to finish the whole transfer process. Fixes: d62fbdb99a85 ("i2c: add support for HiSilicon I2C controller") Reported-by: Sheng Feng Signed-off-by: Sheng Feng Signed-off-by: Yicong Yang Signed-off-by: Wolfram Sang commit cc9812a3096d1986caca9a23bee99effc45c08df Author: Yicong Yang Date: Mon Mar 13 15:45:51 2023 +0800 i2c: hisi: Avoid redundant interrupts After issuing all the messages we can disable the TX_EMPTY interrupts to avoid handling redundant interrupts. For doing a sinlge bus detection (i2cdetect -y -r 0) we can reduce ~97% interrupts (before ~12000 after ~400). Signed-off-by: Sheng Feng Signed-off-by: Yicong Yang Signed-off-by: Wolfram Sang commit 5190417bdf72c71b65bd9892103c6186816a6e8b Author: Matthias Schiffer Date: Mon Feb 13 16:25:50 2023 +0100 i2c: mxs: ensure that DMA buffers are safe for DMA We found that after commit 9c46929e7989 ("ARM: implement THREAD_INFO_IN_TASK for uniprocessor systems"), the PCF85063 RTC driver stopped working on i.MX28 due to regmap_bulk_read() reading bogus data into a stack buffer. This is caused by the i2c-mxs driver using DMA transfers even for messages without the I2C_M_DMA_SAFE flag, and the aforementioned commit enabling vmapped stacks. As the MXS I2C controller requires DMA for reads of >4 bytes, DMA can't be disabled, so the issue is fixed by using i2c_get_dma_safe_msg_buf() to create a bounce buffer when needed. Fixes: 9c46929e7989 ("ARM: implement THREAD_INFO_IN_TASK for uniprocessor systems") Signed-off-by: Matthias Schiffer Signed-off-by: Wolfram Sang commit 1c7885004567e8951d65a983be095f254dd20bef Author: Alexander Stein Date: Mon Jan 30 16:32:47 2023 +0100 i2c: imx-lpi2c: check only for enabled interrupt flags When reading from I2C, the Tx watermark is set to 0. Unfortunately the TDF (transmit data flag) is enabled when Tx FIFO entries is equal or less than watermark. So it is set in every case, hence the reset default of 1. This results in the MSR_RDF _and_ MSR_TDF flags to be set thus trying to send Tx data on a read message. Mask the IRQ status to filter for wanted flags only. Fixes: a55fa9d0e42e ("i2c: imx-lpi2c: add low power i2c bus driver") Signed-off-by: Alexander Stein Tested-by: Emanuele Ghidoli Signed-off-by: Wolfram Sang commit 987dd36c0141f6ab9f0fbf14d6b2ec3342dedb2f Author: Alexander Stein Date: Mon Jan 30 16:32:46 2023 +0100 i2c: imx-lpi2c: clean rx/tx buffers upon new message When start sending a new message clear the Rx & Tx buffer pointers in order to avoid using stale pointers. Signed-off-by: Alexander Stein Tested-by: Emanuele Ghidoli Signed-off-by: Wolfram Sang commit 0ddc84d2dd43e2c2c3f634baa05ea10abd31197e Merge: 9c1bec9c0b08a f3e707413dbe3 Author: Linus Torvalds Date: Thu Mar 16 11:32:12 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM64: - Address a rather annoying bug w.r.t. guest timer offsetting. The synchronization of timer offsets between vCPUs was broken, leading to inconsistent timer reads within the VM. x86: - New tests for the slow path of the EVTCHNOP_send Xen hypercall - Add missing nVMX consistency checks for CR0 and CR4 - Fix bug that broke AMD GATag on 512 vCPU machines Selftests: - Skip hugetlb tests if huge pages are not available - Sync KVM exit reasons" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: selftests: Sync KVM exit reasons in selftests KVM: selftests: Add macro to generate KVM exit reason strings KVM: selftests: Print expected and actual exit reason in KVM exit reason assert KVM: selftests: Make vCPU exit reason test assertion common KVM: selftests: Add EVTCHNOP_send slow path test to xen_shinfo_test KVM: selftests: Use enum for test numbers in xen_shinfo_test KVM: selftests: Add helpers to make Xen-style VMCALL/VMMCALL hypercalls KVM: selftests: Move the guts of kvm_hypercall() to a separate macro KVM: SVM: WARN if GATag generation drops VM or vCPU ID information KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask selftests: KVM: skip hugetlb tests if huge pages are not available KVM: VMX: Use tabs instead of spaces for indentation KVM: VMX: Fix indentation coding style issue KVM: nVMX: remove unnecessary #ifdef KVM: nVMX: add missing consistency checks for CR0 and CR4 KVM: arm64: timers: Convert per-vcpu virtual offset to a global value commit 04504793feec0484dd0deea566c386d1965578f6 Merge: 1a87e641d8a50 1a3bd6eabae35 Author: David S. Miller Date: Thu Mar 16 17:46:05 2023 +0000 Merge branch 'virtio_net-xdp-bugs' Xuan Zhuo says: ==================== virtio_net: fix two bugs related to XDP This patch set fixes two bugs related to XDP. These two patch is not associated. ==================== Signed-off-by: David S. Miller commit 1a3bd6eabae35afc5c6dbe2651f21467cf8ad3fd Author: Xuan Zhuo Date: Wed Mar 15 09:52:23 2023 +0800 virtio_net: free xdp shinfo frags when build_skb_from_xdp_buff() fails build_skb_from_xdp_buff() may return NULL, in this case we need to free the frags of xdp shinfo. Fixes: fab89bafa95b ("virtio-net: support multi-buffer xdp") Signed-off-by: Xuan Zhuo Acked-by: Michael S. Tsirkin Reviewed-by: Yunsheng Lin Signed-off-by: David S. Miller commit fa0f1ba7c8233118b6fdaa65e2f5ded563d3e1fa Author: Xuan Zhuo Date: Wed Mar 15 09:52:22 2023 +0800 virtio_net: fix page_to_skb() miss headroom Because headroom is not passed to page_to_skb(), this causes the shinfo exceeds the range. Then the frags of shinfo are changed by other process. [ 157.724634] stack segment: 0000 [#1] PREEMPT SMP NOPTI [ 157.725358] CPU: 3 PID: 679 Comm: xdp_pass_user_f Tainted: G E 6.2.0+ #150 [ 157.726401] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/4 [ 157.727820] RIP: 0010:skb_release_data+0x11b/0x180 [ 157.728449] Code: 44 24 02 48 83 c3 01 39 d8 7e be 48 89 d8 48 c1 e0 04 41 80 7d 7e 00 49 8b 6c 04 30 79 0c 48 89 ef e8 89 b [ 157.730751] RSP: 0018:ffffc90000178b48 EFLAGS: 00010202 [ 157.731383] RAX: 0000000000000010 RBX: 0000000000000001 RCX: 0000000000000000 [ 157.732270] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff888100dd0b00 [ 157.733117] RBP: 5d5d76010f6e2408 R08: ffff888100dd0b2c R09: 0000000000000000 [ 157.734013] R10: ffffffff82effd30 R11: 000000000000a14e R12: ffff88810981ffc0 [ 157.734904] R13: ffff888100dd0b00 R14: 0000000000000002 R15: 0000000000002310 [ 157.735793] FS: 00007f06121d9740(0000) GS:ffff88842fcc0000(0000) knlGS:0000000000000000 [ 157.736794] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 157.737522] CR2: 00007ffd9a56c084 CR3: 0000000104bda001 CR4: 0000000000770ee0 [ 157.738420] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 157.739283] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 157.740146] PKRU: 55555554 [ 157.740502] Call Trace: [ 157.740843] [ 157.741117] kfree_skb_reason+0x50/0x120 [ 157.741613] __udp4_lib_rcv+0x52b/0x5e0 [ 157.742132] ip_protocol_deliver_rcu+0xaf/0x190 [ 157.742715] ip_local_deliver_finish+0x77/0xa0 [ 157.743280] ip_sublist_rcv_finish+0x80/0x90 [ 157.743834] ip_list_rcv_finish.constprop.0+0x16f/0x190 [ 157.744493] ip_list_rcv+0x126/0x140 [ 157.744952] __netif_receive_skb_list_core+0x29b/0x2c0 [ 157.745602] __netif_receive_skb_list+0xed/0x160 [ 157.746190] ? udp4_gro_receive+0x275/0x350 [ 157.746732] netif_receive_skb_list_internal+0xf2/0x1b0 [ 157.747398] napi_gro_receive+0xd1/0x210 [ 157.747911] virtnet_receive+0x75/0x1c0 [ 157.748422] virtnet_poll+0x48/0x1b0 [ 157.748878] __napi_poll+0x29/0x1b0 [ 157.749330] net_rx_action+0x27a/0x340 [ 157.749812] __do_softirq+0xf3/0x2fb [ 157.750298] do_softirq+0xa2/0xd0 [ 157.750745] [ 157.751563] [ 157.752329] __local_bh_enable_ip+0x6d/0x80 [ 157.753178] virtnet_xdp_set+0x482/0x860 [ 157.754159] ? __pfx_virtnet_xdp+0x10/0x10 [ 157.755129] dev_xdp_install+0xa4/0xe0 [ 157.756033] dev_xdp_attach+0x20b/0x5e0 [ 157.756933] do_setlink+0x82e/0xc90 [ 157.757777] ? __nla_validate_parse+0x12b/0x1e0 [ 157.758744] rtnl_setlink+0xd8/0x170 [ 157.759549] ? mod_objcg_state+0xcb/0x320 [ 157.760328] ? security_capable+0x37/0x60 [ 157.761209] ? security_capable+0x37/0x60 [ 157.762072] rtnetlink_rcv_msg+0x145/0x3d0 [ 157.762929] ? ___slab_alloc+0x327/0x610 [ 157.763754] ? __alloc_skb+0x141/0x170 [ 157.764533] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 157.765422] netlink_rcv_skb+0x58/0x110 [ 157.766229] netlink_unicast+0x21f/0x330 [ 157.766951] netlink_sendmsg+0x240/0x4a0 [ 157.767654] sock_sendmsg+0x93/0xa0 [ 157.768434] ? sockfd_lookup_light+0x12/0x70 [ 157.769245] __sys_sendto+0xfe/0x170 [ 157.770079] ? handle_mm_fault+0xe9/0x2d0 [ 157.770859] ? preempt_count_add+0x51/0xa0 [ 157.771645] ? up_read+0x3c/0x80 [ 157.772340] ? do_user_addr_fault+0x1e9/0x710 [ 157.773166] ? kvm_read_and_reset_apf_flags+0x49/0x60 [ 157.774087] __x64_sys_sendto+0x29/0x30 [ 157.774856] do_syscall_64+0x3c/0x90 [ 157.775518] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 157.776382] RIP: 0033:0x7f06122def70 Fixes: 18117a842ab0 ("virtio-net: remove xdp related info from page_to_skb()") Signed-off-by: Xuan Zhuo Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit 1a87e641d8a50c30b63b1d90819bc607b4327596 Author: Rob Herring Date: Tue Mar 14 14:18:27 2023 -0500 net: Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to of_property_read_bool(). Reviewed-by: Simon Horman Acked-by: Marc Kleine-Budde # for net/can Acked-by: Kalle Valo Acked-by: Nicolas Ferre Acked-by: Francois Romieu Reviewed-by: Wei Fang Signed-off-by: Rob Herring Signed-off-by: David S. Miller commit 65d63e82b19201a5b522ca4eb2d6dffe0b4b6a31 Merge: b830c96423868 7e9517375a14f Author: David S. Miller Date: Thu Mar 16 17:39:42 2023 +0000 Merge branch 'net-dsa-marvell-mtu-reporting' Vladimir Oltean says: ==================== Fix MTU reporting for Marvell DSA switches where we can't change it As explained in patch 2, the driver doesn't know how to change the MTU on MV88E6165, MV88E6191, MV88E6220, MV88E6250 and MV88E6290, and there is a regression where it actually reports an MTU value below the Ethernet standard (1500). Fixing that shows another issue where DSA is unprepared to be told that a switch supports an MTU of only 1500, and still errors out. That is addressed by patch 1. Testing was not done on "real" hardware, but on a different Marvell DSA switch, with code modified such that the driver doesn't know how to change the MTU on that, either. A key assumption is that these switches don't need any MTU configuration to pass full MTU-sized, DSA-tagged packets, which seems like a reasonable assumption to make. My 6390 and 6190 switches, with .port_set_jumbo_size commented out, certainly don't seem to have any problem passing MTU-sized traffic, as can be seen in this iperf3 session captured with tcpdump on the DSA master: $MAC > $MAC, Marvell DSA mode Forward, dev 2, port 8, untagged, VID 1000, FPri 0, ethertype IPv4 (0x0800), length 1518: 10.0.0.69.49590 > 10.0.0.1.5201: Flags [.], seq 81088:82536, ack 1, win 502, options [nop,nop,TS val 2221498829 ecr 3012859850], length 1448 I don't want to go all the way and say that the adjustment made by commit b9c587fed61c ("dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports") is completely unnecessary, just that there's an equally good chance that the switches with unknown MTU configuration procedure "just work". ==================== Signed-off-by: David S. Miller commit 7e9517375a14f44ee830ca1c3278076dd65fcc8f Author: Vladimir Oltean Date: Tue Mar 14 20:24:05 2023 +0200 net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290 There are 3 classes of switch families that the driver is aware of, as far as mv88e6xxx_change_mtu() is concerned: - MTU configuration is available per port. Here, the chip->info->ops->port_set_jumbo_size() method will be present. - MTU configuration is global to the switch. Here, the chip->info->ops->set_max_frame_size() method will be present. - We don't know how to change the MTU. Here, none of the above methods will be present. Switch families MV88E6165, MV88E6191, MV88E6220, MV88E6250 and MV88E6290 fall in category 3. The blamed commit has adjusted the MTU for all 3 categories by EDSA_HLEN (8 bytes), resulting in a new maximum MTU of 1492 being reported by the driver for these switches. I don't have the hardware to test, but I do have a MV88E6390 switch on which I can simulate this by commenting out its .port_set_jumbo_size definition from mv88e6390_ops. The result is this set of messages at probe time: mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 1 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 2 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 3 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 4 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 5 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 6 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 7 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 8 It is highly implausible that there exist Ethernet switches which don't support the standard MTU of 1500 octets, and this is what the DSA framework says as well - the error comes from dsa_slave_create() -> dsa_slave_change_mtu(slave_dev, ETH_DATA_LEN). But the error messages are alarming, and it would be good to suppress them. As a consequence of this unlikeliness, we reimplement mv88e6xxx_get_max_mtu() and mv88e6xxx_change_mtu() on switches from the 3rd category as follows: the maximum supported MTU is 1500, and any request to set the MTU to a value larger than that fails in dev_validate_mtu(). Fixes: b9c587fed61c ("dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 636e8adf7878eab3614250234341bde45537f47a Author: Vladimir Oltean Date: Tue Mar 14 20:24:04 2023 +0200 net: dsa: don't error out when drivers return ETH_DATA_LEN in .port_max_mtu() Currently, when dsa_slave_change_mtu() is called on a user port where dev->max_mtu is 1500 (as returned by ds->ops->port_max_mtu()), the code will stumble upon this check: if (new_master_mtu > mtu_limit) return -ERANGE; because new_master_mtu is adjusted for the tagger overhead but mtu_limit is not. But it would be good if the logic went through, for example if the DSA master really depends on an MTU adjustment to accept DSA-tagged frames. To make the code pass through the check, we need to adjust mtu_limit for the overhead as well, if the minimum restriction was caused by the DSA user port's MTU (dev->max_mtu). A DSA user port MTU and a DSA master MTU are always offset by the protocol overhead. Currently no drivers return 1500 .port_max_mtu(), but this is only temporary and a bug in itself - mv88e6xxx should have done that, but since commit b9c587fed61c ("dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports") it no longer does. This is a preparation for fixing that. Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit d3aa3e060c4a80827eb801fc448debc9daa7c46b Author: Jiasheng Jiang Date: Thu Mar 16 14:55:06 2023 +0800 dm stats: check for and propagate alloc_percpu failure Check alloc_precpu()'s return value and return an error from dm_stats_init() if it fails. Update alloc_dev() to fail if dm_stats_init() does. Otherwise, a NULL pointer dereference will occur in dm_stats_cleanup() even if dm-stats isn't being actively used. Fixes: fd2ed4d25270 ("dm: add statistics support") Cc: stable@vger.kernel.org Signed-off-by: Jiasheng Jiang Signed-off-by: Mike Snitzer commit b830c9642386867863ac64295185f896ff2928ac Author: Maciej Fijalkowski Date: Tue Mar 14 10:45:43 2023 -0700 ice: xsk: disable txq irq before flushing hw ice_qp_dis() intends to stop a given queue pair that is a target of xsk pool attach/detach. One of the steps is to disable interrupts on these queues. It currently is broken in a way that txq irq is turned off *after* HW flush which in turn takes no effect. ice_qp_dis(): -> ice_qvec_dis_irq() --> disable rxq irq --> flush hw -> ice_vsi_stop_tx_ring() -->disable txq irq Below splat can be triggered by following steps: - start xdpsock WITHOUT loading xdp prog - run xdp_rxq_info with XDP_TX action on this interface - start traffic - terminate xdpsock [ 256.312485] BUG: kernel NULL pointer dereference, address: 0000000000000018 [ 256.319560] #PF: supervisor read access in kernel mode [ 256.324775] #PF: error_code(0x0000) - not-present page [ 256.329994] PGD 0 P4D 0 [ 256.332574] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 256.337006] CPU: 3 PID: 32 Comm: ksoftirqd/3 Tainted: G OE 6.2.0-rc5+ #51 [ 256.345218] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 256.355807] RIP: 0010:ice_clean_rx_irq_zc+0x9c/0x7d0 [ice] [ 256.361423] Code: b7 8f 8a 00 00 00 66 39 ca 0f 84 f1 04 00 00 49 8b 47 40 4c 8b 24 d0 41 0f b7 45 04 66 25 ff 3f 66 89 04 24 0f 84 85 02 00 00 <49> 8b 44 24 18 0f b7 14 24 48 05 00 01 00 00 49 89 04 24 49 89 44 [ 256.380463] RSP: 0018:ffffc900088bfd20 EFLAGS: 00010206 [ 256.385765] RAX: 000000000000003c RBX: 0000000000000035 RCX: 000000000000067f [ 256.393012] RDX: 0000000000000775 RSI: 0000000000000000 RDI: ffff8881deb3ac80 [ 256.400256] RBP: 000000000000003c R08: ffff889847982710 R09: 0000000000010000 [ 256.407500] R10: ffffffff82c060c0 R11: 0000000000000004 R12: 0000000000000000 [ 256.414746] R13: ffff88811165eea0 R14: ffffc9000d255000 R15: ffff888119b37600 [ 256.421990] FS: 0000000000000000(0000) GS:ffff8897e0cc0000(0000) knlGS:0000000000000000 [ 256.430207] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 256.436036] CR2: 0000000000000018 CR3: 0000000005c0a006 CR4: 00000000007706e0 [ 256.443283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 256.450527] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 256.457770] PKRU: 55555554 [ 256.460529] Call Trace: [ 256.463015] [ 256.465157] ? ice_xmit_zc+0x6e/0x150 [ice] [ 256.469437] ice_napi_poll+0x46d/0x680 [ice] [ 256.473815] ? _raw_spin_unlock_irqrestore+0x1b/0x40 [ 256.478863] __napi_poll+0x29/0x160 [ 256.482409] net_rx_action+0x136/0x260 [ 256.486222] __do_softirq+0xe8/0x2e5 [ 256.489853] ? smpboot_thread_fn+0x2c/0x270 [ 256.494108] run_ksoftirqd+0x2a/0x50 [ 256.497747] smpboot_thread_fn+0x1c1/0x270 [ 256.501907] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 256.506594] kthread+0xea/0x120 [ 256.509785] ? __pfx_kthread+0x10/0x10 [ 256.513597] ret_from_fork+0x29/0x50 [ 256.517238] In fact, irqs were not disabled and napi managed to be scheduled and run while xsk_pool pointer was still valid, but SW ring of xdp_buff pointers was already freed. To fix this, call ice_qvec_dis_irq() after ice_vsi_stop_tx_ring(). Also while at it, remove redundant ice_clean_rx_ring() call - this is handled in ice_qp_clean_rings(). Fixes: 2d4238f55697 ("ice: Add support for AF_XDP") Signed-off-by: Maciej Fijalkowski Reviewed-by: Larysa Zaremba Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Acked-by: John Fastabend Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 1a200b51fa75100d24861511ccdb105321291b75 Merge: cd356010ce4c6 7e699d2a4e810 Author: David S. Miller Date: Thu Mar 16 17:28:23 2023 +0000 Merge branch 'net-virtio-vsock' commit 7e699d2a4e8104d304e921ac5e0a0c73f0f7b623 Author: Arseniy Krasnov Date: Tue Mar 14 14:09:27 2023 +0300 test/vsock: copy to user failure test This adds SOCK_STREAM and SOCK_SEQPACKET tests for invalid buffer case. It tries to read data to NULL buffer (data already presents in socket's queue), then uses valid buffer. For SOCK_STREAM second read must return data, because skbuff is not dropped, but for SOCK_SEQPACKET skbuff will be dropped by kernel, and 'recv()' will return EAGAIN. Signed-off-by: Arseniy Krasnov Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller commit 8daaf39f7f6ef53a11817f6a11ec104016c3545f Author: Arseniy Krasnov Date: Tue Mar 14 14:08:20 2023 +0300 virtio/vsock: don't drop skbuff on copy failure This returns behaviour of SOCK_STREAM read as before skbuff usage. When copying to user fails current skbuff won't be dropped, but returned to sockets's queue. Technically instead of 'skb_dequeue()', 'skb_peek()' is called and when skbuff becomes empty, it is removed from queue by '__skb_unlink()'. Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Signed-off-by: Arseniy Krasnov Reviewed-by: Stefano Garzarella Acked-by: Bobby Eshleman Signed-off-by: David S. Miller commit 6825e6b4f8e53799d83bc39ca6ec5baed4e2adde Author: Arseniy Krasnov Date: Tue Mar 14 14:06:53 2023 +0300 virtio/vsock: remove redundant 'skb_pull()' call Since we now no longer use 'skb->len' to update credit, there is no sense to update skbuff state, because it is used only once after dequeue to copy data and then will be released. Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Signed-off-by: Arseniy Krasnov Reviewed-by: Stefano Garzarella Acked-by: Bobby Eshleman Signed-off-by: David S. Miller commit 077706165717686a2a6a71405fef036cd5b37ae0 Author: Arseniy Krasnov Date: Tue Mar 14 14:05:48 2023 +0300 virtio/vsock: don't use skbuff state to account credit 'skb->len' can vary when we partially read the data, this complicates the calculation of credit to be updated in 'virtio_transport_inc_rx_pkt()/ virtio_transport_dec_rx_pkt()'. Also in 'virtio_transport_dec_rx_pkt()' we were miscalculating the credit since 'skb->len' was redundant. For these reasons, let's replace the use of skbuff state to calculate new 'rx_bytes'/'fwd_cnt' values with explicit value as input argument. This makes code more simple, because it is not needed to change skbuff state before each call to update 'rx_bytes'/'fwd_cnt'. Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Signed-off-by: Arseniy Krasnov Reviewed-by: Stefano Garzarella Acked-by: Bobby Eshleman Signed-off-by: David S. Miller commit 6de4b1ab470fe52351415217ac6dffddee571c45 Author: Darrick J. Wong Date: Fri Mar 10 13:42:08 2023 -0800 xfs: try to idiot-proof the allocators In porting his development branch to 6.3-rc1, yours truly has repeatedly screwed up the args->pag being fed to the xfs_alloc_vextent* functions. Add some debugging assertions to test the preconditions required of the callers. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 748b2f5e82d17480404b3e2895388fc2925f7caf Author: Harshit Mogalapalli Date: Mon Mar 6 11:18:24 2023 -0800 ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() mac_len is of type unsigned, which can never be less than zero. mac_len = ieee802154_hdr_peek_addrs(skb, &header); if (mac_len < 0) return mac_len; Change this to type int as ieee802154_hdr_peek_addrs() can return negative integers, this is found by static analysis with smatch. Fixes: 6c993779ea1d ("ca8210: fix mac_len negative array access") Signed-off-by: Harshit Mogalapalli Acked-by: Alexander Aring Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230306191824.4115839-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Stefan Schmidt commit 2b4cc3d3f4d8ec42961e98568a0afeee96a943ab Author: AKASHI Takahiro Date: Tue Mar 7 15:45:31 2023 +0900 igc: fix the validation logic for taprio's gate list The check introduced in the commit a5fd39464a40 ("igc: Lift TAPRIO schedule restriction") can detect a false positive error in some corner case. For instance, tc qdisc replace ... taprio num_tc 4 ... sched-entry S 0x01 100000 # slot#1 sched-entry S 0x03 100000 # slot#2 sched-entry S 0x04 100000 # slot#3 sched-entry S 0x08 200000 # slot#4 flags 0x02 # hardware offload Here the queue#0 (the first queue) is on at the slot#1 and #2, and off at the slot#3 and #4. Under the current logic, when the slot#4 is examined, validate_schedule() returns *false* since the enablement count for the queue#0 is two and it is already off at the previous slot (i.e. #3). But this definition is truely correct. Let's fix the logic to enforce a strict validation for consecutively-opened slots. Fixes: a5fd39464a40 ("igc: Lift TAPRIO schedule restriction") Signed-off-by: AKASHI Takahiro Reviewed-by: Kurt Kanzenbach Acked-by: Vinicius Costa Gomes Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 02c83791ef969c6a8a150b4927193d0d0e50fb23 Author: Akihiko Odaki Date: Thu Dec 1 19:20:03 2022 +0900 igbvf: Regard vf reset nack as success vf reset nack actually represents the reset operation itself is performed but no address is assigned. Therefore, e1000_reset_hw_vf should fill the "perm_addr" with the zero address and return success on such an occasion. This prevents its callers in netdev.c from saying PF still resetting, and instead allows them to correctly report that no address is assigned. Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") Signed-off-by: Akihiko Odaki Reviewed-by: Leon Romanovsky Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 85eb39bb39cbb5c086df1e19ba67cc1366693a77 Author: Gaosheng Cui Date: Tue Nov 22 10:28:52 2022 +0800 intel/igbvf: free irq on the error path in igbvf_request_msix() In igbvf_request_msix(), irqs have not been freed on the err path, we need to free it. Fix it. Fixes: d4e0fe01a38a ("igbvf: add new driver to support 82576 virtual functions") Signed-off-by: Gaosheng Cui Reviewed-by: Maciej Fijalkowski Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 50f303496d92e25b79bdfb73e3707ad0684ad67f Author: Akihiko Odaki Date: Tue Nov 22 18:28:03 2022 +0900 igb: Enable SR-IOV after reinit Enabling SR-IOV causes the virtual functions to make requests to the PF via the mailbox. Notably, E1000_VF_RESET request will happen during the initialization of the VF. However, unless the reinit is done, the VMMB interrupt, which delivers mailbox interrupt from VF to PF will be kept masked and such requests will be silently ignored. Enable SR-IOV at the very end of the procedure to configure the device for SR-IOV so that the PF is configured properly for SR-IOV when a VF is activated. Fixes: fa44f2f185f7 ("igb: Enable SR-IOV configuration via PCI sysfs interface") Signed-off-by: Akihiko Odaki Tested-by: Marek Szlosek Signed-off-by: Tony Nguyen commit 65f69851e44d71248b952a687e44759a7abb5016 Author: Lin Ma Date: Tue Mar 7 23:29:17 2023 +0800 igb: revert rtnl_lock() that causes deadlock The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds rtnl_lock to eliminate a false data race shown below (FREE from device detaching) | (USE from netdev core) igb_remove | igb_ndo_get_vf_config igb_disable_sriov | vf >= adapter->vfs_allocated_count? kfree(adapter->vf_data) | adapter->vfs_allocated_count = 0 | | memcpy(... adapter->vf_data[vf] The above race will never happen and the extra rtnl_lock causes deadlock below [ 141.420169] [ 141.420672] __schedule+0x2dd/0x840 [ 141.421427] schedule+0x50/0xc0 [ 141.422041] schedule_preempt_disabled+0x11/0x20 [ 141.422678] __mutex_lock.isra.13+0x431/0x6b0 [ 141.423324] unregister_netdev+0xe/0x20 [ 141.423578] igbvf_remove+0x45/0xe0 [igbvf] [ 141.423791] pci_device_remove+0x36/0xb0 [ 141.423990] device_release_driver_internal+0xc1/0x160 [ 141.424270] pci_stop_bus_device+0x6d/0x90 [ 141.424507] pci_stop_and_remove_bus_device+0xe/0x20 [ 141.424789] pci_iov_remove_virtfn+0xba/0x120 [ 141.425452] sriov_disable+0x2f/0xf0 [ 141.425679] igb_disable_sriov+0x4e/0x100 [igb] [ 141.426353] igb_remove+0xa0/0x130 [igb] [ 141.426599] pci_device_remove+0x36/0xb0 [ 141.426796] device_release_driver_internal+0xc1/0x160 [ 141.427060] driver_detach+0x44/0x90 [ 141.427253] bus_remove_driver+0x55/0xe0 [ 141.427477] pci_unregister_driver+0x2a/0xa0 [ 141.428296] __x64_sys_delete_module+0x141/0x2b0 [ 141.429126] ? mntput_no_expire+0x4a/0x240 [ 141.429363] ? syscall_trace_enter.isra.19+0x126/0x1a0 [ 141.429653] do_syscall_64+0x5b/0x80 [ 141.429847] ? exit_to_user_mode_prepare+0x14d/0x1c0 [ 141.430109] ? syscall_exit_to_user_mode+0x12/0x30 [ 141.430849] ? do_syscall_64+0x67/0x80 [ 141.431083] ? syscall_exit_to_user_mode_prepare+0x183/0x1b0 [ 141.431770] ? syscall_exit_to_user_mode+0x12/0x30 [ 141.432482] ? do_syscall_64+0x67/0x80 [ 141.432714] ? exc_page_fault+0x64/0x140 [ 141.432911] entry_SYSCALL_64_after_hwframe+0x72/0xdc Since the igb_disable_sriov() will call pci_disable_sriov() before releasing any resources, the netdev core will synchronize the cleanup to avoid any races. This patch removes the useless rtnl_(un)lock to guarantee correctness. CC: stable@vger.kernel.org Fixes: 6faee3d4ee8b ("igb: Add lock to avoid data race") Reported-by: Corinna Vinschen Link: https://lore.kernel.org/intel-wired-lan/ZAcJvkEPqWeJHO2r@calimero.vinschen.de/ Signed-off-by: Lin Ma Tested-by: Corinna Vinschen Reviewed-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 964290ff32d132bf971d45b29f7de39756dab7c8 Author: Ahmed Zaki Date: Wed Mar 15 13:59:25 2023 -0600 iavf: do not track VLAN 0 filters When an interface with the maximum number of VLAN filters is brought up, a spurious error is logged: [257.483082] 8021q: adding VLAN 0 to HW filter on device enp0s3 [257.483094] iavf 0000:00:03.0 enp0s3: Max allowed VLAN filters 8. Remove existing VLANs or disable filtering via Ethtool if supported. The VF driver complains that it cannot add the VLAN 0 filter. On the other hand, the PF driver always adds VLAN 0 filter on VF initialization. The VF does not need to ask the PF for that filter at all. Fix the error by not tracking VLAN 0 filters altogether. With that, the check added by commit 0e710a3ffd0c ("iavf: Fix VF driver counting VLAN 0 filters") in iavf_virtchnl.c is useless and might be confusing if left as it suggests that we track VLAN 0. Fixes: 0e710a3ffd0c ("iavf: Fix VF driver counting VLAN 0 filters") Signed-off-by: Ahmed Zaki Reviewed-by: Michal Kubiak Signed-off-by: Tony Nguyen commit de58647b4301fe181f9c38e8b46f7021584ae427 Author: Alexander Lobakin Date: Wed Mar 1 12:59:08 2023 +0100 iavf: fix non-tunneled IPv6 UDP packet type and hashing Currently, IAVF's decode_rx_desc_ptype() correctly reports payload type of L4 for IPv4 UDP packets and IPv{4,6} TCP, but only L3 for IPv6 UDP. Originally, i40e, ice and iavf were affected. Commit 73df8c9e3e3d ("i40e: Correct UDP packet header for non_tunnel-ipv6") fixed that in i40e, then commit 638a0c8c8861 ("ice: fix incorrect payload indicator on PTYPE") fixed that for ice. IPv6 UDP is L4 obviously. Fix it and make iavf report correct L4 hash type for such packets, so that the stack won't calculate it on CPU when needs it. Fixes: 206812b5fccb ("i40e/i40evf: i40e implementation for skb_set_hash") Reviewed-by: Larysa Zaremba Reviewed-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Rafal Romanowski Reviewed-by: Leon Romanovsky Signed-off-by: Tony Nguyen commit 32d57f667f871bc5a8babbe27ea4c5e668ee0ea8 Author: Alexander Lobakin Date: Wed Mar 1 12:59:07 2023 +0100 iavf: fix inverted Rx hash condition leading to disabled hash Condition, which checks whether the netdev has hashing enabled is inverted. Basically, the tagged commit effectively disabled passing flow hash from descriptor to skb, unless user *disables* it via Ethtool. Commit a876c3ba59a6 ("i40e/i40evf: properly report Rx packet hash") fixed this problem, but only for i40e. Invert the condition now in iavf and unblock passing hash to skbs again. Fixes: 857942fd1aa1 ("i40e: Fix Rx hash reported to the stack by our driver") Reviewed-by: Larysa Zaremba Reviewed-by: Michal Kubiak Signed-off-by: Alexander Lobakin Tested-by: Rafal Romanowski Reviewed-by: Leon Romanovsky Signed-off-by: Tony Nguyen commit 8f0d196e4dc137470bbd5de98278d941c8002fcb Author: Lukas Bulwahn Date: Thu Mar 16 12:16:30 2023 +0100 block: remove obsolete config BLOCK_COMPAT Before commit bdc1ddad3e5f ("compat_ioctl: block: move blkdev_compat_ioctl() into ioctl.c"), the config BLOCK_COMPAT was used to include compat_ioctl.c into the kernel build. With this commit, the code is moved into ioctl.c and included with the config COMPAT. So, since then, the config BLOCK_COMPAT has no effect and any further purpose. Remove this obsolete config BLOCK_COMPAT. Signed-off-by: Lukas Bulwahn Reviewed-by: Christoph Hellwig Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230316111630.4897-1-lukas.bulwahn@gmail.com Signed-off-by: Jens Axboe commit d2acf789088bb562cea342b6a24e646df4d47839 Author: Pavel Begunkov Date: Thu Mar 16 15:26:05 2023 +0000 io_uring/rsrc: fix folio accounting | BUG: Bad page state in process kworker/u8:0 pfn:5c001 | page:00000000bfda61c8 refcount:0 mapcount:0 mapping:0000000000000000 index:0x20001 pfn:0x5c001 | head:0000000011409842 order:9 entire_mapcount:0 nr_pages_mapped:0 pincount:1 | anon flags: 0x3fffc00000b0004(uptodate|head|mappedtodisk|swapbacked|node=0|zone=0|lastcpupid=0xffff) | raw: 03fffc0000000000 fffffc0000700001 ffffffff00700903 0000000100000000 | raw: 0000000000000200 0000000000000000 00000000ffffffff 0000000000000000 | head: 03fffc00000b0004 dead000000000100 dead000000000122 ffff00000a809dc1 | head: 0000000000020000 0000000000000000 00000000ffffffff 0000000000000000 | page dumped because: nonzero pincount | CPU: 3 PID: 9 Comm: kworker/u8:0 Not tainted 6.3.0-rc2-00001-gc6811bf0cd87 #1 | Hardware name: linux,dummy-virt (DT) | Workqueue: events_unbound io_ring_exit_work | Call trace: | dump_backtrace+0x13c/0x208 | show_stack+0x34/0x58 | dump_stack_lvl+0x150/0x1a8 | dump_stack+0x20/0x30 | bad_page+0xec/0x238 | free_tail_pages_check+0x280/0x350 | free_pcp_prepare+0x60c/0x830 | free_unref_page+0x50/0x498 | free_compound_page+0xcc/0x100 | free_transhuge_page+0x1f0/0x2b8 | destroy_large_folio+0x80/0xc8 | __folio_put+0xc4/0xf8 | gup_put_folio+0xd0/0x250 | unpin_user_page+0xcc/0x128 | io_buffer_unmap+0xec/0x2c0 | __io_sqe_buffers_unregister+0xa4/0x1e0 | io_ring_exit_work+0x68c/0x1188 | process_one_work+0x91c/0x1a58 | worker_thread+0x48c/0xe30 | kthread+0x278/0x2f0 | ret_from_fork+0x10/0x20 Mark reports an issue with the recent patches coalescing compound pages while registering them in io_uring. The reason is that we try to drop excessive references with folio_put_refs(), but pages were acquired with pin_user_pages(), which has extra accounting and so should be put down with matching unpin_user_pages() or at least gup_put_folio(). As a fix unpin_user_pages() all but first page instead, and let's figure out a better API after. Fixes: 57bebf807e2abcf8 ("io_uring/rsrc: optimise registered huge pages") Reported-by: Mark Rutland Reviewed-by: Jens Axboe Tested-by: Jens Axboe Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/10efd5507d6d1f05ea0f3c601830e08767e189bd.1678980230.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 29413f05fe34e8824551b91f660fde781249417d Author: Rob Herring Date: Fri Mar 10 08:47:29 2023 -0600 fbdev: Use of_property_present() for testing DT property presence It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. As part of this, convert of_get_property/of_find_property calls to the recently added of_property_present() helper when we just want to test for presence of a property and nothing more. Signed-off-by: Rob Herring Signed-off-by: Helge Deller commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb Author: Wei Chen Date: Wed Mar 15 09:22:54 2023 +0000 fbdev: au1200fb: Fix potential divide by zero var->pixclock can be assigned to zero by user. Without proper check, divide by zero would occur when invoking macro PICOS2KHZ in au1200fb_fb_check_var. Error out if var->pixclock is zero. Signed-off-by: Wei Chen Signed-off-by: Helge Deller commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 Author: Wei Chen Date: Wed Mar 15 09:05:18 2023 +0000 fbdev: lxfb: Fix potential divide by zero var->pixclock can be assigned to zero by user. Without proper check, divide by zero would occur in lx_set_clock. Error out if var->pixclock is zero. Signed-off-by: Wei Chen Signed-off-by: Helge Deller commit d823685486a3446d061fed7c7d2f80af984f119a Author: Wei Chen Date: Wed Mar 15 08:33:47 2023 +0000 fbdev: intelfb: Fix potential divide by zero Variable var->pixclock is controlled by user and can be assigned to zero. Without proper check, divide by zero would occur in intelfbhw_validate_mode and intelfbhw_mode_to_hw. Error out if var->pixclock is zero. Signed-off-by: Wei Chen Signed-off-by: Helge Deller commit 92e2a00f2987483e1f9253625828622edd442e61 Author: Wei Chen Date: Wed Mar 15 07:18:31 2023 +0000 fbdev: nvidia: Fix potential divide by zero variable var->pixclock can be set by user. In case it equals to zero, divide by zero would occur in nvidiafb_set_par. Similar crashes have happened in other fbdev drivers. There is no check and modification on var->pixclock along the call chain to nvidia_check_var and nvidiafb_set_par. We believe it could also be triggered in driver nvidia from user site. Signed-off-by: Wei Chen Signed-off-by: Helge Deller commit 203873a535d627c668f293be0cb73e26c30f9cc7 Author: Helge Deller Date: Thu Mar 16 11:38:19 2023 +0100 fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks Find a valid modeline depending on the machine graphic card configuration and add the fb_check_var() function to validate Xorg provided graphics settings. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org commit c7df4813b149362248d6ef7be41a311e27bf75fe Author: Kal Conley Date: Wed Mar 8 18:40:13 2023 +0100 xsk: Add missing overflow check in xdp_umem_reg The number of chunks can overflow u32. Make sure to return -EINVAL on overflow. Also remove a redundant u32 cast assigning umem->npgs. Fixes: bbff2f321a86 ("xsk: new descriptor addressing scheme") Signed-off-by: Kal Conley Signed-off-by: Daniel Borkmann Acked-by: Magnus Karlsson Link: https://lore.kernel.org/bpf/20230308174013.1114745-1-kal.conley@dectris.com commit 05e96e96a315fa49faca4da2aedd1761a218b616 Author: Masahiro Yamada Date: Thu Mar 16 00:50:18 2023 +0900 kbuild: use git-archive for source package creation Commit 5c3d1d0abb12 ("kbuild: add a tool to list files ignored by git") added a new tool, scripts/list-gitignored. My intention was to create source packages without cleaning the source tree, without relying on git. Linus strongly objected to it, and suggested using 'git archive' instead. [1] [2] [3] This commit goes in that direction - Remove scripts/list-gitignored.c and rewrites Makefiles and scripts to use 'git archive' for building Debian and RPM source packages. It also makes 'make perf-tar*-src-pkg' use 'git archive' again. Going forward, building source packages is only possible in a git-managed tree. Building binary packages does not require git. [1]: https://lore.kernel.org/lkml/CAHk-=wi49sMaC7vY1yMagk7eqLK=1jHeHQ=yZ_k45P=xBccnmA@mail.gmail.com/ [2]: https://lore.kernel.org/lkml/CAHk-=wh5AixGsLeT0qH2oZHKq0FLUTbyTw4qY921L=PwYgoGVw@mail.gmail.com/ [3]: https://lore.kernel.org/lkml/CAHk-=wgM-W6Fu==EoAVCabxyX8eYBz9kNC88-tm9ExRQwA79UQ@mail.gmail.com/ Fixes: 5c3d1d0abb12 ("kbuild: add a tool to list files ignored by git") Fixes: e0ca16749ac3 ("kbuild: make perf-tar*-src-pkg work without relying on git") Suggested-by: Linus Torvalds Signed-off-by: Masahiro Yamada commit 81f59a26f3d59c6aeb137b7b5546848779222c65 Author: Masahiro Yamada Date: Thu Mar 16 00:50:17 2023 +0900 kbuild: rpm-pkg: move source components to rpmbuild/SOURCES Prepare to add more files to the source RPM. Also, fix the build error when KCONFIG_CONFIG is set: error: Bad file: ./.config: No such file or directory Signed-off-by: Masahiro Yamada commit 5da28edd7bd5518f97175ecea77615bb729a7a28 Author: Pavel Begunkov Date: Thu Mar 16 12:11:42 2023 +0000 io_uring/msg_ring: let target know allocated index msg_ring requests transferring files support auto index selection via IORING_FILE_INDEX_ALLOC, however they don't return the selected index to the target ring and there is no other good way for the userspace to know where is the receieved file. Return the index for allocated slots and 0 otherwise, which is consistent with other fixed file installing requests. Cc: stable@vger.kernel.org # v6.0+ Fixes: e6130eba8a848 ("io_uring: add support for passing fixed file descriptors") Signed-off-by: Pavel Begunkov Link: https://github.com/axboe/liburing/issues/809 Signed-off-by: Jens Axboe commit 890a2fb06eb9af88b16f18840bf0b4dddc08b53d Merge: 23e5b9307ede2 6173a77b7e9d3 Author: Jens Axboe Date: Thu Mar 16 07:01:48 2023 -0600 Merge tag 'nvme-6.3-2022-03-16' of git://git.infradead.org/nvme into block-6.3 Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.3 - avoid potential UAF in nvmet_req_complete (Damien Le Moal) - more quirks (Elmer Miroslav Mosher Golovin, Philipp Geulen) - fix a memory leak in the nvme-pci probe teardown path (Irvin Cote) - repair the MAINTAINERS entry (Lukas Bulwahn) - fix handling single range discard request (Ming Lei) - show more opcode names in trace events (Minwoo Im) - fix nvme-tcp timeout reporting (Sagi Grimberg)" * tag 'nvme-6.3-2022-03-16' of git://git.infradead.org/nvme: nvmet: avoid potential UAF in nvmet_req_complete() nvme-trace: show more opcode names nvme-tcp: add nvme-tcp pdu size build protection nvme-tcp: fix opcode reporting in the timeout handler nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 nvme-pci: fixing memory leak in probe teardown path nvme: fix handling single range discard request MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS commit bbf860ed710bacc0279c4cda2817f70e1200d04b Author: Andy Shevchenko Date: Mon Mar 13 17:45:22 2023 +0200 usb: gadget: Use correct endianness of the wLength field for WebUSB WebUSB code uses wLength directly without proper endianness conversion. Update it to use already prepared temporary variable w_length instead. Fixes: 93c473948c58 ("usb: gadget: add WebUSB landing page support") Signed-off-by: Andy Shevchenko Tested-By: Jó Ágila Bitsch Link: https://lore.kernel.org/r/20230313154522.52684-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a37eb61b6ec064ac794b8a1e89fd33eb582fe51d Author: Yaroslav Furman Date: Sun Mar 12 11:07:45 2023 +0200 uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2 Just like other JMicron JMS5xx enclosures, it chokes on report-opcodes, let's avoid them. Signed-off-by: Yaroslav Furman Cc: stable Link: https://lore.kernel.org/r/20230312090745.47962-1-yaro330@gmail.com Signed-off-by: Greg Kroah-Hartman commit 96b96b2a567fb34dd41c87e6cf01f6902ce8cae4 Author: Pawel Laszczak Date: Thu Mar 9 01:30:48 2023 -0500 usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver Patch changes CDNS_DEVICE_ID in USBSSP PCI Glue driver to remove the conflict with Cadence USBSS driver. cc: Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/20230309063048.299378-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman commit 1272fd652a226ccb34e9f47371b6121948048438 Author: Pawel Laszczak Date: Wed Mar 8 07:44:27 2023 -0500 usb: cdns3: Fix issue with using incorrect PCI device function PCI based platform can have more than two PCI functions. USBSS PCI Glue driver during initialization should consider only DRD/HOST/DEVICE PCI functions and all other should be ignored. This patch adds additional condition which causes that only DRD and HOST/DEVICE function will be accepted. cc: Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/20230308124427.311245-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman commit 5bc38d33a5a1209fd4de65101d1ae8255ea12c6e Author: Pawel Laszczak Date: Tue Mar 7 06:14:20 2023 -0500 usb: cdnsp: Fixes issue with redundant Status Stage In some cases, driver trees to send Status Stage twice. The first one from upper layer of gadget usb subsystem and second time from controller driver. This patch fixes this issue and remove tricky handling of SET_INTERFACE from controller driver which is no longer needed. cc: Fixes: 3d82904559f4 ("usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver") Signed-off-by: Pawel Laszczak Link: https://lore.kernel.org/r/20230307111420.376056-1-pawell@cadence.com Signed-off-by: Greg Kroah-Hartman commit c3aa32ac86fe5f27659f07474995ec743a3251b0 Author: Hongren Zheng Date: Thu Mar 16 01:31:53 2023 +0800 MAINTAINERS: make me a reviewer of USB/IP I think I am familiar enough with USB/IP and is adequate as a reviewer. Every time there is some patch/bug, I wish I can get pinged and I will feedback on that. I had some contributions to USBIP and some support for it. Contribution: Commit 17af79321 ("docs: usbip: Fix major fields and descriptions in protocol") Commit b737eecd4 ("usbip: tools: add options and examples in man page related to device mode") Commit a58977b2f ("usbip: tools: add usage of device mode in usbip_list.c") Support: Commit 8f36b3b4e1 ("usbip: add USBIP_URB_* URB transfer flags") Bug report: https://lore.kernel.org/lkml/ZBHxfUX60EyCMw5l@Sun/ I also have implemented a userspace usbip server in https://github.com/canokeys/canokey-usbip and maintain a list of usbip implementations https://github.com/usbip/implementations Signed-off-by: Hongren (Zenithal) Zheng Acked-by: Shuah Khan Link: https://lore.kernel.org/r/ZBIBCRiFGSqQcOon@Sun Signed-off-by: Greg Kroah-Hartman commit cbebd68f59f03633469f3ecf9bea99cd6cce3854 Author: Nikita Zhandarovich Date: Mon Mar 6 08:06:56 2023 -0800 x86/mm: Fix use of uninitialized buffer in sme_enable() cmdline_find_option() may fail before doing any initialization of the buffer array. This may lead to unpredictable results when the same buffer is used later in calls to strncmp() function. Fix the issue by returning early if cmdline_find_option() returns an error. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: aca20d546214 ("x86/mm: Add support to make use of Secure Memory Encryption") Signed-off-by: Nikita Zhandarovich Signed-off-by: Borislav Petkov (AMD) Acked-by: Tom Lendacky Cc: Link: https://lore.kernel.org/r/20230306160656.14844-1-n.zhandarovich@fintech.ru commit 7ad2c39860dc0ca01d2152232224d2124e160fe3 Author: Yu Zhe Date: Thu Mar 16 16:39:54 2023 +0800 xen: remove unnecessary (void*) conversions Pointer variables of void * type do not require type cast. Signed-off-by: Yu Zhe Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230316083954.4223-1-yuzhe@nfschina.com Signed-off-by: Juergen Gross commit f551592f72563e119bdec5b9d5242f584111b2aa Merge: 06be62083c530 9db481c909dd6 Author: Greg Kroah-Hartman Date: Thu Mar 16 10:55:42 2023 +0100 Merge tag 'icc-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus Georgi writes: interconnect fixes for v6.3-rc This contains a bunch of fixes with the highlight being fixes for a race condition that could sometimes occur during the interconnect provider driver registration. There are also fixes for memory overallocation and a memory leak. - interconnect: qcom: osm-l3: fix icc_onecell_data allocation - interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function - interconnect: qcom: sm8550: switch to qcom_icc_rpmh_* function - interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT - interconnect: fix mem leak when freeing nodes - interconnect: fix icc_provider_del() error handling - interconnect: fix provider registration API - interconnect: imx: fix registration race - interconnect: qcom: osm-l3: fix registration race - interconnect: qcom: rpm: fix probe child-node error handling - interconnect: qcom: rpm: fix registration race - interconnect: qcom: rpmh: fix probe child-node error handling - interconnect: qcom: rpmh: fix registration race - interconnect: qcom: msm8974: fix registration race - interconnect: exynos: fix node leak in probe PM QoS error path - interconnect: exynos: fix registration race - interconnect: exynos: drop redundant link destroy - memory: tegra: fix interconnect registration race - memory: tegra124-emc: fix interconnect registration race - memory: tegra20-emc: fix interconnect registration race - memory: tegra30-emc: fix interconnect registration race Signed-off-by: Georgi Djakov * tag 'icc-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: (21 commits) memory: tegra30-emc: fix interconnect registration race memory: tegra20-emc: fix interconnect registration race memory: tegra124-emc: fix interconnect registration race memory: tegra: fix interconnect registration race interconnect: exynos: drop redundant link destroy interconnect: exynos: fix registration race interconnect: exynos: fix node leak in probe PM QoS error path interconnect: qcom: msm8974: fix registration race interconnect: qcom: rpmh: fix registration race interconnect: qcom: rpmh: fix probe child-node error handling interconnect: qcom: rpm: fix registration race interconnect: qcom: rpm: fix probe child-node error handling interconnect: qcom: osm-l3: fix registration race interconnect: imx: fix registration race interconnect: fix provider registration API interconnect: fix icc_provider_del() error handling interconnect: fix mem leak when freeing nodes interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT interconnect: qcom: sm8550: switch to qcom_icc_rpmh_* function interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function ... commit 5bc9e2d43f86105a95f86fa096fb4e517bb0ce73 Author: Ondrej Zary Date: Tue Mar 14 23:58:05 2023 +0100 ata: pata_parport: fix memory leaks When ida_alloc() fails, "pi" is not freed although the misleading comment says otherwise. Move the ida_alloc() call up so we really don't have to free "pi" in case of ida_alloc() failure. Also move ida_free() call from pi_remove_one() to pata_parport_dev_release(). It was dereferencing already freed dev pointer. Testing revealed leak even in non-failure case which was tracked down to missing put_device() call after bus_find_device_by_name(). As a result, pata_parport_dev_release() was never called. Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202303111822.IHNchbkp-lkp@intel.com/ Signed-off-by: Ondrej Zary Signed-off-by: Damien Le Moal commit a075bacde257f755bea0e53400c9f1cdd1b8e8e6 Author: Eric Biggers Date: Tue Mar 14 16:31:32 2023 -0700 fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY The full pagecache drop at the end of FS_IOC_ENABLE_VERITY is causing performance problems and is hindering adoption of fsverity. It was intended to solve a race condition where unverified pages might be left in the pagecache. But actually it doesn't solve it fully. Since the incomplete solution for this race condition has too much performance impact for it to be worth it, let's remove it for now. Fixes: 3fda4c617e84 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl") Cc: stable@vger.kernel.org Reviewed-by: Victor Hsieh Link: https://lore.kernel.org/r/20230314235332.50270-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit cd356010ce4c69ac7e1a40586112df24d22c6a4b Author: Vladimir Oltean Date: Tue Mar 14 17:30:25 2023 +0200 net: phy: mscc: fix deadlock in phy_ethtool_{get,set}_wol() Since the blamed commit, phy_ethtool_get_wol() and phy_ethtool_set_wol() acquire phydev->lock, but the mscc phy driver implementations, vsc85xx_wol_get() and vsc85xx_wol_set(), acquire the same lock as well, resulting in a deadlock. $ ip link set swp3 down ============================================ WARNING: possible recursive locking detected mscc_felix 0000:00:00.5 swp3: Link is Down -------------------------------------------- ip/375 is trying to acquire lock: ffff3d7e82e987a8 (&dev->lock){+.+.}-{4:4}, at: vsc85xx_wol_get+0x2c/0xf4 but task is already holding lock: ffff3d7e82e987a8 (&dev->lock){+.+.}-{4:4}, at: phy_ethtool_get_wol+0x3c/0x6c other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&dev->lock); lock(&dev->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by ip/375: #0: ffffd43b2a955788 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x144/0x58c #1: ffff3d7e82e987a8 (&dev->lock){+.+.}-{4:4}, at: phy_ethtool_get_wol+0x3c/0x6c Call trace: __mutex_lock+0x98/0x454 mutex_lock_nested+0x2c/0x38 vsc85xx_wol_get+0x2c/0xf4 phy_ethtool_get_wol+0x50/0x6c phy_suspend+0x84/0xcc phy_state_machine+0x1b8/0x27c phy_stop+0x70/0x154 phylink_stop+0x34/0xc0 dsa_port_disable_rt+0x2c/0xa4 dsa_slave_close+0x38/0xec __dev_close_many+0xc8/0x16c __dev_change_flags+0xdc/0x218 dev_change_flags+0x24/0x6c do_setlink+0x234/0xea4 __rtnl_newlink+0x46c/0x878 rtnl_newlink+0x50/0x7c rtnetlink_rcv_msg+0x16c/0x58c Removing the mutex_lock(&phydev->lock) calls from the driver restores the functionality. Fixes: 2f987d486610 ("net: phy: Add locks to ethtool functions") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230314153025.2372970-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7c10131803e45269ddc6c817f19ed649110f3cae Author: Shawn Bohrer Date: Tue Mar 14 10:33:51 2023 -0500 veth: Fix use after free in XDP_REDIRECT Commit 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") introduced a bug where it tried to use pskb_expand_head() if the headroom was less than XDP_PACKET_HEADROOM. This however uses kmalloc to expand the head, which will later allow consume_skb() to free the skb while is it still in use by AF_XDP. Previously if the headroom was less than XDP_PACKET_HEADROOM we continued on to allocate a new skb from pages so this restores that behavior. BUG: KASAN: use-after-free in __xsk_rcv+0x18d/0x2c0 Read of size 78 at addr ffff888976250154 by task napi/iconduit-g/148640 CPU: 5 PID: 148640 Comm: napi/iconduit-g Kdump: loaded Tainted: G O 6.1.4-cloudflare-kasan-2023.1.2 #1 Hardware name: Quanta Computer Inc. QuantaPlex T41S-2U/S2S-MB, BIOS S2S_3B10.03 06/21/2018 Call Trace: dump_stack_lvl+0x34/0x48 print_report+0x170/0x473 ? __xsk_rcv+0x18d/0x2c0 kasan_report+0xad/0x130 ? __xsk_rcv+0x18d/0x2c0 kasan_check_range+0x149/0x1a0 memcpy+0x20/0x60 __xsk_rcv+0x18d/0x2c0 __xsk_map_redirect+0x1f3/0x490 ? veth_xdp_rcv_skb+0x89c/0x1ba0 [veth] xdp_do_redirect+0x5ca/0xd60 veth_xdp_rcv_skb+0x935/0x1ba0 [veth] ? __netif_receive_skb_list_core+0x671/0x920 ? veth_xdp+0x670/0x670 [veth] veth_xdp_rcv+0x304/0xa20 [veth] ? do_xdp_generic+0x150/0x150 ? veth_xdp_rcv_one+0xde0/0xde0 [veth] ? _raw_spin_lock_bh+0xe0/0xe0 ? newidle_balance+0x887/0xe30 ? __perf_event_task_sched_in+0xdb/0x800 veth_poll+0x139/0x571 [veth] ? veth_xdp_rcv+0xa20/0xa20 [veth] ? _raw_spin_unlock+0x39/0x70 ? finish_task_switch.isra.0+0x17e/0x7d0 ? __switch_to+0x5cf/0x1070 ? __schedule+0x95b/0x2640 ? io_schedule_timeout+0x160/0x160 __napi_poll+0xa1/0x440 napi_threaded_poll+0x3d1/0x460 ? __napi_poll+0x440/0x440 ? __kthread_parkme+0xc6/0x1f0 ? __napi_poll+0x440/0x440 kthread+0x2a2/0x340 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Freed by task 148640: kasan_save_stack+0x23/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x169/0x1d0 slab_free_freelist_hook+0xd2/0x190 __kmem_cache_free+0x1a1/0x2f0 skb_release_data+0x449/0x600 consume_skb+0x9f/0x1c0 veth_xdp_rcv_skb+0x89c/0x1ba0 [veth] veth_xdp_rcv+0x304/0xa20 [veth] veth_poll+0x139/0x571 [veth] __napi_poll+0xa1/0x440 napi_threaded_poll+0x3d1/0x460 kthread+0x2a2/0x340 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888976250000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 340 bytes inside of 2048-byte region [ffff888976250000, ffff888976250800) The buggy address belongs to the physical page: page:00000000ae18262a refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x976250 head:00000000ae18262a order:3 compound_mapcount:0 compound_pincount:0 flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff) raw: 002ffff800010200 0000000000000000 dead000000000122 ffff88810004cf00 raw: 0000000000000000 0000000080080008 00000002ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888976250000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888976250080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888976250100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888976250180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888976250200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") Signed-off-by: Shawn Bohrer Acked-by: Lorenzo Bianconi Acked-by: Toshiaki Makita Acked-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20230314153351.2201328-1-sbohrer@cloudflare.com Signed-off-by: Jakub Kicinski commit ab00709310eedcd8dae0df1f66d332f9bc64c99e Author: Lars-Peter Clausen Date: Tue Mar 14 02:31:46 2023 -0700 hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip The ltc2992 drivers uses a mutex and I2C bus access in its GPIO chip `set` and `get` implementation. This means these functions can sleep and the GPIO chip should set the `can_sleep` property to true. This will ensure that a warning is printed when trying to set or get the GPIO value from a context that potentially can't sleep. Fixes: 9ca26df1ba25 ("hwmon: (ltc2992) Add support for GPIOs.") Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20230314093146.2443845-2-lars@metafoo.de Signed-off-by: Guenter Roeck commit a5bb73b3f5db1a4e91402ad132b59b13d2651ed9 Author: Lars-Peter Clausen Date: Tue Mar 14 02:31:45 2023 -0700 hwmon: (adm1266) Set `can_sleep` flag for GPIO chip The adm1266 driver uses I2C bus access in its GPIO chip `set` and `get` implementation. This means these functions can sleep and the GPIO chip should set the `can_sleep` property to true. This will ensure that a warning is printed when trying to set or get the GPIO value from a context that potentially can't sleep. Fixes: d98dfad35c38 ("hwmon: (pmbus/adm1266) Add support for GPIOs") Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20230314093146.2443845-1-lars@metafoo.de Signed-off-by: Guenter Roeck commit 6acd352dfee558194643adbed7e849fe80fd1b93 Author: Li zeming Date: Sat Mar 18 02:25:38 2023 +0800 io_uring: rsrc: Optimize return value variable 'ret' The initialization assignment of the variable ret is changed to 0, only in 'goto fail;' Use the ret variable as the function return value. Signed-off-by: Li zeming Link: https://lore.kernel.org/r/20230317182538.3027-1-zeming@nfschina.com Signed-off-by: Jens Axboe commit c7b7c64ab5821352db0b3fbaa92773e5a60bfaa7 Author: Oz Shlomo Date: Wed Feb 22 10:03:36 2023 +0000 net/mlx5e: TC, Remove error message log print The cited commit attempts to update the hw stats when dumping tc actions. However, the driver may be called to update the stats of a police action that may not be in hardware. In such cases the driver will fail to lookup the police action object and will output an error message both to extack and dmesg. The dmesg error is confusing as it may not indicate an actual error. Remove the dmesg error. Fixes: 2b68d659a704 ("net/mlx5e: TC, support per action stats") Signed-off-by: Oz Shlomo Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit b23bf10cca59b2955fa5c2b5e4f753962b4f88ca Author: Oz Shlomo Date: Tue Feb 21 15:24:39 2023 +0000 net/mlx5e: TC, fix cloned flow attribute Currently the cloned flow attr resets the original tc action cookies count. Fix that by resetting the cloned flow attribute. Fixes: cca7eac13856 ("net/mlx5e: TC, store tc action cookies per attr") Signed-off-by: Oz Shlomo Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 1166add424dae14ccdb64a6eefbf26766c9d0ef2 Author: Oz Shlomo Date: Tue Feb 21 14:46:56 2023 +0000 net/mlx5e: TC, fix missing error code Missing error code when mlx5e_tc_act_stats_create fails Fixes: d13674b1d14c ("net/mlx5e: TC, map tc action cookie to a hw counter") Reported-by: Dan Carpenter Signed-off-by: Oz Shlomo Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit d1a0075ad6b693c2bd41e7aedb8a4f3b74b6999c Author: Oz Shlomo Date: Thu Feb 16 12:34:21 2023 +0000 net/sched: TC, fix raw counter initialization Freed counters may be reused by fs core. As such, raw counters may not be initialized to zero. Cache the counter values when the action stats object is initialized to have a proper base value for calculating the difference from the previous query. Fixes: 2b68d659a704 ("net/mlx5e: TC, support per action stats") Signed-off-by: Oz Shlomo Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 78dee7befd56987283c13877b834c0aa97ad51b9 Author: Adham Faris Date: Mon Jan 23 10:09:01 2023 +0200 net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites XSK redirecting XDP programs require linearity, hence applies restrictions on the MTU. For PAGE_SIZE=4K, MTU shouldn't exceed 3498. Features that contradict with XDP such HW-LRO and HW-GRO are enforced by the driver in advance, during XSK params validation, except for MTU, which was not enforced before this patch. This has been spotted during test scenario described below: Attaching xdpsock program (PAGE_SIZE=4K), with MTU < 3498, detaching XDP program, changing the MTU to arbitrary value in the range [3499, 3754], attaching XDP program again, which ended up with failure since MTU is > 3498. This commit lowers the XSK MTU limitation to be aligned with XDP MTU limitation, since XSK socket is meaningless without XDP program. Signed-off-by: Adham Faris Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 031a163f2c476adcb2c01e27a7d323e66174ac11 Author: Shay Drory Date: Tue Feb 28 10:36:19 2023 +0200 net/mlx5: Set BREAK_FW_WAIT flag first when removing driver Currently, BREAK_FW_WAIT flag is set after syncing with fw_reset. However, fw_reset can call mlx5_load_one() which is waiting for fw init bit and BREAK_FW_WAIT flag is intended to stop. e.g.: the driver might wait on a loop it should exit. Fix it by setting the flag before syncing with fw_reset. Fixes: 8324a02c342a ("net/mlx5: Add exit route when waiting for FW") Signed-off-by: Shay Drory Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit dd64572490c3d7aab04083db8791fab157a941ed Author: Gal Pressman Date: Tue Jan 24 17:34:32 2023 +0200 net/mlx5e: kTLS, Fix missing error unwind on unsupported cipher type Do proper error unwinding when adding an unsupported TX/RX cipher type. Move the switch case prior to key creation so there's less to unwind, and change the goto label name to describe the action performed instead of what failed. Fixes: 4960c414db35 ("net/mlx5e: Support 256 bit keys with kTLS device offload") Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit c9668f0b1d28570327dbba189f2c61f6f9e43ae7 Author: Paul Blakey Date: Sun Feb 12 11:01:43 2023 +0200 net/mlx5e: Fix cleanup null-ptr deref on encap lock During module is unloaded while a peer tc flow is still offloaded, first the peer uplink rep profile is changed to a nic profile, and so neigh encap lock is destroyed. Next during unload, the VF reps netdevs are unregistered which causes the original non-peer tc flow to be deleted, which deletes the peer flow. The peer flow deletion detaches the encap entry and try to take the already destroyed encap lock, causing the below trace. Fix this by clearing peer flows during tc eswitch cleanup (mlx5e_tc_esw_cleanup()). Relevant trace: [ 4316.837128] BUG: kernel NULL pointer dereference, address: 00000000000001d8 [ 4316.842239] RIP: 0010:__mutex_lock+0xb5/0xc40 [ 4316.851897] Call Trace: [ 4316.852481] [ 4316.857214] mlx5e_rep_neigh_entry_release+0x93/0x790 [mlx5_core] [ 4316.858258] mlx5e_rep_encap_entry_detach+0xa7/0xf0 [mlx5_core] [ 4316.859134] mlx5e_encap_dealloc+0xa3/0xf0 [mlx5_core] [ 4316.859867] clean_encap_dests.part.0+0x5c/0xe0 [mlx5_core] [ 4316.860605] mlx5e_tc_del_fdb_flow+0x32a/0x810 [mlx5_core] [ 4316.862609] __mlx5e_tc_del_fdb_peer_flow+0x1a2/0x250 [mlx5_core] [ 4316.863394] mlx5e_tc_del_flow+0x(/0x630 [mlx5_core] [ 4316.864090] mlx5e_flow_put+0x5f/0x100 [mlx5_core] [ 4316.864771] mlx5e_delete_flower+0x4de/0xa40 [mlx5_core] [ 4316.865486] tc_setup_cb_reoffload+0x20/0x80 [ 4316.865905] fl_reoffload+0x47c/0x510 [cls_flower] [ 4316.869181] tcf_block_playback_offloads+0x91/0x1d0 [ 4316.869649] tcf_block_unbind+0xe7/0x1b0 [ 4316.870049] tcf_block_offload_cmd.isra.0+0x1ee/0x270 [ 4316.879266] tcf_block_offload_unbind+0x61/0xa0 [ 4316.879711] __tcf_block_put+0xa4/0x310 Fixes: 04de7dda7394 ("net/mlx5e: Infrastructure for duplicated offloading of TC flows") Fixes: 1418ddd96afd ("net/mlx5e: Duplicate offloaded TC eswitch rules under uplink LAG") Signed-off-by: Paul Blakey Reviewed-by: Chris Mi Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 28d3815a629cbdee660dd1c9de28d77cb3d77917 Author: Maor Dickman Date: Wed Feb 8 11:37:41 2023 +0200 net/mlx5: E-switch, Fix missing set of split_count when forward to ovs internal port Rules with mirror actions are split to two FTEs when the actions after the mirror action contains pedit, vlan push/pop or ct. Forward to ovs internal port adds implicit header rewrite (pedit) but missing trigger to do split. Fix by setting split_count when forwarding to ovs internal port which will trigger split in mirror rules. Fixes: 27484f7170ed ("net/mlx5e: Offload tc rules that redirect to ovs internal port") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 1313d78ac0c1cfcff7bdece8da54b080e71487c4 Author: Maor Dickman Date: Tue Feb 7 15:07:00 2023 +0200 net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules In few cases, rules with mirror use case are split to two FTEs, one which do the mirror action and forward to second FTE which do the rest of the rule actions and the second redirect action. In case of mirror rules which do split and forward to ovs internal port or VF stack devices, source port rewrite should be used in the second FTE but it is wrongly also set in the first FTE which break the offload. Fix this issue by removing the wrong check if source port rewrite is needed to be used on the first FTE of the split and instead return EOPNOTSUPP which will block offload of rules which mirror to ovs internal port or VF stack devices which isn't supported. Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading") Fixes: a508728a4c8b ("net/mlx5e: VF tunnel RX traffic offloading") Signed-off-by: Maor Dickman Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 7ba930fc25def6fd736abcdfa224272948a65cf7 Author: Daniel Jurgens Date: Thu Oct 20 00:13:50 2022 +0300 net/mlx5: Disable eswitch before waiting for VF pages The offending commit changed the ordering of moving to legacy mode and waiting for the VF pages. Moving to legacy mode is important in bluefield, because it sends the host driver into error state, and frees its pages. Without this transition we end up waiting 2 minutes for pages that aren't coming before carrying on with the unload process. Fixes: f019679ea5f2 ("net/mlx5: E-switch, Remove dependency between sriov and eswitch mode") Signed-off-by: Daniel Jurgens Signed-off-by: Saeed Mahameed commit ba5d8f72b82cc197355c9340ef89dab813815865 Author: Parav Pandit Date: Thu Jun 24 18:22:57 2021 +0300 net/mlx5: Fix setting ec_function bit in MANAGE_PAGES When ECPF is a page supplier, reclaim pages missed to honor the ec_function bit provided by the firmware. It always used the ec_function to true during driver unload flow for ECPF. This is incorrect. Honor the ec_function bit provided by device during page allocation request event. Fixes: d6945242f45d ("net/mlx5: Hold pages RB tree per VF") Signed-off-by: Parav Pandit Signed-off-by: Daniel Jurgens Signed-off-by: Saeed Mahameed commit 9a92fe1db9e57ea94388a1d768e8ee42af858377 Author: Parav Pandit Date: Fri Mar 12 07:21:29 2021 -0600 net/mlx5e: Don't cache tunnel offloads capability When mlx5e attaches again after device health recovery, the device capabilities might have changed by the eswitch manager. For example in one flow when ECPF changes the eswitch mode between legacy and switchdev, it updates the flow table tunnel capability. The cached value is only used in one place, so just check the capability there instead. Fixes: 5bef709d76a2 ("net/mlx5: Enable host PF HCA after eswitch is initialized") Signed-off-by: Parav Pandit Signed-off-by: Daniel Jurgens Signed-off-by: Saeed Mahameed commit 37beabe9a891b92174cd1aafbfa881fe9e05aa87 Author: Emeel Hakim Date: Wed Feb 8 14:25:54 2023 +0200 net/mlx5e: Fix macsec ASO context alignment Currently mlx5e_macsec_umr struct does not satisfy hardware memory alignment requirement. Hence the result of querying advanced steering operation (ASO) is not copied to the memory region as expected. Fix by satisfying hardware memory alignment requirement and move context to be first field in struct for better readability. Fixes: 1f53da676439 ("net/mlx5e: Create advanced steering operation (ASO) object for MACsec") Signed-off-by: Emeel Hakim Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit f3921a9a641483784448fb982b2eb738b383d9b9 Author: Felix Kuehling Date: Mon Mar 13 20:03:08 2023 -0400 drm/amdgpu: Don't resume IOMMU after incomplete init Check kfd->init_complete in kgd2kfd_iommu_resume, consistent with other kgd2kfd calls. This should fix IOMMU errors on resume from suspend when KFD IOMMU initialization failed. Reported-by: Matt Fagnani Link: https://lore.kernel.org/r/4a3b225c-2ffd-e758-4de1-447375e34cad@bell.net/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=217170 Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2454 Cc: Vasant Hegde Cc: Linux regression tracking (Thorsten Leemhuis) Cc: stable@vger.kernel.org Signed-off-by: Felix Kuehling Acked-by: Alex Deucher Tested-by: Matt Fagnani Signed-off-by: Alex Deucher commit 20bc9f76b6a2455c6b54b91ae7634f147f64987f Author: David Belanger Date: Tue Feb 28 14:11:24 2023 -0500 drm/amdkfd: Fixed kfd_process cleanup on module exit. Handle case when module is unloaded (kfd_exit) before a process space (mm_struct) is released. v2: Fixed potential race conditions by removing all kfd_process from the process table first, then working on releasing the resources. v3: Fixed loop element access / synchronization. Fixed extra empty lines. Signed-off-by: David Belanger Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 0424a7dfe9129b93f29b277511a60e87f052ac6b Author: Shawn Wang Date: Tue Jan 17 13:14:50 2023 -0800 x86/resctrl: Clear staged_config[] before and after it is used As a temporary storage, staged_config[] in rdt_domain should be cleared before and after it is used. The stale value in staged_config[] could cause an MSR access error. Here is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3 Cache (MBA should be disabled if the number of CLOSIDs for MB is less than 16.) : mount -t resctrl resctrl -o cdp /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..7} umount /sys/fs/resctrl/ mount -t resctrl resctrl /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..8} An error occurs when creating resource group named p8: unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60) Call Trace: __flush_smp_call_function_queue+0x11d/0x170 __sysvec_call_function+0x24/0xd0 sysvec_call_function+0x89/0xc0 asm_sysvec_call_function+0x16/0x20 When creating a new resource control group, hardware will be configured by the following process: rdtgroup_mkdir() rdtgroup_mkdir_ctrl_mon() rdtgroup_init_alloc() resctrl_arch_update_domains() resctrl_arch_update_domains() iterates and updates all resctrl_conf_type whose have_new_ctrl is true. Since staged_config[] holds the same values as when CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA configurations. When group p8 is created, get_config_index() called in resctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for CDP_CODE and CDP_DATA, which will be translated to an invalid register - 0xca0 in this scenario. Fix it by clearing staged_config[] before and after it is used. [reinette: re-order commit tags] Fixes: 75408e43509e ("x86/resctrl: Allow different CODE/DATA configurations to be staged") Suggested-by: Xin Hao Signed-off-by: Shawn Wang Signed-off-by: Reinette Chatre Signed-off-by: Dave Hansen Tested-by: Reinette Chatre Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/2fad13f49fbe89687fc40e9a5a61f23a28d1507a.1673988935.git.reinette.chatre%40intel.com commit 7304ee979b6b6422f41a1312391a5e505fc29ccd Author: Ayush Gupta Date: Thu Mar 2 09:58:05 2023 -0500 drm/amd/display: disconnect MPCC only on OTG change [Why] Framedrops are observed while playing Vp9 and Av1 10 bit video on 8k resolution using VSR while playback controls are disappeared/appeared [How] Now ODM 2 to 1 is disabled for 5k or greater resolutions on VSR. Cc: stable@vger.kernel.org Cc: Mario Limonciello Reviewed-by: Alvin Lee Acked-by: Qingqing Zhuo Signed-off-by: Ayush Gupta Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit cbd6c1b17d3b42b7935526a86ad5f66838767d03 Author: Cruise Hung Date: Thu Mar 2 10:33:51 2023 +0800 drm/amd/display: Fix DP MST sinks removal issue [Why] In USB4 DP tunneling, it's possible to have this scenario that the path becomes unavailable and CM tears down the path a little bit late. So, in this case, the HPD is high but fails to read any DPCD register. That causes the link connection type to be set to sst. And not all sinks are removed behind the MST branch. [How] Restore the link connection type if it fails to read DPCD register. Cc: stable@vger.kernel.org Cc: Mario Limonciello Reviewed-by: Wenjing Liu Acked-by: Qingqing Zhuo Signed-off-by: Cruise Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 56574f89dbd84004c3fd6485bcaafb5aa9b8be14 Author: Wesley Chalmers Date: Thu Nov 3 22:29:31 2022 -0400 drm/amd/display: Do not set DRR on pipe Commit [WHY] Writing to DRR registers such as OTG_V_TOTAL_MIN on the same frame as a pipe commit can cause underflow. Cc: stable@vger.kernel.org Cc: Mario Limonciello Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Wesley Chalmers Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 709671ffb15dcd1b4f6afe2a9d8c67c7c4ead4a1 Author: Saaem Rizvi Date: Mon Feb 27 18:55:07 2023 -0500 drm/amd/display: Remove OTG DIV register write for Virtual signals. [WHY] Hot plugging and then hot unplugging leads to k1 and k2 values to change, as signal is detected as a virtual signal on hot unplug. Writing these values to OTG_PIXEL_RATE_DIV register might cause primary display to blank (known hw bug). [HOW] No longer write k1 and k2 values to register if signal is virtual, we have safe guards in place in the case that k1 and k2 is unassigned so that an unknown value is not written to the register either. Cc: stable@vger.kernel.org Cc: Mario Limonciello Reviewed-by: Samson Tam Reviewed-by: Alvin Lee Acked-by: Qingqing Zhuo Signed-off-by: Saaem Rizvi Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fd0815f632c24878e325821943edccc7fde947a2 Author: Budimir Markovic Date: Wed Mar 15 00:29:01 2023 -0700 perf: Fix check before add_event_to_groups() in perf_group_detach() Events should only be added to a groups rb tree if they have not been removed from their context by list_del_event(). Since remove_on_exec made it possible to call list_del_event() on individual events before they are detached from their group, perf_group_detach() should check each sibling's attach_state before calling add_event_to_groups() on it. Fixes: 2e498d0a74e5 ("perf: Add support for event removal on exec") Signed-off-by: Budimir Markovic Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/ZBFzvQV9tEqoHEtH@gentoo commit baf1b12a67f5b24f395baca03e442ce27cab0c18 Author: Song Liu Date: Mon Mar 13 10:16:08 2023 -0700 perf: fix perf_event_context->time Time readers rely on perf_event_context->[time|timestamp|timeoffset] to get accurate time_enabled and time_running for an event. The difference between ctx->timestamp and ctx->time is the among of time when the context is not enabled. __update_context_time(ctx, false) is used to increase timestamp, but not time. Therefore, it should only be called in ctx_sched_in() when EVENT_TIME was not enabled. Fixes: 09f5e7dc7ad7 ("perf: Fix perf_event_read_local() time") Signed-off-by: Song Liu Signed-off-by: Peter Zijlstra (Intel) Acked-by: Namhyung Kim Link: https://lkml.kernel.org/r/20230313171608.298734-1-song@kernel.org commit eb81a2ed4f52be831c9fb879752d89645a312c13 Author: Yang Jihong Date: Tue Mar 14 04:47:35 2023 +0000 perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output syzkaller reportes a KASAN issue with stack-out-of-bounds. The call trace is as follows: dump_stack+0x9c/0xd3 print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 __perf_event_header__init_id+0x34/0x290 perf_event_header__init_id+0x48/0x60 perf_output_begin+0x4a4/0x560 perf_event_bpf_output+0x161/0x1e0 perf_iterate_sb_cpu+0x29e/0x340 perf_iterate_sb+0x4c/0xc0 perf_event_bpf_event+0x194/0x2c0 __bpf_prog_put.constprop.0+0x55/0xf0 __cls_bpf_delete_prog+0xea/0x120 [cls_bpf] cls_bpf_delete_prog_work+0x1c/0x30 [cls_bpf] process_one_work+0x3c2/0x730 worker_thread+0x93/0x650 kthread+0x1b8/0x210 ret_from_fork+0x1f/0x30 commit 267fb27352b6 ("perf: Reduce stack usage of perf_output_begin()") use on-stack struct perf_sample_data of the caller function. However, perf_event_bpf_output uses incorrect parameter to convert small-sized data (struct perf_bpf_event) into large-sized data (struct perf_sample_data), which causes memory overwriting occurs in __perf_event_header__init_id. Fixes: 267fb27352b6 ("perf: Reduce stack usage of perf_output_begin()") Signed-off-by: Yang Jihong Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230314044735.56551-1-yangjihong1@huawei.com commit e15acc25880cf048dba9df94d76ed7e7e10040e6 Author: Naohiro Aota Date: Mon Mar 13 16:06:14 2023 +0900 btrfs: zoned: drop space_info->active_total_bytes The space_info->active_total_bytes is no longer necessary as we now count the region of newly allocated block group as zone_unusable. Drop its usage. Fixes: 6a921de58992 ("btrfs: zoned: introduce space_info->active_total_bytes") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit fa2068d7e922b434eba5bfb0131e6d39febfdb48 Author: Naohiro Aota Date: Mon Mar 13 16:06:13 2023 +0900 btrfs: zoned: count fresh BG region as zone unusable The naming of space_info->active_total_bytes is misleading. It counts not only active block groups but also full ones which are previously active but now inactive. That confusion results in a bug not counting the full BGs into active_total_bytes on mount time. For a background, there are three kinds of block groups in terms of activation. 1. Block groups never activated 2. Block groups currently active 3. Block groups previously active and currently inactive (due to fully written or zone finish) What we really wanted to exclude from "total_bytes" is the total size of BGs #1. They seem empty and allocatable but since they are not activated, we cannot rely on them to do the space reservation. And, since BGs #1 never get activated, they should have no "used", "reserved" and "pinned" bytes. OTOH, BGs #3 can be counted in the "total", since they are already full we cannot allocate from them anyway. For them, "total_bytes == used + reserved + pinned + zone_unusable" should hold. Tracking #2 and #3 as "active_total_bytes" (current implementation) is confusing. And, tracking #1 and subtract that properly from "total_bytes" every time you need space reservation is cumbersome. Instead, we can count the whole region of a newly allocated block group as zone_unusable. Then, once that block group is activated, release [0 .. zone_capacity] from the zone_unusable counters. With this, we can eliminate the confusing ->active_total_bytes and the code will be common among regular and the zoned mode. Also, no additional counter is needed with this approach. Fixes: 6a921de58992 ("btrfs: zoned: introduce space_info->active_total_bytes") CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit df384da5a49cace5c5e3100803dfd563fd982f93 Author: Josef Bacik Date: Wed Mar 1 16:14:43 2023 -0500 btrfs: use temporary variable for space_info in btrfs_update_block_group We do cache->space_info->counter += num_bytes; everywhere in here. This is makes the lines longer than they need to be, and will be especially noticeable when we add the active tracking in, so add a temp variable for the space_info so this is cleaner. Reviewed-by: Naohiro Aota Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit bf1f1fec2724a33b67ec12032402ea75f2a83622 Author: Josef Bacik Date: Wed Mar 1 16:14:42 2023 -0500 btrfs: rename BTRFS_FS_NO_OVERCOMMIT to BTRFS_FS_ACTIVE_ZONE_TRACKING This flag only gets set when we're doing active zone tracking, and we're going to need to use this flag for things related to this behavior. Rename the flag to represent what it actually means for the file system so it can be used in other ways and still make sense. Reviewed-by: Naohiro Aota Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9e1cdf0c354e46e428c0e0cab008abbe81b6013d Author: Naohiro Aota Date: Mon Mar 13 16:29:49 2023 +0900 btrfs: zoned: fix btrfs_can_activate_zone() to support DUP profile btrfs_can_activate_zone() returns true if at least one device has one zone available for activation. This is OK for the single profile, but not OK for DUP profile. We need two zones to create a DUP block group. Fix it by properly handling the case with the profile flags. Fixes: 265f7237dd25 ("btrfs: zoned: allow DUP on meta-data block groups") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit 10a8857a1beaa015efba7d56e06243d484549fb6 Author: Sweet Tea Dorminy Date: Wed Mar 8 10:58:36 2023 -0500 btrfs: fix compiler warning on SPARC/PA-RISC handling fscrypt_setup_filename Commit 1ec49744ba83 ("btrfs: turn on -Wmaybe-uninitialized") exposed that on SPARC and PA-RISC, gcc is unaware that fscrypt_setup_filename() only returns negative error values or 0. This ultimately results in a maybe-uninitialized warning in btrfs_lookup_dentry(). Change to only return negative error values or 0 from fscrypt_setup_filename() at the relevant call site, and assert that no positive error codes are returned (which would have wider implications involving other users). Reported-by: Guenter Roeck Link: https://lore.kernel.org/all/481b19b5-83a0-4793-b4fd-194ad7b978c3@roeck-us.net/ Signed-off-by: Sweet Tea Dorminy Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c3ab6dfa0692c3626580a508cf84e794201b357 Author: Qu Wenruo Date: Thu Mar 2 09:54:12 2023 +0800 btrfs: handle missing chunk mapping more gracefully [BUG] During my scrub rework, I did a stupid thing like this: bio->bi_iter.bi_sector = stripe->logical; btrfs_submit_bio(fs_info, bio, stripe->mirror_num); Above bi_sector assignment is using logical address directly, which lacks ">> SECTOR_SHIFT". This results a read on a range which has no chunk mapping. This results the following crash: BTRFS critical (device dm-1): unable to find logical 11274289152 length 65536 assertion failed: !IS_ERR(em), in fs/btrfs/volumes.c:6387 Sure this is all my fault, but this shows a possible problem in real world, that some bit flip in file extents/tree block can point to unmapped ranges, and trigger above ASSERT(), or if CONFIG_BTRFS_ASSERT is not configured, cause invalid pointer access. [PROBLEMS] In the above call chain, we just don't handle the possible error from btrfs_get_chunk_map() inside __btrfs_map_block(). [FIX] The fix is straightforward, replace the ASSERT() with proper error handling (callers handle errors already). Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 9c1bec9c0b08abeac72ed6214b723adc224013bf Merge: 6015b1aca1a23 624c60f326c6e Author: Linus Torvalds Date: Wed Mar 15 12:20:37 2023 -0700 Merge tag 'linux-kselftest-fixes-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "A fix to amd-pstate test Makefile and a fix to LLVM build for x86 in kselftest common lib.mk" * tag 'linux-kselftest-fixes-6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: fix LLVM build for i386 and x86_64 selftests: amd-pstate: fix TEST_FILES commit 23e5b9307ede26e37c5a97f91d0b7f3f86c4182b Merge: 5f27571382ca4 6c0f5898836c0 Author: Jens Axboe Date: Wed Mar 15 12:18:07 2023 -0600 Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.3 Pull MD fixes from Song: "This set contains two fixes for old issues (by Neil) and one fix for 6.3 (by Xiao)." * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md: select BLOCK_LEGACY_AUTOLOAD md: avoid signed overflow in slot_store() md: Free resources in __md_stop commit 6c0f5898836c05c6d850a750ed7940ba29e4e6c5 Author: NeilBrown Date: Mon Mar 13 13:29:17 2023 -0700 md: select BLOCK_LEGACY_AUTOLOAD When BLOCK_LEGACY_AUTOLOAD is not enable, mdadm is not able to activate new arrays unless "CREATE names=yes" appears in mdadm.conf As this is a regression we need to always enable BLOCK_LEGACY_AUTOLOAD for when MD is selected - at least until mdadm is updated and the updates widely available. Cc: stable@vger.kernel.org # v5.18+ Fixes: fbdee71bb5d8 ("block: deprecate autoloading based on dev_t") Signed-off-by: NeilBrown Signed-off-by: Song Liu commit 5f27571382ca42daa3e3d40d1b252bf18c2b61d2 Author: Yu Kuai Date: Thu Feb 23 17:12:26 2023 +0800 block: count 'ios' and 'sectors' when io is done for bio-based device While using iostat for raid, I observed very strange 'await' occasionally, and turns out it's due to that 'ios' and 'sectors' is counted in bdev_start_io_acct(), while 'nsecs' is counted in bdev_end_io_acct(). I'm not sure why they are ccounted like that but I think this behaviour is obviously wrong because user will get wrong disk stats. Fix the problem by counting 'ios' and 'sectors' when io is done, like what rq-based device does. Fixes: 394ffa503bc4 ("blk: introduce generic io stat accounting help function") Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230223091226.1135678-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 6030363199e3a6341afb467ddddbed56640cbf6a Author: Liang He Date: Wed Mar 15 14:20:32 2023 +0800 block: sunvdc: add check for mdesc_grab() returning NULL In vdc_port_probe(), we should check the return value of mdesc_grab() as it may return NULL, which can cause potential NPD bug. Fixes: 43fdf27470b2 ("[SPARC64]: Abstract out mdesc accesses for better MD update handling.") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20230315062032.1741692-1-windhl@126.com [axboe: style cleanup] Signed-off-by: Jens Axboe commit 7c3940bf81e5664cdb50c3fedfec8f0a756a34fb Author: GuoRui.Yu Date: Thu Feb 23 00:53:15 2023 +0800 swiotlb: fix the deadlock in swiotlb_do_find_slots In general, if swiotlb is sufficient, the logic of index = wrap_area_index(mem, index + 1) is fine, it will quickly take a slot and release the area->lock; But if swiotlb is insufficient and the device has min_align_mask requirements, such as NVME, we may not be able to satisfy index == wrap and exit the loop properly. In this case, other kernel threads will not be able to acquire the area->lock and release the slot, resulting in a deadlock. The current implementation of wrap_area_index does not involve a modulo operation, so adjusting the wrap to ensure the loop ends is not trivial. Introduce a new variable to record the number of loops and exit the loop after completing the traversal. Backtraces: Other CPUs are waiting this core to exit the swiotlb_do_find_slots loop. [10199.924391] RIP: 0010:swiotlb_do_find_slots+0x1fe/0x3e0 [10199.924403] Call Trace: [10199.924404] [10199.924405] swiotlb_tbl_map_single+0xec/0x1f0 [10199.924407] swiotlb_map+0x5c/0x260 [10199.924409] ? nvme_pci_setup_prps+0x1ed/0x340 [10199.924411] dma_direct_map_page+0x12e/0x1c0 [10199.924413] nvme_map_data+0x304/0x370 [10199.924415] nvme_prep_rq.part.0+0x31/0x120 [10199.924417] nvme_queue_rq+0x77/0x1f0 ... [ 9639.596311] NMI backtrace for cpu 48 [ 9639.596336] Call Trace: [ 9639.596337] [ 9639.596338] _raw_spin_lock_irqsave+0x37/0x40 [ 9639.596341] swiotlb_do_find_slots+0xef/0x3e0 [ 9639.596344] swiotlb_tbl_map_single+0xec/0x1f0 [ 9639.596347] swiotlb_map+0x5c/0x260 [ 9639.596349] dma_direct_map_sg+0x7a/0x280 [ 9639.596352] __dma_map_sg_attrs+0x30/0x70 [ 9639.596355] dma_map_sgtable+0x1d/0x30 [ 9639.596356] nvme_map_data+0xce/0x370 ... [ 9639.595665] NMI backtrace for cpu 50 [ 9639.595682] Call Trace: [ 9639.595682] [ 9639.595683] _raw_spin_lock_irqsave+0x37/0x40 [ 9639.595686] swiotlb_release_slots.isra.0+0x86/0x180 [ 9639.595688] dma_direct_unmap_sg+0xcf/0x1a0 [ 9639.595690] nvme_unmap_data.part.0+0x43/0xc0 Fixes: 1f221a0d0dbf ("swiotlb: respect min_align_mask") Signed-off-by: GuoRui.Yu Signed-off-by: Xiaokang Hu Signed-off-by: Christoph Hellwig commit 6173a77b7e9d3e202bdb9897b23f2a8afe7bf286 Author: Damien Le Moal Date: Mon Mar 6 10:13:13 2023 +0900 nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete(). Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call. Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") Signed-off-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 8e19b87cfce2de2125f11363d7dea3d08f16ccae Author: Minwoo Im Date: Thu Mar 9 23:31:18 2023 +0900 nvme-trace: show more opcode names We have more commands to show in the trace. Sync up. Signed-off-by: Minwoo Im Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 7e87965d3807ab1f518ef2365f91d5ba6b0c5abe Author: Sagi Grimberg Date: Mon Mar 13 10:56:23 2023 +0200 nvme-tcp: add nvme-tcp pdu size build protection Make sure that we don't somehow mess up the wire structures in the spec. Signed-off-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit a3406352c54fbc476f4f6b98159c3ea1c7dbb6fc Author: Sagi Grimberg Date: Mon Mar 13 10:56:22 2023 +0200 nvme-tcp: fix opcode reporting in the timeout handler For non in-capsule writes we reuse the request pdu space for a h2cdata pdu in order to avoid over allocating space (either preallocate or dynamically upon receving an r2t pdu). However if the request times out the core expects to find the opcode in the start of the request, which we override. In order to prevent that, without sacrificing additional 24 bytes per request, we just use the tail of the command pdu space instead (last 24 bytes from the 72 bytes command pdu). That should make the command opcode always available, and we get away from allocating more space. If in the future we would need the last 24 bytes of the nvme command available we would need to allocate a dedicated space for it in the request, but until then we can avoid doing so. Reported-by: Akinobu Mita Signed-off-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Tested-by: Akinobu Mita Signed-off-by: Christoph Hellwig commit b65d44fa0fe072c91bf41cd8756baa2b4c77eff2 Author: Philipp Geulen Date: Mon Mar 13 11:11:50 2023 +0100 nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 Added a quirk to fix Lexar NM620 1TB SSD reporting duplicate NGUIDs. Signed-off-by: Philipp Geulen Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 9630d80655bfe7e62e4aff2889dc4eae7ceeb887 Author: Elmer Miroslav Mosher Golovin Date: Wed Mar 8 19:19:29 2023 +0300 nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000 Added a quirk to fix the Netac NV3000 SSD reporting duplicate NGUIDs. Cc: Signed-off-by: Elmer Miroslav Mosher Golovin Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit a61d265533b7fe0026a02a49916aa564ffe38e4c Author: Irvin Cote Date: Wed Mar 8 18:05:08 2023 -0300 nvme-pci: fixing memory leak in probe teardown path In case the nvme_probe teardown path is triggered the ctrl ref count does not reach 0 thus creating a memory leak upon failure of nvme_probe. Signed-off-by: Irvin Cote Signed-off-by: Christoph Hellwig commit 37f0dc2ec78af0c3f35dd05578763de059f6fe77 Author: Ming Lei Date: Sat Mar 4 07:13:45 2023 +0800 nvme: fix handling single range discard request When investigating one customer report on warning in nvme_setup_discard, we observed the controller(nvme/tcp) actually exposes queue_max_discard_segments(req->q) == 1. Obviously the current code can't handle this situation, since contiguity merge like normal RW request is taken. Fix the issue by building range from request sector/nr_sectors directly. Fixes: b35ba01ea697 ("nvme: support ranged discard requests") Signed-off-by: Ming Lei Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 54686b611eb054a5c84976e6f6e03788fa8e6a38 Author: Lukas Bulwahn Date: Wed Mar 8 15:41:32 2023 +0100 MAINTAINERS: repair malformed T: entries in NVM EXPRESS DRIVERS The T: entries shall be composed of a SCM tree type (git, hg, quilt, stgit or topgit) and location. Add the SCM tree type to the T: entry, and reorder the file entries in alphabetical order. Fixes: b508fc354f6d ("nvme: update maintainers information") Signed-off-by: Lukas Bulwahn Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig commit a5fc1441af7719e93dc7a638a960befb694ade89 Author: Michal Koutný Date: Tue Mar 14 19:33:32 2023 +0100 io_uring/sqpoll: Do not set PF_NO_SETAFFINITY on sqpoll threads Users may specify a CPU where the sqpoll thread would run. This may conflict with cpuset operations because of strict PF_NO_SETAFFINITY requirement. That flag is unnecessary for polling "kernel" threads, see the reasoning in commit 01e68ce08a30 ("io_uring/io-wq: stop setting PF_NO_SETAFFINITY on io-wq workers"). Drop the flag on poll threads too. Fixes: 01e68ce08a30 ("io_uring/io-wq: stop setting PF_NO_SETAFFINITY on io-wq workers") Link: https://lore.kernel.org/all/20230314162559.pnyxdllzgw7jozgx@blackpad/ Signed-off-by: Michal Koutný Link: https://lore.kernel.org/r/20230314183332.25834-1-mkoutny@suse.com Signed-off-by: Jens Axboe commit b6402014cab0481bdfd1ffff3e1dad714e8e1205 Author: Damien Le Moal Date: Tue Mar 14 13:11:06 2023 +0900 block: null_blk: cleanup null_queue_rq() Use a local struct request pointer variable to avoid having to dereference struct blk_mq_queue_data multiple times. While at it, also fix the function argument indentation and remove a useless "else" after a return. Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Pankaj Raghav Link: https://lore.kernel.org/r/20230314041106.19173-2-damien.lemoal@opensource.wdc.com Signed-off-by: Jens Axboe commit 63f886597085f346276e3b3c8974de0100d65f32 Author: Damien Le Moal Date: Tue Mar 14 13:11:05 2023 +0900 block: null_blk: Fix handling of fake timeout request When injecting a fake timeout into the null_blk driver using fail_io_timeout, the request timeout handler does not execute blk_mq_complete_request(), so the complete callback is never executed for a timedout request. The null_blk driver also has a driver-specific fake timeout mechanism which does not have this problem. Fix the problem with fail_io_timeout by using the same meachanism as null_blk internal timeout feature, using the fake_timeout field of null_blk commands. Reported-by: Akinobu Mita Fixes: de3510e52b0a ("null_blk: fix command timeout completion handling") Signed-off-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20230314041106.19173-2-damien.lemoal@opensource.wdc.com Signed-off-by: Jens Axboe commit 007ae9b268ba7553e479608cf9735d3c4672a2ab Author: Alexander Wetzel Date: Tue Mar 14 22:11:22 2023 +0100 wifi: mac80211: Serialize ieee80211_handle_wake_tx_queue() ieee80211_handle_wake_tx_queue must not run concurrent multiple times. It calls ieee80211_txq_schedule_start() and the drivers migrated to iTXQ do not expect overlapping drv_tx() calls. This fixes 'c850e31f79f0 ("wifi: mac80211: add internal handler for wake_tx_queue")', which introduced ieee80211_handle_wake_tx_queue. Drivers started to use it with 'a790cc3a4fad ("wifi: mac80211: add wake_tx_queue callback to drivers")'. But only after fixing an independent bug with '4444bc2116ae ("wifi: mac80211: Proper mark iTXQs for resumption")' problematic concurrent calls really happened and exposed the initial issue. Fixes: c850e31f79f0 ("wifi: mac80211: add internal handler for wake_tx_queue") Reported-by: Thomas Mann Link: https://bugzilla.kernel.org/show_bug.cgi?id=217119 Link: https://lore.kernel.org/r/b8efebc6-4399-d0b8-b2a0-66843314616b@leemhuis.info/ Link: https://lore.kernel.org/r/b7445607128a6b9ed7c17fcdcf3679bfaf4aaea.camel@sipsolutions.net> CC: Signed-off-by: Alexander Wetzel Link: https://lore.kernel.org/r/20230314211122.111688-1-alexander@wetzel-home.de [add missing spin_lock_init() noticed by Felix] Signed-off-by: Johannes Berg commit 139f6973bf140c65d4d1d4bde5485badb4454d7a Author: Krzysztof Kozlowski Date: Sun Mar 12 14:25:23 2023 +0100 wifi: mwifiex: mark OF related data as maybe unused The driver can be compile tested with !CONFIG_OF making certain data unused: drivers/net/wireless/marvell/mwifiex/sdio.c:498:34: error: ‘mwifiex_sdio_of_match_table’ defined but not used [-Werror=unused-const-variable=] drivers/net/wireless/marvell/mwifiex/pcie.c:175:34: error: ‘mwifiex_pcie_of_match_table’ defined but not used [-Werror=unused-const-variable=] Signed-off-by: Krzysztof Kozlowski Reviewed-by: Simon Horman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230312132523.352182-1-krzysztof.kozlowski@linaro.org commit f2c7e3562b4c4f1699acc1538ebf3e75f5cced35 Author: Russell Currey Date: Fri Mar 10 16:08:34 2023 +1100 powerpc/mm: Fix false detection of read faults To support detection of read faults with Radix execute-only memory, the vma_is_accessible() check in access_error() (which checks for PROT_NONE) was replaced with a check to see if VM_READ was missing, and if so, returns true to assert the fault was caused by a bad read. This is incorrect, as it ignores that both VM_WRITE and VM_EXEC imply read on powerpc, as defined in protection_map[]. This causes mappings containing VM_WRITE or VM_EXEC without VM_READ to misreport the cause of page faults, since the MMU is still allowing reads. Correct this by restoring the original vma_is_accessible() check for PROT_NONE mappings, and adding a separate check for Radix PROT_EXEC-only mappings. Fixes: 395cac7752b9 ("powerpc/mm: Support execute-only memory on the Radix MMU") Reported-by: Michal Suchánek Link: https://lore.kernel.org/r/20230308152702.GR19419@kitsune.suse.cz Tested-by: Benjamin Gray Signed-off-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://msgid.link/20230310050834.63105-1-ruscur@russell.cc commit 4028cbf867f70a3c599c9b0c9509334c56ed97d7 Author: Marek Szyprowski Date: Thu Mar 9 16:24:46 2023 +0100 drm/meson: dw-hdmi: Fix devm_regulator_*get_enable*() conversion again devm_regulator_get_enable_optional() returns -ENODEV if requested optional regulator is not present. Adjust code for that, because in the 67d0a30128c9 I've incorrectly assumed that it also returns 0 when regulator is not present. Reported-by: Ricardo Cañuelo Fixes: 67d0a30128c9 ("drm/meson: dw-hdmi: Fix devm_regulator_*get_enable*() conversion") Signed-off-by: Marek Szyprowski Acked-by: Martin Blumenstingl Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230309152446.104913-1-m.szyprowski@samsung.com commit 0d3c9333d976af41d7dbc6bf4d9d2e95fbdf9c89 Author: Liu Ying Date: Tue Mar 14 13:50:35 2023 +0800 drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc The returned array size for input formats is set through atomic_get_input_bus_fmts()'s 'num_input_fmts' argument, so use 'num_input_fmts' to represent the array size in the function's kdoc, not 'num_output_fmts'. Fixes: 91ea83306bfa ("drm/bridge: Fix the bridge kernel doc") Fixes: f32df58acc68 ("drm/bridge: Add the necessary bits to support bus format negotiation") Signed-off-by: Liu Ying Reviewed-by: Robert Foss Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230314055035.3731179-1-victor.liu@nxp.com commit 75014826d0826d175aa9e36cd8e118793263e3f4 Merge: d8b2283189350 6e933a804c7db Author: David S. Miller Date: Wed Mar 15 08:58:13 2023 +0000 Merge branch 'mtk_eth_soc-SGMII-fixes' Daniel Golle says: ==================== net: ethernet: mtk_eth_soc: minor SGMII fixes This small series brings two minor fixes for the SGMII unit found in MediaTek's router SoCs. The first patch resets the PCS internal state machine on major configuration changes, just like it is also done in MediaTek's SDK. The second patch makes sure we only write values and restart AN if actually needed, thus preventing unnesseray loss of an existing link in some cases. Both patches have previously been submitted as part of the series "net: ethernet: mtk_eth_soc: various enhancements" which grew a bit too big and it has correctly been criticized that some of the patches should rather go as fixes to net-next. This new series tries to address this. ==================== Signed-off-by: David S. Miller commit 6e933a804c7db8be64f367f33e63cd7dcc302ebb Author: Daniel Golle Date: Tue Mar 14 00:34:45 2023 +0000 net: ethernet: mtk_eth_soc: only write values if needed Only restart auto-negotiation and write link timer if actually necessary. This prevents losing the link in case of minor changes. Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII") Reviewed-by: Russell King (Oracle) Tested-by: Bjørn Mork Signed-off-by: Daniel Golle Signed-off-by: David S. Miller commit 611e2dabb4b3243d176739fd6a5a34d007fa3f86 Author: Daniel Golle Date: Tue Mar 14 00:34:26 2023 +0000 net: ethernet: mtk_eth_soc: reset PCS state Reset the internal PCS state machine when changing interface mode. This prevents confusing the state machine when changing interface modes, e.g. from SGMII to 2500Base-X or vice-versa. Fixes: 7e538372694b ("net: ethernet: mediatek: Re-add support SGMII") Reviewed-by: Russell King (Oracle) Tested-by: Bjørn Mork Signed-off-by: Daniel Golle Signed-off-by: David S. Miller commit d8b228318935044dafe3a5bc07ee71a1f1424b8d Author: Szymon Heidrich Date: Mon Mar 13 23:00:45 2023 +0100 net: usb: smsc75xx: Limit packet length to skb->len Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb passed up the network stack will leak kernel memory contents. Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") Signed-off-by: Szymon Heidrich Signed-off-by: David S. Miller commit fd6ad75f8c008925e279576dc749ad12aa3fb64b Merge: 35c356924fe36 9d876d3ef27fa Author: David S. Miller Date: Wed Mar 15 08:15:20 2023 +0000 Merge branch 'net-smc-fixes' Wenjia Zhang says: ==================== net/smc: Fixes 2023-03-01 The 1st patch solves the problem that CLC message initialization was not properly reversed in error handling path. And the 2nd one fixes the possible deadlock triggered by cancel_delayed_work_sync(). ==================== Signed-off-by: David S. Miller commit 9d876d3ef27fa84355597ad269939772192356d8 Author: Stefan Raspl Date: Mon Mar 13 11:08:29 2023 +0100 net/smc: Fix device de-init sequence CLC message initialization was not properly reversed in error handling path. Reported-and-suggested-by: Alexander Gordeev Signed-off-by: Stefan Raspl Signed-off-by: Wenjia Zhang Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 13085e1b5cab8ad802904d72e6a6dae85ae0cd20 Author: Wenjia Zhang Date: Mon Mar 13 11:08:28 2023 +0100 net/smc: fix deadlock triggered by cancel_delayed_work_syn() The following LOCKDEP was detected: Workqueue: events smc_lgr_free_work [smc] WARNING: possible circular locking dependency detected 6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted ------------------------------------------------------ kworker/3:0/176251 is trying to acquire lock: 00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}, at: __flush_workqueue+0x7a/0x4f0 but task is already holding lock: 0000037fffe97dc8 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}, at: process_one_work+0x232/0x730 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}: __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 __flush_work+0x76/0xf0 __cancel_work_timer+0x170/0x220 __smc_lgr_terminate.part.0+0x34/0x1c0 [smc] smc_connect_rdma+0x15e/0x418 [smc] __smc_connect+0x234/0x480 [smc] smc_connect+0x1d6/0x230 [smc] __sys_connect+0x90/0xc0 __do_sys_socketcall+0x186/0x370 __do_syscall+0x1da/0x208 system_call+0x82/0xb0 -> #3 (smc_client_lgr_pending){+.+.}-{3:3}: __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 __mutex_lock+0x96/0x8e8 mutex_lock_nested+0x32/0x40 smc_connect_rdma+0xa4/0x418 [smc] __smc_connect+0x234/0x480 [smc] smc_connect+0x1d6/0x230 [smc] __sys_connect+0x90/0xc0 __do_sys_socketcall+0x186/0x370 __do_syscall+0x1da/0x208 system_call+0x82/0xb0 -> #2 (sk_lock-AF_SMC){+.+.}-{0:0}: __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 lock_sock_nested+0x46/0xa8 smc_tx_work+0x34/0x50 [smc] process_one_work+0x30c/0x730 worker_thread+0x62/0x420 kthread+0x138/0x150 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 -> #1 ((work_completion)(&(&smc->conn.tx_work)->work)){+.+.}-{0:0}: __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 process_one_work+0x2bc/0x730 worker_thread+0x62/0x420 kthread+0x138/0x150 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 -> #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}: check_prev_add+0xd8/0xe88 validate_chain+0x70c/0xb20 __lock_acquire+0x58e/0xbd8 lock_acquire.part.0+0xe2/0x248 lock_acquire+0xac/0x1c8 __flush_workqueue+0xaa/0x4f0 drain_workqueue+0xaa/0x158 destroy_workqueue+0x44/0x2d8 smc_lgr_free+0x9e/0xf8 [smc] process_one_work+0x30c/0x730 worker_thread+0x62/0x420 kthread+0x138/0x150 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 other info that might help us debug this: Chain exists of: (wq_completion)smc_tx_wq-00000000#2 --> smc_client_lgr_pending --> (work_completion)(&(&lgr->free_work)->work) Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock((work_completion)(&(&lgr->free_work)->work)); lock(smc_client_lgr_pending); lock((work_completion) (&(&lgr->free_work)->work)); lock((wq_completion)smc_tx_wq-00000000#2); *** DEADLOCK *** 2 locks held by kworker/3:0/176251: #0: 0000000080183548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x232/0x730 #1: 0000037fffe97dc8 ((work_completion) (&(&lgr->free_work)->work)){+.+.}-{0:0}, at: process_one_work+0x232/0x730 stack backtrace: CPU: 3 PID: 176251 Comm: kworker/3:0 Not tainted Hardware name: IBM 8561 T01 701 (z/VM 7.2.0) Call Trace: [<000000002983c3e4>] dump_stack_lvl+0xac/0x100 [<0000000028b477ae>] check_noncircular+0x13e/0x160 [<0000000028b48808>] check_prev_add+0xd8/0xe88 [<0000000028b49cc4>] validate_chain+0x70c/0xb20 [<0000000028b4bd26>] __lock_acquire+0x58e/0xbd8 [<0000000028b4cf6a>] lock_acquire.part.0+0xe2/0x248 [<0000000028b4d17c>] lock_acquire+0xac/0x1c8 [<0000000028addaaa>] __flush_workqueue+0xaa/0x4f0 [<0000000028addf9a>] drain_workqueue+0xaa/0x158 [<0000000028ae303c>] destroy_workqueue+0x44/0x2d8 [<000003ff8029af26>] smc_lgr_free+0x9e/0xf8 [smc] [<0000000028adf3d4>] process_one_work+0x30c/0x730 [<0000000028adf85a>] worker_thread+0x62/0x420 [<0000000028aeac50>] kthread+0x138/0x150 [<0000000028a63914>] __ret_from_fork+0x3c/0x58 [<00000000298503da>] ret_from_fork+0xa/0x40 INFO: lockdep is turned off. =================================================================== This deadlock occurs because cancel_delayed_work_sync() waits for the work(&lgr->free_work) to finish, while the &lgr->free_work waits for the work(lgr->tx_wq), which needs the sk_lock-AF_SMC, that is already used under the mutex_lock. The solution is to use cancel_delayed_work() instead, which kills off a pending work. Fixes: a52bcc919b14 ("net/smc: improve termination processing") Signed-off-by: Wenjia Zhang Reviewed-by: Jan Karcher Reviewed-by: Karsten Graul Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 35c356924fe3669dfbb1185607ce3b37f70bfa80 Author: Ido Schimmel Date: Mon Mar 13 18:21:24 2023 +0100 mlxsw: spectrum: Fix incorrect parsing depth after reload Spectrum ASICs have a configurable limit on how deep into the packet they parse. By default, the limit is 96 bytes. There are several cases where this parsing depth is not enough and there is a need to increase it. For example, timestamping of PTP packets and a FIB multipath hash policy that requires hashing on inner fields. The driver therefore maintains a reference count that reflects the number of consumers that require an increased parsing depth. During reload_down() the parsing depth reference count does not necessarily drop to zero, but the parsing depth itself is restored to the default during reload_up() when the firmware is reset. It is therefore possible to end up in situations where the driver thinks that the parsing depth was increased (reference count is non-zero), when it is not. Fix by making sure that all the consumers that increase the parsing depth reference count also decrease it during reload_down(). Specifically, make sure that when the routing code is de-initialized it drops the reference count if it was increased because of a FIB multipath hash policy that requires hashing on inner fields. Add a warning if the reference count is not zero after the driver was de-initialized and explicitly reset it to zero during initialization for good measures. Fixes: 2d91f0803b84 ("mlxsw: spectrum: Add infrastructure for parsing configuration") Reported-by: Maksym Yaremchuk Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Link: https://lore.kernel.org/r/9c35e1b3e6c1d8f319a2449d14e2b86373f3b3ba.1678727526.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 5ce76fe1eead179c058d9151ee1f4088cfdc1c6b Author: Lorenzo Bianconi Date: Tue Mar 14 00:08:40 2023 +0100 veth: rely on rtnl_dereference() instead of on rcu_dereference() in veth_set_xdp_features() Fix the following kernel warning in veth_set_xdp_features routine relying on rtnl_dereference() instead of on rcu_dereference(): ============================= WARNING: suspicious RCU usage 6.3.0-rc1-00144-g064d70527aaa #149 Not tainted ----------------------------- drivers/net/veth.c:1265 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/135: (net/core/rtnetlink.c:6172) stack backtrace: CPU: 1 PID: 135 Comm: ip Not tainted 6.3.0-rc1-00144-g064d70527aaa #149 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl (lib/dump_stack.c:107) lockdep_rcu_suspicious (include/linux/context_tracking.h:152) veth_set_xdp_features (drivers/net/veth.c:1265 (discriminator 9)) veth_newlink (drivers/net/veth.c:1892) ? veth_set_features (drivers/net/veth.c:1774) ? kasan_save_stack (mm/kasan/common.c:47) ? kasan_save_stack (mm/kasan/common.c:46) ? kasan_set_track (mm/kasan/common.c:52) ? alloc_netdev_mqs (include/linux/slab.h:737) ? rcu_read_lock_sched_held (kernel/rcu/update.c:125) ? trace_kmalloc (include/trace/events/kmem.h:54) ? __xdp_rxq_info_reg (net/core/xdp.c:188) ? alloc_netdev_mqs (net/core/dev.c:10657) ? rtnl_create_link (net/core/rtnetlink.c:3312) rtnl_newlink_create (net/core/rtnetlink.c:3440) ? rtnl_link_get_net_capable.constprop.0 (net/core/rtnetlink.c:3391) __rtnl_newlink (net/core/rtnetlink.c:3657) ? lock_downgrade (kernel/locking/lockdep.c:5321) ? rtnl_link_unregister (net/core/rtnetlink.c:3487) rtnl_newlink (net/core/rtnetlink.c:3671) rtnetlink_rcv_msg (net/core/rtnetlink.c:6174) ? rtnl_link_fill (net/core/rtnetlink.c:6070) ? mark_usage (kernel/locking/lockdep.c:4914) ? mark_usage (kernel/locking/lockdep.c:4914) netlink_rcv_skb (net/netlink/af_netlink.c:2574) ? rtnl_link_fill (net/core/rtnetlink.c:6070) ? netlink_ack (net/netlink/af_netlink.c:2551) ? lock_acquire (kernel/locking/lockdep.c:467) ? net_generic (include/linux/rcupdate.h:805) ? netlink_deliver_tap (include/linux/rcupdate.h:805) netlink_unicast (net/netlink/af_netlink.c:1340) ? netlink_attachskb (net/netlink/af_netlink.c:1350) netlink_sendmsg (net/netlink/af_netlink.c:1942) ? netlink_unicast (net/netlink/af_netlink.c:1861) ? netlink_unicast (net/netlink/af_netlink.c:1861) sock_sendmsg (net/socket.c:727) ____sys_sendmsg (net/socket.c:2501) ? kernel_sendmsg (net/socket.c:2448) ? __copy_msghdr (net/socket.c:2428) ___sys_sendmsg (net/socket.c:2557) ? mark_usage (kernel/locking/lockdep.c:4914) ? do_recvmmsg (net/socket.c:2544) ? lock_acquire (kernel/locking/lockdep.c:467) ? find_held_lock (kernel/locking/lockdep.c:5159) ? __lock_release (kernel/locking/lockdep.c:5345) ? __might_fault (mm/memory.c:5625) ? lock_downgrade (kernel/locking/lockdep.c:5321) ? __fget_light (include/linux/atomic/atomic-arch-fallback.h:227) __sys_sendmsg (include/linux/file.h:31) ? __sys_sendmsg_sock (net/socket.c:2572) ? rseq_get_rseq_cs (kernel/rseq.c:275) ? lockdep_hardirqs_on_prepare.part.0 (kernel/locking/lockdep.c:4263) do_syscall_64 (arch/x86/entry/common.c:50) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7f0d1aadeb17 Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 Fixes: fccca038f300 ("veth: take into account device reconfiguration for xdp_features flag") Suggested-by: Eric Dumazet Reported-by: Matthieu Baerts Link: https://lore.kernel.org/netdev/cover.1678364612.git.lorenzo@kernel.org/T/#me4c9d8e985ec7ebee981cfdb5bc5ec651ef4035d Signed-off-by: Lorenzo Bianconi Reported-by: syzbot+c3d0d9c42d59ff644ea6@syzkaller.appspotmail.com Reviewed-by: Eric Dumazet Tested-by: Matthieu Baerts Link: https://lore.kernel.org/r/dfd6a9a7d85e9113063165e1f47b466b90ad7b8a.1678748579.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 5000fe6c27827a61d8250a7e4a1d26c3298ef4f6 Author: Zheng Wang Date: Mon Mar 13 00:08:37 2023 +0800 nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition This bug influences both st_nci_i2c_remove and st_nci_spi_remove. Take st_nci_i2c_remove as an example. In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work with llt_ndlc_sm_work. When it calls ndlc_recv or timeout handler, it will finally call schedule_work to start the work. When we call st_nci_i2c_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in ndlc_remove CPU0 CPU1 |llt_ndlc_sm_work st_nci_i2c_remove | ndlc_remove | st_nci_remove | nci_free_device| kfree(ndev) | //free ndlc->ndev | |llt_ndlc_rcv_queue |nci_recv_frame |//use ndlc->ndev Fixes: 35630df68d60 ("NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip") Signed-off-by: Zheng Wang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230312160837.2040857-1-zyytlz.wz@163.com Signed-off-by: Jakub Kicinski commit cf18d55e535b34fd4845e87e31e1c5609db6d0a3 Merge: c22c3bbf351e4 13715acf8ab5b Author: Jakub Kicinski Date: Wed Mar 15 00:22:43 2023 -0700 Merge branch 'tcp-fix-bind-regression-for-dual-stack-wildcard-address' Kuniyuki Iwashima says: ==================== tcp: Fix bind() regression for dual-stack wildcard address. The first patch fixes the regression reported in [0], and the second patch adds a test for similar cases to catch future regression. [0]: https://lore.kernel.org/netdev/e21bf153-80b0-9ec0-15ba-e04a4ad42c34@redhat.com/ ==================== Link: https://lore.kernel.org/r/20230312031904.4674-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 13715acf8ab5b32a6d7e42686fceeb66df114185 Author: Kuniyuki Iwashima Date: Sat Mar 11 19:19:04 2023 -0800 selftest: Add test for bind() conflicts. The test checks if (IPv4, IPv6) address pair properly conflict or not. * IPv4 * 0.0.0.0 * 127.0.0.1 * IPv6 * :: * ::1 If the IPv6 address is [::], the second bind() always fails. Signed-off-by: Kuniyuki Iwashima Signed-off-by: Jakub Kicinski commit d9ba9934285514f1f95d96326a82398a22dc77f2 Author: Kuniyuki Iwashima Date: Sat Mar 11 19:19:03 2023 -0800 tcp: Fix bind() conflict check for dual-stack wildcard address. Paul Holzinger reported [0] that commit 5456262d2baa ("net: Fix incorrect address comparison when searching for a bind2 bucket") introduced a bind() regression. Paul also gave a nice repro that calls two types of bind() on the same port, both of which now succeed, but the second call should fail: bind(fd1, ::, port) + bind(fd2, 127.0.0.1, port) The cited commit added address family tests in three functions to fix the uninit-value KMSAN report. [1] However, the test added to inet_bind2_bucket_match_addr_any() removed a necessary conflict check; the dual-stack wildcard address no longer conflicts with an IPv4 non-wildcard address. If tb->family is AF_INET6 and sk->sk_family is AF_INET in inet_bind2_bucket_match_addr_any(), we still need to check if tb has the dual-stack wildcard address. Note that the IPv4 wildcard address does not conflict with IPv6 non-wildcard addresses. [0]: https://lore.kernel.org/netdev/e21bf153-80b0-9ec0-15ba-e04a4ad42c34@redhat.com/ [1]: https://lore.kernel.org/netdev/CAG_fn=Ud3zSW7AZWXc+asfMhZVL5ETnvuY44Pmyv4NPv-ijN-A@mail.gmail.com/ Fixes: 5456262d2baa ("net: Fix incorrect address comparison when searching for a bind2 bucket") Signed-off-by: Kuniyuki Iwashima Reported-by: Paul Holzinger Link: https://lore.kernel.org/netdev/CAG_fn=Ud3zSW7AZWXc+asfMhZVL5ETnvuY44Pmyv4NPv-ijN-A@mail.gmail.com/ Reviewed-by: Eric Dumazet Tested-by: Paul Holzinger Reviewed-by: Martin KaFai Lau Signed-off-by: Jakub Kicinski commit c22c3bbf351e4ce905f082649cffa1ff893ea8c1 Author: Heiner Kallweit Date: Sat Mar 11 19:34:45 2023 +0100 net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails If genphy_read_status fails then further access to the PHY may result in unpredictable behavior. To prevent this bail out immediately if genphy_read_status fails. Fixes: 4223dbffed9f ("net: phy: smsc: Re-enable EDPD mode for LAN87xx") Signed-off-by: Heiner Kallweit Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/026aa4f2-36f5-1c10-ab9f-cdb17dda6ac4@gmail.com Signed-off-by: Jakub Kicinski commit 4b397c06cb987935b1b097336532aa6b4210e091 Author: Eric Dumazet Date: Fri Mar 10 19:11:09 2023 +0000 net: tunnels: annotate lockless accesses to dev->needed_headroom IP tunnels can apparently update dev->needed_headroom in their xmit path. This patch takes care of three tunnels xmit, and also the core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA() helpers. More changes might be needed for completeness. BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1: ip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 write to 0xffff88815b9da0ec of 2 bytes by task 2379 on cpu 0: ip_tunnel_xmit+0x1294/0x1730 net/ipv4/ip_tunnel.c:804 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip6_finish_output2+0x9bc/0xc50 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x39a/0x4e0 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0xeb/0x220 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] mld_sendpack+0x438/0x6a0 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x519/0x7b0 net/ipv6/mcast.c:2653 process_one_work+0x3e6/0x750 kernel/workqueue.c:2390 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2537 kthread+0x1ac/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 value changed: 0x0dd4 -> 0x0e14 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 2379 Comm: kworker/0:0 Not tainted 6.3.0-rc1-syzkaller-00002-g8ca09d5fa354-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Workqueue: mld mld_ifc_work Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") Reported-by: syzbot Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230310191109.2384387-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 248401cb2c4612d83eb0c352ee8103b78b8eb365 Author: Dave Ertman Date: Fri Mar 10 11:48:33 2023 -0800 ice: avoid bonding causing auxiliary plug/unplug under RTNL lock RDMA is not supported in ice on a PF that has been added to a bonded interface. To enforce this, when an interface enters a bond, we unplug the auxiliary device that supports RDMA functionality. This unplug currently happens in the context of handling the netdev bonding event. This event is sent to the ice driver under RTNL context. This is causing a deadlock where the RDMA driver is waiting for the RTNL lock to complete the removal. Defer the unplugging/re-plugging of the auxiliary device to the service task so that it is not performed under the RTNL lock context. Cc: stable@vger.kernel.org # 6.1.x Reported-by: Jaroslav Pulchart Link: https://lore.kernel.org/netdev/CAK8fFZ6A_Gphw_3-QMGKEFQk=sfCw1Qmq0TVZK3rtAi7vb621A@mail.gmail.com/ Fixes: 5cb1ebdbc434 ("ice: Fix race condition during interface enslave") Fixes: 4eace75e0853 ("RDMA/irdma: Report the correct link speed") Signed-off-by: Dave Ertman Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230310194833.3074601-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 36862e14e31611f9786622db366327209a7aede7 Author: Masahiro Yamada Date: Mon Mar 13 05:07:30 2023 +0900 kbuild: deb-pkg: use dh_listpackages to know enabled packages Use dh_listpackages to get a list of all binary packages. With this, debian/control lists which binary packages will be produced. Previously, ARCH=um listed linux-libc-dev in debian/control, but it was not generated because each of mkdebian and builddeb independently maintained the if-conditionals. Another motivation is to allow scripts/package/builddeb to get the package name (linux-image-*, etc.) dynamically from debian/control. This will also allow the BuildProfile to control the generation of the binary packages. Signed-off-by: Masahiro Yamada commit b611daae5efc64e817171a54021d3b334cc1bc41 Author: Masahiro Yamada Date: Mon Mar 13 05:07:29 2023 +0900 kbuild: deb-pkg: split image and debug objects staging out into functions Prepare for the refactoring in the next commit. Signed-off-by: Masahiro Yamada commit f50aa51c4498d7886cfd9dbf439a2332f234a755 Author: Masahiro Yamada Date: Mon Mar 13 05:07:28 2023 +0900 kbuild: deb-pkg: set CROSS_COMPILE only when undefined Commit 3ab18a625ce4 ("kbuild: deb-pkg: improve the usability of source package") set needless CROSS_COMPILE. For example, 'make allnoconfig bindeb-pkg' on a x86_64 system will set CROSS_COMPILE=i686-linux-gnu-, where the biarch compiler 'gcc' should work for building the i386 kernel. $ uname -m x86_64 $ make allnoconfig bindeb-pkg >/dev/null dpkg-architecture: warning: specified GNU system type i686-linux-gnu does not match CC system type x86_64-linux-gnu, try setting a correct CC environment variable dpkg-source --before-build . debian/rules binary scripts/Kconfig.include:39: C compiler 'i686-linux-gnu-gcc' not found make[6]: *** [scripts/kconfig/Makefile:77: olddefconfig] Error 1 make[5]: *** [Makefile:693: olddefconfig] Error 2 make[4]: *** [Makefile:358: __build_one_by_one] Error 2 make[3]: *** [debian/rules:7: build-arch] Error 2 dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2 make[2]: *** [scripts/Makefile.package:127: bindeb-pkg] Error 2 make[1]: *** [Makefile:1657: bindeb-pkg] Error 2 make: *** [Makefile:358: __build_one_by_one] Error 2 Check whether CROSS_COMPILE is defined, instead of whether it is non-empty. If you invoke debian/rules via Kbuild, CROSS_COMPILE is always defined in the top Makefile. Fixes: 3ab18a625ce4 ("kbuild: deb-pkg: improve the usability of source package") Signed-off-by: Masahiro Yamada commit 7a531c21f83d7c62825d00bee3a76c1ccfb5de9f Author: Masahiro Yamada Date: Mon Mar 13 05:07:27 2023 +0900 kbuild: deb-pkg: do not take KERNELRELEASE from the source version KERNELRELEASE does not need to match the package version in changelog. Rather, it conventially matches what is called 'ABINAME', which is a part of the binary package names. Both are the same by default, but the former might be overridden by KDEB_PKGVERSION. In this case, the resulting package would not boot because /lib/modules/$(uname -r) does not point the module directory. Partially revert 3ab18a625ce4 ("kbuild: deb-pkg: improve the usability of source package"). Reported-by: Péter Ujfalusi Fixes: 3ab18a625ce4 ("kbuild: deb-pkg: improve the usability of source package") Signed-off-by: Masahiro Yamada Tested-by: Peter Ujfalusi commit 2fd6c4553c962ec7ea8a60c0a3632c7e984800f0 Author: Masahiro Yamada Date: Mon Mar 13 05:07:26 2023 +0900 kbuild: deb-pkg: make debian source package working again Since commit c5bf2efb058d ("kbuild: deb-pkg: fix binary-arch and clean in debian/rules"), the source package generated by 'make deb-pkg' fails to build. I terribly missed the fact that the intdeb-pkg target may regenerate include/config/kernel.release due to the following in the top Makefile: %pkg: include/config/kernel.release FORCE Restore KERNELRELEASE= option to avoid the kernel.release disagreement between build-arch and binary-arch. Fixes: c5bf2efb058d ("kbuild: deb-pkg: fix binary-arch and clean in debian/rules") Signed-off-by: Masahiro Yamada commit c753ccb2629f536b8c4feae5c223d5873c814d23 Author: Tzafrir Cohen Date: Tue Mar 14 15:02:48 2023 +0200 Makefile: Make kernelrelease target work with M= That commit required the use of filechk_kernel.release for the kernelrelease Makefile target. It is currently only being set when KBUILD_EXTMOD is not set. Make sure it is set in that case as well. Fixes: 1cb86b6c3136 ("kbuild: save overridden KERNELRELEASE in include/config/kernel.release") Signed-off-by: Tzafrir Cohen Signed-off-by: Masahiro Yamada commit 6284e46bdd47743a064fe6ac834a7ac05b1fd206 Author: Paulo Alcantara Date: Tue Mar 14 20:32:56 2023 -0300 cifs: use DFS root session instead of tcon ses Use DFS root session whenever possible to get new DFS referrals otherwise we might end up with an IPC tcon (tcon->ses->tcon_ipc) that doesn't respond to them. It should be safe accessing @ses->dfs_root_ses directly in cifs_inval_name_dfs_link_error() as it has same lifetime as of @tcon. Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Steve French commit f446a630802f154ef0087771683bd4f8e9d08384 Author: Paulo Alcantara Date: Tue Mar 14 20:32:55 2023 -0300 cifs: return DFS root session id in DebugData Return the DFS root session id in /proc/fs/cifs/DebugData to make it easier to track which IPC tcon was used to get new DFS referrals for a specific connection, and aids in debugging. A simple output of it would be Sessions: 1) Address: 192.168.1.13 Uses: 1 Capability: 0x300067 Session Status: 1 Security type: RawNTLMSSP SessionId: 0xd80000000009 User: 0 Cred User: 0 DFS root session id: 0x128006c000035 Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Steve French commit 6015b1aca1a233379625385feb01dd014aca60b5 Author: Linus Torvalds Date: Tue Mar 14 19:32:38 2023 -0700 sched_getaffinity: don't assume 'cpumask_size()' is fully initialized The getaffinity() system call uses 'cpumask_size()' to decide how big the CPU mask is - so far so good. It is indeed the allocation size of a cpumask. But the code also assumes that the whole allocation is initialized without actually doing so itself. That's wrong, because we might have fixed-size allocations (making copying and clearing more efficient), but not all of it is then necessarily used if 'nr_cpu_ids' is smaller. Having checked other users of 'cpumask_size()', they all seem to be ok, either using it purely for the allocation size, or explicitly zeroing the cpumask before using the size in bytes to copy it. See for example the ublk_ctrl_get_queue_affinity() function that uses the proper 'zalloc_cpumask_var()' to make sure that the whole mask is cleared, whether the storage is on the stack or if it was an external allocation. Fix this by just zeroing the allocation before using it. Do the same for the compat version of sched_getaffinity(), which had the same logic. Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to access the bits. For a cpumask_var_t, it ends up being a pointer to the same data either way, but it's just a good idea to treat it like you would a 'cpumask_t'. The compat case already did that. Reported-by: Ryan Roberts Link: https://lore.kernel.org/lkml/7d026744-6bd6-6827-0471-b5e8eae0be3f@arm.com/ Cc: Yury Norov Signed-off-by: Linus Torvalds commit 47dd902aaee9b9341808a3a994793199e7eddb88 Author: Dylan Jhong Date: Fri Mar 10 15:50:21 2023 +0800 RISC-V: mm: Support huge page in vmalloc_fault() Since RISC-V supports ioremap() with huge page (pud/pmd) mapping, However, vmalloc_fault() assumes that the vmalloc range is limited to pte mappings. To complete the vmalloc_fault() function by adding huge page support. Fixes: 310f541a027b ("riscv: Enable HAVE_ARCH_HUGE_VMAP for 64BIT") Cc: stable@vger.kernel.org Signed-off-by: Dylan Jhong Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230310075021.3919290-1-dylan@andestech.com Signed-off-by: Palmer Dabbelt commit 396935de145589c8bfe552fa03a5e38604071829 Author: Paulo Alcantara Date: Tue Mar 14 20:32:54 2023 -0300 cifs: fix use-after-free bug in refresh_cache_worker() The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed. Make DFS root sessions have same lifetime as DFS tcons so we can avoid the use-after-free bug is DFS cache refresher and other places that require IPCs to get new DFS referrals on. Also, get rid of mount group handling in DFS cache as we no longer need it. This fixes below use-after-free bug catched by KASAN [ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56 [ 379.948096] [ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23 [ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs] [ 379.949942] Call Trace: [ 379.950113] [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x16a/0x48e [ 379.950759] ? __virt_addr_valid+0xd8/0x160 [ 379.951040] ? __phys_addr+0x41/0x80 [ 379.951285] kasan_report+0xdb/0x110 [ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs] [ 379.953637] ? __pfx___mutex_lock+0x10/0x10 [ 379.953915] ? lock_release+0xb6/0x720 [ 379.954167] ? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0x10/0x10 [ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs] [ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs] [ 379.956323] ? __pfx_lock_acquired+0x10/0x10 [ 379.956615] ? read_word_at_a_time+0xe/0x20 [ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220 [ 379.957235] process_one_work+0x535/0x990 [ 379.957509] ? __pfx_process_one_work+0x10/0x10 [ 379.957812] ? lock_acquired+0xb7/0x5f0 [ 379.958069] ? __list_add_valid+0x37/0xd0 [ 379.958341] ? __list_add_valid+0x37/0xd0 [ 379.958611] worker_thread+0x8e/0x630 [ 379.958861] ? __pfx_worker_thread+0x10/0x10 [ 379.959148] kthread+0x17d/0x1b0 [ 379.959369] ? __pfx_kthread+0x10/0x10 [ 379.959630] ret_from_fork+0x2c/0x50 [ 379.959879] Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Steve French commit b56bce502f55505a97e381d546ee881928183126 Author: Paulo Alcantara Date: Tue Mar 14 20:32:53 2023 -0300 cifs: set DFS root session in cifs_get_smb_ses() Set the DFS root session pointer earlier when creating a new SMB session to prevent racing with smb2_reconnect(), cifs_reconnect_tcon() and DFS cache refresher. Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org # 6.2 Signed-off-by: Steve French commit dc472c7612297ffc9aea655bf6e9538bec5bfedf Author: Ondrej Zary Date: Sat Mar 11 20:25:38 2023 +0100 ata: pata_parport: fix parport release without claim When adapter is not found, pi->disconnect() is called without previous pi->connect(). This results in error like this: parport0: pata_parport tried to release parport when not owner Add missing out_disconnect label and use it correctly. Signed-off-by: Ondrej Zary Reviewed-by: Sergey Shtylyov Signed-off-by: Damien Le Moal commit 00e885efcfbb8712d3e1bfc1ae30639c15ca1d3b Author: Chris Leech Date: Fri Mar 10 09:09:13 2023 +0800 blk-mq: fix "bad unlock balance detected" on q->srcu in __blk_mq_run_dispatch_ops The 'q' parameter of the macro __blk_mq_run_dispatch_ops may not be one local variable, such as, it is rq->q, then request queue pointed by this variable could be changed to another queue in case of BLK_MQ_F_TAG_QUEUE_SHARED after 'dispatch_ops' returns, then 'bad unlock balance' is triggered. Fixes the issue by adding one local variable for doing srcu lock/unlock. Fixes: 2a904d00855f ("blk-mq: remove hctx_lock and hctx_unlock") Cc: Marco Patalano Signed-off-by: Chris Leech Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230310010913.1014789-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 9b0cb770f5d7b1ff40bea7ca385438ee94570eec Author: Bart Van Assche Date: Tue Mar 14 11:21:54 2023 -0700 loop: Fix use-after-free issues do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor 'rq' after do_req_filebacked() finished unless we are sure that the request has not yet been completed. This patch fixes the following kernel crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054 Call trace: css_put.42938+0x1c/0x1ac loop_process_work+0xc8c/0xfd4 loop_rootcg_workfn+0x24/0x34 process_one_work+0x244/0x558 worker_thread+0x400/0x8fc kthread+0x16c/0x1e0 ret_from_fork+0x10/0x20 Cc: Christoph Hellwig Cc: Ming Lei Cc: Jan Kara Cc: Johannes Weiner Cc: Dan Schatzberg Fixes: c74d40e8b5e2 ("loop: charge i/o to mem and blk cg") Fixes: bc07c10a3603 ("block: loop: support DIO & AIO") Signed-off-by: Bart Van Assche Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20230314182155.80625-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit 26e2878b3e18530c6198354a561be202235bd325 Merge: 29db00c252c7d dd52a61da0dd8 Author: Linus Torvalds Date: Tue Mar 14 17:13:58 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-03-14-16-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "Eleven hotfixes. Four of these are cc:stable and the remainder address post-6.2 issues or aren't considered suitable for backporting. Seven of these fixes are for MM" * tag 'mm-hotfixes-stable-2023-03-14-16-51' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/damon/paddr: fix folio_nr_pages() after folio_put() in damon_pa_mark_accessed_or_deactivate() mm/damon/paddr: fix folio_size() call after folio_put() in damon_pa_young() ocfs2: fix data corruption after failed write migrate_pages: try migrate in batch asynchronously firstly migrate_pages: move split folios processing out of migrate_pages_batch() migrate_pages: fix deadlock in batched migration .mailmap: add Alexandre Ghiti personal email address mailmap: correct Dikshita Agarwal's Qualcomm email address mailmap: updates for Jarkko Sakkinen mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage mm: teach mincore_hugetlb about pte markers commit 29db00c252c7d0e015f3b436647b6f87d5854833 Merge: ed38ff164fba9 c2679254b9c99 Author: Linus Torvalds Date: Tue Mar 14 17:07:54 2023 -0700 Merge tag 'trace-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Do not allow histogram values to have modifies. They can cause a NULL pointer dereference if they do. - Warn if hist_field_name() is passed a NULL. Prevent the NULL pointer dereference mentioned above. - Fix invalid address look up race in lookup_rec() - Define ftrace_stub_graph conditionally to prevent linker errors - Always check if RCU is watching at all tracepoint locations * tag 'trace-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Make tracepoint lockdep check actually test something ftrace,kcfi: Define ftrace_stub_graph conditionally ftrace: Fix invalid address access in lookup_rec() when index is 0 tracing: Check field value in hist_field_name() tracing: Do not let histogram values have some modifiers commit ed38ff164fba98a21993c95d240013f32309ccab Merge: c0856b7c14b69 6906598f1ce93 Author: Linus Torvalds Date: Tue Mar 14 17:03:25 2023 -0700 Merge tag 'zstd-linus-v6.3-rc3' of https://github.com/terrelln/linux Pull zstd fixes from Nick Terrell: "A small number of fixes for zstd-v1.5.2. I'm not pulling in zstd-v1.5.4 from upstream this release because it didn't have any time to bake in linux-next, but I'm aiming for the next update in v6.4" * tag 'zstd-linus-v6.3-rc3' of https://github.com/terrelln/linux: zstd: Fix definition of assert() lib: zstd: Backport fix for in-place decompression lib: zstd: Fix -Wstringop-overflow warning commit c0856b7c14b690ef9917cdb1d94e96169212e43b Merge: 4979bf8668255 5cf9d015be160 Author: Linus Torvalds Date: Tue Mar 14 16:58:33 2023 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A collection of clk driver fixes, and a couple OF clk patches to fix regressions seen in the last few weeks. The fwnode patch broke the build for one driver that isn't always compiled, so I waited over the weekend to be certain no more build issues came up. - Mark the firmware node (fwnode) that matches the compatible in CLK_OF_DECLARE() as initialized to fix a regression on u8500 SoCs after fw_devlink stopped checking parent nodes in of_link_to_phandle() - Remove a couple MODULE_LICENSE macros in non-modules - Update the maintainers file for Microchip clk drivers - Use 'select' instead of 'depend on' for the REGMAP config to fix Kconfig issues - Use div_u64() for portable 64-bit division in K210 clk driver" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: Avoid invalid function names in CLK_OF_DECLARE() clk: k210: remove an implicit 64-bit division MAINTAINERS: add missing clock driver coverage for Microchip FPGAs clk: HI655X: select REGMAP instead of depending on it kbuild, clk: remove MODULE_LICENSE in non-modules kbuild, clk: bcm2835: remove MODULE_LICENSE in non-modules clk: Mark a fwnode as initialized when using CLK_OF_DECLARE() macro commit f959325e6ac3f499450088b8d9c626d1177be160 Author: Nathan Huckleberry Date: Fri Mar 10 11:33:25 2023 -0800 fsverity: Remove WQ_UNBOUND from fsverity read workqueue WQ_UNBOUND causes significant scheduler latency on ARM64/Android. This is problematic for latency sensitive workloads, like I/O post-processing. Removing WQ_UNBOUND gives a 96% reduction in fsverity workqueue related scheduler latency and improves app cold startup times by ~30ms. WQ_UNBOUND was also removed from the dm-verity workqueue for the same reason [1]. This code was tested by running Android app startup benchmarks and measuring how long the fsverity workqueue spent in the runnable state. Before Total workqueue scheduler latency: 553800us After Total workqueue scheduler latency: 18962us [1]: https://lore.kernel.org/all/20230202012348.885402-1-nhuck@google.com/ Signed-off-by: Nathan Huckleberry Fixes: 8a1d0f9cacc9 ("fs-verity: add data verification hooks for ->readpages()") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230310193325.620493-1-nhuck@google.com Signed-off-by: Eric Biggers commit 05ce0448c3f36febd8db0ee0e9e16557f3ab5ee8 Author: Shyam Prasad N Date: Fri Mar 10 15:32:01 2023 +0000 cifs: generate signkey for the channel that's reconnecting Before my changes to how multichannel reconnects work, the primary channel was always used to do a non-binding session setup. With my changes, that is not the case anymore. Missed this place where channel at index 0 was forcibly updated with the signing key. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 211baef0eabf4169ce4f73ebd917749d1a7edd74 Author: Volker Lendecke Date: Mon Mar 13 16:09:54 2023 +0100 cifs: Fix smb2_set_path_size() If cifs_get_writable_path() finds a writable file, smb2_compound_op() must use that file's FID and not the COMPOUND_FID. Cc: stable@vger.kernel.org Signed-off-by: Volker Lendecke Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit c2679254b9c9980d9045f0f722cf093a2b1f7590 Author: Steven Rostedt (Google) Date: Fri Mar 10 17:28:56 2023 -0500 tracing: Make tracepoint lockdep check actually test something A while ago where the trace events had the following: rcu_read_lock_sched_notrace(); rcu_dereference_sched(...); rcu_read_unlock_sched_notrace(); If the tracepoint is enabled, it could trigger RCU issues if called in the wrong place. And this warning was only triggered if lockdep was enabled. If the tracepoint was never enabled with lockdep, the bug would not be caught. To handle this, the above sequence was done when lockdep was enabled regardless if the tracepoint was enabled or not (although the always enabled code really didn't do anything, it would still trigger a warning). But a lot has changed since that lockdep code was added. One is, that sequence no longer triggers any warning. Another is, the tracepoint when enabled doesn't even do that sequence anymore. The main check we care about today is whether RCU is "watching" or not. So if lockdep is enabled, always check if rcu_is_watching() which will trigger a warning if it is not (tracepoints require RCU to be watching). Note, that old sequence did add a bit of overhead when lockdep was enabled, and with the latest kernel updates, would cause the system to slow down enough to trigger kernel "stalled" warnings. Link: http://lore.kernel.org/lkml/20140806181801.GA4605@redhat.com Link: http://lore.kernel.org/lkml/20140807175204.C257CAC5@viggo.jf.intel.com Link: https://lore.kernel.org/lkml/20230307184645.521db5c9@gandalf.local.home/ Link: https://lore.kernel.org/linux-trace-kernel/20230310172856.77406446@gandalf.local.home Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Dave Hansen Cc: "Paul E. McKenney" Cc: Mathieu Desnoyers Cc: Joel Fernandes Acked-by: Peter Zijlstra (Intel) Acked-by: Paul E. McKenney Fixes: e6753f23d961 ("tracepoint: Make rcuidle tracepoint callers use SRCU") Signed-off-by: Steven Rostedt (Google) commit 0bc23d8b2237a104d7f8379d687aa4cb82e2968b Author: Chen Yu Date: Wed Mar 8 21:23:09 2023 +0800 ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range The user provides arbitrary non-numeic value to level and type, which could bring unexpected behavior. In this case the expected behavior would be to throw an error. pfrut -h usage: pfrut [OPTIONS] code injection: -l, --load -s, --stage -a, --activate -u, --update [stage and activate] -q, --query -d, --revid update telemetry: -G, --getloginfo -T, --type(0:execution, 1:history) -L, --level(0, 1, 2, 4) -R, --read -D, --revid log pfrut -T A pfrut -G log_level:0 log_type:0 log_revid:2 max_data_size:65536 chunk1_size:0 chunk2_size:1530 rollover_cnt:0 reset_cnt:17 Fix this by restricting the input to be in the expected range. Reported-by: Hariganesh Govindarajulu Suggested-by: "Rafael J. Wysocki" Signed-off-by: Chen Yu Signed-off-by: Rafael J. Wysocki commit 91d7b60a65d9f71230ea09b86d2058a884a3c2af Author: Sudeep Holla Date: Wed Mar 8 11:26:32 2023 +0000 ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") enabled to map PPTT once on the first invocation of acpi_get_pptt() and never unmapped the same allowing it to be used at runtime with out the hassle of mapping and unmapping the table. This was needed to fetch LLC information from the PPTT in the cpuhotplug path which is executed in the atomic context as the acpi_get_table() might sleep waiting for a mutex. However it missed to handle the case when there is no PPTT on the system which results in acpi_get_pptt() being called from all the secondary CPUs attempting to fetch the LLC information in the atomic context without knowing the absence of PPTT resulting in the splat like below: | BUG: sleeping function called from invalid context at kernel/locking/semaphore.c:164 | in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 | preempt_count: 1, expected: 0 | RCU nest depth: 0, expected: 0 | no locks held by swapper/1/0. | irq event stamp: 0 | hardirqs last enabled at (0): 0x0 | hardirqs last disabled at (0): copy_process+0x61c/0x1b40 | softirqs last enabled at (0): copy_process+0x61c/0x1b40 | softirqs last disabled at (0): 0x0 | CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.3.0-rc1 #1 | Call trace: | dump_backtrace+0xac/0x138 | show_stack+0x30/0x48 | dump_stack_lvl+0x60/0xb0 | dump_stack+0x18/0x28 | __might_resched+0x160/0x270 | __might_sleep+0x58/0xb0 | down_timeout+0x34/0x98 | acpi_os_wait_semaphore+0x7c/0xc0 | acpi_ut_acquire_mutex+0x58/0x108 | acpi_get_table+0x40/0xe8 | acpi_get_pptt+0x48/0xa0 | acpi_get_cache_info+0x38/0x140 | init_cache_level+0xf4/0x118 | detect_cache_attributes+0x2e4/0x640 | update_siblings_masks+0x3c/0x330 | store_cpu_topology+0x88/0xf0 | secondary_start_kernel+0xd0/0x168 | __secondary_switched+0xb8/0xc0 Update acpi_get_pptt() to consider the fact that PPTT is once checked and is not available on the system and return NULL avoiding any attempts to fetch PPTT and thereby avoiding any possible sleep waiting for a mutex in the atomic context. Fixes: 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") Reported-by: Aishwarya TCV Signed-off-by: Sudeep Holla Tested-by: Pierre Gondois Cc: 6.0+ # 6.0+ Signed-off-by: Rafael J. Wysocki commit 21fd9e8700de86d1169f6336e97d7a74916ed04a Author: Chengen Du Date: Wed Mar 8 16:03:27 2023 +0800 NFS: Correct timing for assigning access cache timestamp When the user's login time is newer than the cache's timestamp, the original entry in the RB-tree will be replaced by a new entry. Currently, the timestamp is only set if the entry is not found in the RB-tree, which can cause the timestamp to be undefined when the entry exists. This may result in a significant increase in ACCESS operations if the timestamp is set to zero. Signed-off-by: Chengen Du Fixes: 0eb43812c027 ("NFS: Clear the file access cache upon login”) Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 4979bf8668255a67449714653314662fbc7e5bdb Merge: fc89d7fb499b0 d7ba3657d5162 Author: Linus Torvalds Date: Tue Mar 14 11:08:28 2023 -0700 Merge tag 'docs-6.3-fixes' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "A handful of fixes and minor documentation updates" * tag 'docs-6.3-fixes' of git://git.lwn.net/linux: docs: vfio: fix header path docs: process: typo fix docs/mm: hugetlbfs_reserv: fix a reference to a file that doesn't exist docs/mm: Physical Memory: fix a reference to a file that doesn't exist docs: rebasing-and-merging: Drop wrong statement about git docs: programming-language: add Rust programming language section docs: programming-language: remove mention of the Intel compiler docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate sched/doc: supplement CPU capacity with RISC-V commit 7ff84910c66c9144cc0de9d9deed9fb84c03aff0 Author: Jeff Layton Date: Tue Mar 14 06:20:58 2023 -0400 lockd: set file_lock start and end when decoding nlm4 testargs Commit 6930bcbfb6ce dropped the setting of the file_lock range when decoding a nlm_lock off the wire. This causes the client side grant callback to miss matching blocks and reject the lock, only to rerequest it 30s later. Add a helper function to set the file_lock range from the start and end values that the protocol uses, and have the nlm_lock decoder call that to set up the file_lock args properly. Fixes: 6930bcbfb6ce ("lockd: detect and reject lock arguments that overflow") Reported-by: Amir Goldstein Signed-off-by: Jeff Layton Tested-by: Amir Goldstein Cc: stable@vger.kernel.org #6.0 Signed-off-by: Anna Schumaker commit 6fa7f537351c8fad0e43e9279efe76dbc942bea0 Author: Todd Brandt Date: Mon Mar 13 15:26:52 2023 -0700 pm-graph: sleepgraph: Avoid crashing on binary data in device names A regression has occurred in the hid-sensor code where a device name string has not been initialized to 0, and ends up without a NULL char and is printed with %s. This includes random binary data in the device name, which makes its way into the ftrace output and ends up crashing sleepgraph because it expects the ftrace output to be ASCII only. For example: "HID-SENSOR-INT-020b?.39.auto" ends up in ftrace instead of "HID-SENSOR-INT-020b.39.auto". It causes this crash in sleepgraph: File "/usr/bin/sleepgraph", line 5579, in executeSuspend for line in fp: File "/usr/lib/python3.10/codecs.py", line 322, in decode (result, consumed) = self._buffer_decode(data, self.errors, final) UnicodeDecodeError: 'utf-8' codec can't decode byte 0xff in position 1568: invalid start byte The issue is present in 6.3-rc1 and is described in full here: https://bugzilla.kernel.org/show_bug.cgi?id=217169 A separate fix has been submitted to have this issue repaired, but it has also exposed a larger bug in sleepgraph, since nothing should make sleepgraph crash. Sleepgraph needs to be able to handle binary data showing up in ftrace gracefully. Modify the ftrace processing code to treat it as potentially binary and to filter out binary data and leave just the ASCII. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217169 Fixes: 98c062e82451 ("HID: hid-sensor-custom: Allow more custom iio sensors") Signed-off-by: Todd Brandt [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit e140980ef211d537833500377ae411c3f232b41d Author: Arnd Bergmann Date: Tue Mar 14 17:27:10 2023 +0100 fbdev: omapfb: remove omap1 osk driver Commit 21a3e6eed423 ("ARM: omap1: remove osk-mistral add-on board support") removed the platform_device definition for the "lcd_osk" device, so this driver is now unused and can be removed as well. Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller commit 4c7e8e05bca577380d03a2731a14b3cb5652b4f3 Author: Yang Li Date: Tue Mar 14 13:42:19 2023 +0800 fbdev: xilinxfb: Use devm_platform_get_and_ioremap_resource() According to commit 890cc39a8799 ("drivers: provide devm_platform_get_and_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yang Li Signed-off-by: Helge Deller commit be66c2cbc05ed84821f3dde6439044ab44506525 Author: Yang Li Date: Tue Mar 14 13:42:18 2023 +0800 fbdev: wm8505fb: Use devm_platform_ioremap_resource() According to commit 7945f929f1a7 ("drivers: provide devm_platform_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to Use devm_platform_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yang Li Signed-off-by: Helge Deller commit 0db0a1eb444dc9f79241d673ea611741211acdae Author: Yang Li Date: Tue Mar 14 13:42:17 2023 +0800 fbdev: pxa3xx-gcu: Use devm_platform_get_and_ioremap_resource() According to commit 890cc39a8799 ("drivers: provide devm_platform_get_and_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yang Li Signed-off-by: Helge Deller commit 096dc32bb73d20e0854b3a471379f577f903f0ee Author: Rob Herring Date: Fri Mar 10 08:47:30 2023 -0600 fbdev: Use of_property_read_bool() for boolean properties It is preferred to use typed property access functions (i.e. of_property_read_ functions) rather than low-level of_get_property/of_find_property functions for reading properties. Convert reading boolean properties to to of_property_read_bool(). Signed-off-by: Rob Herring Signed-off-by: Helge Deller commit 7eb1220f4bde36a15b26e8f54480406c72081bfa Author: Yang Li Date: Wed Mar 8 13:49:50 2023 +0800 fbdev: clps711x-fb: Use devm_platform_get_and_ioremap_resource() According to commit 890cc39a8799 ("drivers: provide devm_platform_get_and_ioremap_resource()"), convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yang Li Signed-off-by: Helge Deller commit f90bd245de82c095187d8c2cabb8b488a39eaecc Author: Wei Chen Date: Tue Mar 7 13:08:56 2023 +0000 fbdev: tgafb: Fix potential divide by zero fb_set_var would by called when user invokes ioctl with cmd FBIOPUT_VSCREENINFO. User-provided data would finally reach tgafb_check_var. In case var->pixclock is assigned to zero, divide by zero would occur when checking whether reciprocal of var->pixclock is too high. Similar crashes have happened in other fbdev drivers. There is no check and modification on var->pixclock along the call chain to tgafb_check_var. We believe it could also be triggered in driver tgafb from user site. Signed-off-by: Wei Chen Signed-off-by: Helge Deller commit 33bf61c0a1a97e2abff3117751eabad28106a7c5 Author: Lukas Bulwahn Date: Wed Mar 8 08:19:21 2023 +0100 MAINTAINERS: orphan SIS FRAMEBUFFER DRIVER This was triggered by the fact that the webpage: http://www.winischhofer.net/linuxsisvga.shtml cannot be reached anymore. Thomas Winischhofer is still reachable at the given email address, but he has not been active since 2005. Mark the SIS FRAMEBUFFER DRIVER as orphan to reflect the current state. Signed-off-by: Lukas Bulwahn Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 7f501aa71da9dc2eaae2b0118a151cad018d33b0 Author: Lucy Mielke Date: Tue Feb 7 11:06:30 2023 +0100 fbdev: omapfb: cleanup inconsistent indentation This cleans up the indentation according to the Linux kernel coding style, and should fix the warning created by the kernel test robot. Fixes: 8b08cf2b64f5 ("OMAP: add TI OMAP framebuffer driver") Reported-by: kernel test robot Signed-off-by: Lucy Mielke Signed-off-by: Helge Deller commit 8f0e056068f26c0f1121f7f96a6b4515f59160f2 Author: Nikita Romanyuk Date: Sat Feb 25 10:12:29 2023 +0300 drivers: video: logo: add SPDX comment, remove GPL notice in pnmtologo.c Signed-off-by: Nikita Romanyuk Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller commit 044b14b51d78a549664efac3a5a4c9edd1211b79 Author: Nikita Romanyuk Date: Sat Feb 25 10:12:28 2023 +0300 drivers: video: logo: fix code style issues in pnmtologo.c Signed-off-by: Nikita Romanyuk Signed-off-by: Helge Deller commit 9c88ea00fef03031ce6554531e89be82f6a42835 Author: Dave Wysochanski Date: Thu Mar 9 13:58:52 2023 -0500 NFS: Fix /proc/PID/io read_bytes for buffered reads Prior to commit 8786fde8421c ("Convert NFS from readpages to readahead"), nfs_readpages() used the old mm interface read_cache_pages() which called task_io_account_read() for each NFS page read. After this commit, nfs_readpages() is converted to nfs_readahead(), which now uses the new mm interface readahead_page(). The new interface requires callers to call task_io_account_read() themselves. In addition, to nfs_readahead() task_io_account_read() should also be called from nfs_read_folio(). Fixes: 8786fde8421c ("Convert NFS from readpages to readahead") Link: https://lore.kernel.org/linux-nfs/CAPt2mGNEYUk5u8V4abe=5MM5msZqmvzCVrtCP4Qw1n=gCHCnww@mail.gmail.com/ Signed-off-by: Dave Wysochanski Signed-off-by: Anna Schumaker commit d7ba3657d5162bd551e5c653f67f941c94a7dc0a Author: Jiri Pirko Date: Fri Mar 10 10:58:57 2023 +0100 docs: vfio: fix header path The text points to a different header file, fix by changing the path to "uapi". Signed-off-by: Jiri Pirko Reviewed-by: Yi Liu Link: https://lore.kernel.org/r/20230310095857.985814-1-jiri@resnulli.us Signed-off-by: Jonathan Corbet commit 42da2c00b91486980a724c05c29818a7e60a067e Author: Xujun Leng Date: Sun Mar 12 15:14:23 2023 +0800 docs: process: typo fix In the second paragraph of section "Respond to review comments", there is a spelling mistake: "aganst" should be "against". Signed-off-by: Xujun Leng Link: https://lore.kernel.org/r/20230312071423.3042-1-lengxujun2007@126.com Signed-off-by: Jonathan Corbet commit ccb820dc7d2236b1af0d54ae038a27b5b6d5ae5a Author: Eric Biggers Date: Mon Mar 13 15:12:29 2023 -0700 fscrypt: destroy keyring after security_sb_delete() fscrypt_destroy_keyring() must be called after all potentially-encrypted inodes were evicted; otherwise it cannot safely destroy the keyring. Since inodes that are in-use by the Landlock LSM don't get evicted until security_sb_delete(), this means that fscrypt_destroy_keyring() must be called *after* security_sb_delete(). This fixes a WARN_ON followed by a NULL dereference, only possible if Landlock was being used on encrypted files. Fixes: d7e7b9af104c ("fscrypt: stop using keyrings subsystem for fscrypt_master_key") Cc: stable@vger.kernel.org Reported-by: syzbot+93e495f6a4f748827c88@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/00000000000044651705f6ca1e30@google.com Reviewed-by: Christian Brauner Link: https://lore.kernel.org/r/20230313221231.272498-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 13ec9308a85702af7c31f3638a2720863848a7f2 Author: David Matlack Date: Mon Mar 13 16:54:54 2023 -0700 KVM: arm64: Retry fault if vma_lookup() results become invalid Read mmu_invalidate_seq before dropping the mmap_lock so that KVM can detect if the results of vma_lookup() (e.g. vma_shift) become stale before it acquires kvm->mmu_lock. This fixes a theoretical bug where a VMA could be changed by userspace after vma_lookup() and before KVM reads the mmu_invalidate_seq, causing KVM to install page table entries based on a (possibly) no-longer-valid vma_shift. Re-order the MMU cache top-up to earlier in user_mem_abort() so that it is not done after KVM has read mmu_invalidate_seq (i.e. so as to avoid inducing spurious fault retries). This bug has existed since KVM/ARM's inception. It's unlikely that any sane userspace currently modifies VMAs in such a way as to trigger this race. And even with directed testing I was unable to reproduce it. But a sufficiently motivated host userspace might be able to exploit this race. Fixes: 94f8e6418d39 ("KVM: ARM: Handle guest faults in KVM") Cc: stable@vger.kernel.org Reported-by: Sean Christopherson Signed-off-by: David Matlack Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230313235454.2964067-1-dmatlack@google.com Signed-off-by: Oliver Upton commit 30549964ce67f6f363023ec680ddca9fac63904e Merge: 083a25b18d6ad 9c691a42b8926 Author: Mark Brown Date: Tue Mar 14 16:24:13 2023 +0000 ASOC: Intel: add quirk for Intel 'Rooks County' NUC Merge series from Bard Liao : Adding Intel 'Rooks County' NUC M15 support. To support 'Rooks County', we also need the "soundwire: dmi-quirks: add remapping for Intel 'Rooks County'" patch. commit 98e5eb110095ec77cb6d775051d181edbf9cd3cf Author: Kuninori Morimoto Date: Mon Mar 13 00:50:28 2023 +0000 ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for (i = 0; i < TUNING_CTLS_COUNT; i++) (A) if (nid == ca0132_tuning_ctls[i].nid) break; snd_hda_power_up(...); (X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^ return 1; } We will get below error by cppcheck sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^ This patch cares non match case. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Takashi Iwai commit 9026c0bf233db53b86f74f4c620715e94eb32a09 Author: Kuninori Morimoto Date: Mon Mar 13 00:49:24 2023 +0000 ALSA: asihpi: check pao in control_message() control_message() might be called with pao = NULL. Here indicates control_message() as sample. (B) static void control_message(struct hpi_adapter_obj *pao, ...) { ^^^ struct hpi_hw_obj *phw = pao->priv; ... ^^^ } (A) void _HPI_6205(struct hpi_adapter_obj *pao, ...) { ^^^ ... case HPI_OBJ_CONTROL: (B) control_message(pao, phm, phr); break; ^^^ ... } void HPI_6205(...) { ... (A) _HPI_6205(NULL, phm, phr); ... ^^^^ } Therefore, We will get too many warning via cppcheck, like below sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer] struct hpi_hw_obj *phw = pao->priv; ^ sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0 _HPI_6205(NULL, phm, phr); ^ sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0 control_message(pao, phm, phr); ^ Set phr->error like many functions doing, and don't call _HPI_6205() with NULL. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87ttypeaqz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Takashi Iwai commit 28e8cabe80f3e6e3c98121576eda898eeb20f1b1 Author: Kristian Overskeid Date: Tue Mar 7 14:32:29 2023 +0100 net: hsr: Don't log netdev_err message on unknown prp dst node If no frames has been exchanged with a node for HSR_NODE_FORGET_TIME, the node will be deleted from the node_db list. If a frame is sent to the node after it is deleted, a netdev_err message for each slave interface is produced. This should not happen with dan nodes because of supervision frames, but can happen often with san nodes, which clutters the kernel log. Since the hsr protocol does not support sans, this is only relevant for the prp protocol. Signed-off-by: Kristian Overskeid Signed-off-by: David S. Miller commit 34e0a279a993debaff03158fc2fbf6a00c093643 Author: Jan Kara Date: Mon Mar 13 10:30:02 2023 +0100 block: do not reverse request order when flushing plug list Commit 26fed4ac4eab ("block: flush plug based on hardware and software queue order") changed flushing of plug list to submit requests one device at a time. However while doing that it also started using list_add_tail() instead of list_add() used previously thus effectively submitting requests in reverse order. Also when forming a rq_list with remaining requests (in case two or more devices are used), we effectively reverse the ordering of the plug list for each device we process. Submitting requests in reverse order has negative impact on performance for rotational disks (when BFQ is not in use). We observe 10-25% regression in random 4k write throughput, as well as ~20% regression in MariaDB OLTP benchmark on rotational storage on btrfs filesystem. Fix the problem by preserving ordering of the plug list when inserting requests into the queuelist as well as by appending to requeue_list instead of prepending to it. Fixes: 26fed4ac4eab ("block: flush plug based on hardware and software queue order") Signed-off-by: Jan Kara Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230313093002.11756-1-jack@suse.cz Signed-off-by: Jens Axboe commit 542a56e8eb4467ae654eefab31ff194569db39cd Author: Guilherme G. Piccoli Date: Sun Mar 12 13:51:00 2023 -0300 drm/amdgpu/vcn: Disable indirect SRAM on Vangogh broken BIOSes The VCN firmware loading path enables the indirect SRAM mode if it's advertised as supported. We might have some cases of FW issues that prevents this mode to working properly though, ending-up in a failed probe. An example below, observed in the Steam Deck: [...] [drm] failed to load ucode VCN0_RAM(0x3A) [drm] psp gfx command LOAD_IP_FW(0x6) failed and response status is (0xFFFF0000) amdgpu 0000:04:00.0: [drm:amdgpu_ring_test_helper [amdgpu]] *ERROR* ring vcn_dec_0 test failed (-110) [drm:amdgpu_device_init.cold [amdgpu]] *ERROR* hw_init of IP block failed -110 amdgpu 0000:04:00.0: amdgpu: amdgpu_device_ip_init failed amdgpu 0000:04:00.0: amdgpu: Fatal error during GPU init [...] Disabling the VCN block circumvents this, but it's a very invasive workaround that turns off the entire feature. So, let's add a quirk on VCN loading that checks for known problematic BIOSes on Vangogh, so we can proactively disable the indirect SRAM mode and allow the HW proper probe and VCN IP block to work fine. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2385 Fixes: 82132ecc5432 ("drm/amdgpu: enable Vangogh VCN indirect sram mode") Cc: stable@vger.kernel.org Cc: James Zhu Cc: Leo Liu Signed-off-by: Guilherme G. Piccoli Signed-off-by: Alex Deucher commit 45aa07fa832412f1de99194f37fd847915d7e0f6 Author: Alex Deucher Date: Wed Mar 8 22:45:59 2023 -0500 drm/amdgpu/nv: fix codec array for SR_IOV Copy paste error. Fixes: 384334120b66 ("drm/amdgpu/nv: don't expose AV1 if VCN0 is harvested") Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4454 Cc: Jiapeng Chong Acked-by: Guchun Chen Signed-off-by: Alex Deucher commit 751281c55579f0cb0e56c9797d4663f689909681 Author: Benjamin Cheng Date: Sun Mar 12 20:47:39 2023 -0400 drm/amd/display: Write to correct dirty_rect When FB_DAMAGE_CLIPS are provided in a non-MPO scenario, the loop does not use the counter i. This causes the fill_dc_dity_rect() to always fill dirty_rects[0], causing graphical artifacts when a damage clip aware DRM client sends more than 1 damage clip. Instead, use the flip_addrs->dirty_rect_count which is incremented by fill_dc_dirty_rect() on a successful fill. Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support") Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2453 Signed-off-by: Benjamin Cheng Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 3fadda5de8073e2cb65744803a6941736411d55b Author: Guchun Chen Date: Thu Mar 9 10:02:45 2023 +0800 drm/amdgpu: move poll enabled/disable into non DC path Some amd asics having reliable hotplug support don't call drm_kms_helper_poll_init in driver init sequence. However, due to the unified suspend/resume path for all asics, because the output_poll_work->func is not set for these asics, a warning arrives when suspending. [ 90.656049] [ 90.656050] ? console_unlock+0x4d/0x100 [ 90.656053] ? __irq_work_queue_local+0x27/0x60 [ 90.656056] ? irq_work_queue+0x2b/0x50 [ 90.656057] ? __wake_up_klogd+0x40/0x60 [ 90.656059] __cancel_work_timer+0xed/0x180 [ 90.656061] drm_kms_helper_poll_disable.cold+0x1f/0x2c [drm_kms_helper] [ 90.656072] amdgpu_device_suspend+0x81/0x170 [amdgpu] [ 90.656180] amdgpu_pmops_runtime_suspend+0xb5/0x1b0 [amdgpu] [ 90.656269] pci_pm_runtime_suspend+0x61/0x1b0 drm_kms_helper_poll_enable/disable is valid when poll_init is called in amdgpu code, which is only used in non DC path. So move such codes into non-DC path code to get rid of such warnings. v1: introduce use_kms_poll flag in amdgpu as the poll stuff check v2: use dc_enabled as the flag to simply code v3: move code into non DC path instead of relying on any flag Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2411 Fixes: a4e771729a51 ("drm/probe_helper: sort out poll_running vs poll_enabled") Reported-by: Bert Karwatzki Suggested-by: Dmitry Baryshkov Suggested-by: Alex Deucher Signed-off-by: Guchun Chen Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 728cefa53a36ba378ed4a7f31a0c08289687d824 Author: Bhawanpreet Lakha Date: Fri Feb 17 16:08:21 2023 -0500 drm/amd/display: Fix HDCP failing to enable after suspend [Why] On resume some displays are not ready for HDCP, so they will fail if we start the hdcp authentintication too soon. Add a delay so that the displays can be ready before we start. NOTE: Previoulsy this delay was set to 3 seconds but it was causing issues with compliance, 2 seconds should enough for compliance and the s3 resume case. [How] Change the Delay to 2 seconds. Reviewed-by: Aurabindo Pillai Acked-by: Qingqing Zhuo Signed-off-by: Bhawanpreet Lakha Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9da050b0d9e04439d225a2ec3044af70cdfb3933 Author: Chia-I Wu Date: Wed Mar 8 13:37:24 2023 -0800 drm/amdkfd: fix potential kgd_mem UAFs kgd_mem pointers returned by kfd_process_device_translate_handle are only guaranteed to be valid while p->mutex is held. As soon as the mutex is unlocked, another thread can free the BO. Signed-off-by: Chia-I Wu Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit d71e38df3b730a17ab6b25cabb2ccfe8a7f04385 Author: Jane Jian Date: Tue Feb 28 18:48:41 2023 +0800 drm/amdgpu/vcn: custom video info caps for sriov for sriov, we added a new flag to indicate av1 support, this will override the original caps info. Signed-off-by: Jane Jian Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit a9386ee9681585794dbab95d4ce6826f73d19af6 Author: Błażej Szczygieł Date: Sun Mar 5 00:44:31 2023 +0100 drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume Always setup overdrive tables after resume. Preserve only some user-defined settings in user_overdrive_table if they're set. Copy restored user_overdrive_table into od_table to get correct values. On cold boot, BTC was triggered and GfxVfCurve was calibrated. We got VfCurve settings (a). On resuming back, BTC will be triggered again and GfxVfCurve will be recalibrated. VfCurve settings (b) got may be different from those of cold boot. So if we reuse those VfCurve settings (a) got on cold boot on suspend, we can run into discrepencies. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1897 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2276 Reviewed-by: Evan Quan Signed-off-by: Błażej Szczygieł Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit ab9bdb1213b4b40942af6a383f555d0c14874c1b Author: Tim Huang Date: Wed Mar 1 10:53:03 2023 +0800 drm/amd/pm: bump SMU 13.0.4 driver_if header version Align the SMU driver interface version with PMFW to suppress the version mismatch message on driver loading. Signed-off-by: Tim Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit b2ca5c5d416b4e72d1e9d0293fc720e2d525fd42 Author: Chia-I Wu Date: Tue Mar 7 16:19:02 2023 -0800 drm/amdkfd: fix a potential double free in pqm_create_queue Set *q to NULL on errors, otherwise pqm_create_queue would free it again. Signed-off-by: Chia-I Wu Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 8eeddc0d4200762063e1c66b9cc63afa7b24ebf0 Author: Xiaogang Chen Date: Thu Mar 9 17:44:55 2023 -0600 drm/amdkfd: Get prange->offset after svm_range_vram_node_new During miration to vram prange->offset is valid after vram buffer is located, either use old one or allocate a new one. Move svm_range_vram_node_new before migrate for each vma to get valid prange->offset. v2: squash in warning fix Fixes: b4ee9606378b ("drm/amdkfd: Fix BO offset for multi-VMA page migration") Signed-off-by: Xiaogang Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit b4ee9606378bb9520c94d8b96f0305c3696f5c29 Author: Xiaogang Chen Date: Wed Mar 1 10:21:06 2023 -0600 drm/amdkfd: Fix BO offset for multi-VMA page migration svm_migrate_ram_to_vram migrates a prange from sys ram to vram. The prange may cross multiple vma. Need remember current dst vram offset in the TTM resource for each migration. v2: squash in warning fix (Alex) Signed-off-by: Xiaogang Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 934ef33ee75c3846f605f18b65048acd147e3918 Author: Jan Beulich Date: Mon Mar 13 15:45:48 2023 +0100 x86/PVH: obtain VGA console info in Dom0 A new platform-op was added to Xen to allow obtaining the same VGA console information PV Dom0 is handed. Invoke the new function and have the output data processed by xen_init_vga(). Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/8f315e92-7bda-c124-71cc-478ab9c5e610@suse.com Signed-off-by: Juergen Gross commit f3e707413dbe3920a972d0c2b51175180e7de36b Author: Vipin Sharma Date: Fri Feb 3 17:45:47 2023 -0800 KVM: selftests: Sync KVM exit reasons in selftests Add missing KVM_EXIT_* reasons in KVM selftests from include/uapi/linux/kvm.h Signed-off-by: Vipin Sharma Message-Id: <20230204014547.583711-5-vipinsh@google.com> Signed-off-by: Paolo Bonzini commit 1b3d660e5d7b8b408a2b0988de65672199ebfaf2 Author: Sean Christopherson Date: Fri Feb 3 17:45:46 2023 -0800 KVM: selftests: Add macro to generate KVM exit reason strings Add and use a macro to generate the KVM exit reason strings array instead of relying on developers to correctly copy+paste+edit each string. Signed-off-by: Sean Christopherson Message-Id: <20230204014547.583711-4-vipinsh@google.com> Signed-off-by: Paolo Bonzini commit 6f974494b8077bb1a2a10fe33f62c143f246f102 Author: Vipin Sharma Date: Fri Feb 3 17:45:45 2023 -0800 KVM: selftests: Print expected and actual exit reason in KVM exit reason assert Print what KVM exit reason a test was expecting and what it actually got int TEST_ASSERT_KVM_EXIT_REASON(). Signed-off-by: Vipin Sharma Message-Id: <20230204014547.583711-3-vipinsh@google.com> Signed-off-by: Paolo Bonzini commit c96f57b08012805da323c6bdf929bab1b88d250c Author: Vipin Sharma Date: Fri Feb 3 17:45:44 2023 -0800 KVM: selftests: Make vCPU exit reason test assertion common Make TEST_ASSERT_KVM_EXIT_REASON() macro and replace all exit reason test assert statements with it. No functional changes intended. Signed-off-by: Vipin Sharma Reviewed-by: David Matlack Message-Id: <20230204014547.583711-2-vipinsh@google.com> Signed-off-by: Paolo Bonzini commit e6239a4ec5c51e4d5ee4d1604f741f490c32054c Author: David Woodhouse Date: Sat Feb 4 02:41:51 2023 +0000 KVM: selftests: Add EVTCHNOP_send slow path test to xen_shinfo_test When kvm_xen_evtchn_send() takes the slow path because the shinfo GPC needs to be revalidated, it used to violate the SRCU vs. kvm->lock locking rules and potentially cause a deadlock. Now that lockdep is learning to catch such things, make sure that code path is exercised by the selftest. Link: https://lore.kernel.org/all/20230113124606.10221-2-dwmw2@infradead.org Signed-off-by: David Woodhouse Signed-off-by: Sean Christopherson Message-Id: <20230204024151.1373296-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit e7062a98d0b3e0b42089f4c5da633a1ce41b807f Author: David Woodhouse Date: Sat Feb 4 02:41:50 2023 +0000 KVM: selftests: Use enum for test numbers in xen_shinfo_test The xen_shinfo_test started off with very few iterations, and the numbers we used in GUEST_SYNC() were precisely mapped to the RUNSTATE_xxx values anyway to start with. It has since grown quite a few more tests, and it's kind of awful to be handling them all as bare numbers. Especially when I want to add a new test in the middle. Define an enum for the test stages, and use it both in the guest code and the host switch statement. No functional change, if I can count to 24. Signed-off-by: David Woodhouse Signed-off-by: Sean Christopherson Message-Id: <20230204024151.1373296-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c0c76d99939cb4ac28cbc5ce542cff2b9e1e1b02 Author: Sean Christopherson Date: Sat Feb 4 02:41:49 2023 +0000 KVM: selftests: Add helpers to make Xen-style VMCALL/VMMCALL hypercalls Add wrappers to do hypercalls using VMCALL/VMMCALL and Xen's register ABI (as opposed to full Xen-style hypercalls through a hypervisor provided page). Using the common helpers dedups a pile of code, and uses the native hypercall instruction when running on AMD. Signed-off-by: Sean Christopherson Message-Id: <20230204024151.1373296-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 4009e0bb7b83d967a14e108d271f003b378f9af9 Author: Sean Christopherson Date: Sat Feb 4 02:41:48 2023 +0000 KVM: selftests: Move the guts of kvm_hypercall() to a separate macro Extract the guts of kvm_hypercall() to a macro so that Xen hypercalls, which have a different register ABI, can reuse the VMCALL vs. VMMCALL logic. No functional change intended. Signed-off-by: Sean Christopherson Message-Id: <20230204024151.1373296-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c281794eaa5c635c0edf39c6a9a3b0171000e92f Author: Sean Christopherson Date: Tue Feb 7 00:21:56 2023 +0000 KVM: SVM: WARN if GATag generation drops VM or vCPU ID information WARN if generating a GATag given a VM ID and vCPU ID doesn't yield the same IDs when pulling the IDs back out of the tag. Don't bother adding error handling to callers, this is very much a paranoid sanity check as KVM fully controls the VM ID and is supposed to reject too-big vCPU IDs. Signed-off-by: Sean Christopherson Reviewed-by: Suravee Suthikulpanit Tested-by: Suravee Suthikulpanit Message-Id: <20230207002156.521736-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 5999715922c5a3ede5d8fe2a6b17aba58a157d41 Author: Suravee Suthikulpanit Date: Tue Feb 7 00:21:55 2023 +0000 KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs Define AVIC_VCPU_ID_MASK based on AVIC_PHYSICAL_MAX_INDEX, i.e. the mask that effectively controls the largest guest physical APIC ID supported by x2AVIC, instead of hardcoding the number of bits to 8 (and the number of VM bits to 24). The AVIC GATag is programmed into the AMD IOMMU IRTE to provide a reference back to KVM in case the IOMMU cannot inject an interrupt into a non-running vCPU. In such a case, the IOMMU notifies software by creating a GALog entry with the corresponded GATag, and KVM then uses the GATag to find the correct VM+vCPU to kick. Dropping bit 8 from the GATag results in kicking the wrong vCPU when targeting vCPUs with x2APIC ID > 255. Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode") Cc: stable@vger.kernel.org Reported-by: Alejandro Jimenez Signed-off-by: Suravee Suthikulpanit Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Reviewed-by: Suravee Suthikulpanit Tested-by: Suravee Suthikulpanit Message-Id: <20230207002156.521736-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 3ec7a1b2743c07c45f4a0c508114f6cb410ddef3 Author: Sean Christopherson Date: Tue Feb 7 00:21:54 2023 +0000 KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask Define the "physical table max index mask" as bits 8:0, not 9:0. x2AVIC currently supports a max of 512 entries, i.e. the max index is 511, and the inputs to GENMASK_ULL() are inclusive. The bug is benign as bit 9 is reserved and never set by KVM, i.e. KVM is just clearing bits that are guaranteed to be zero. Note, as of this writing, APM "Rev. 3.39-October 2022" incorrectly states that bits 11:8 are reserved in Table B-1. VMCB Layout, Control Area. I.e. that table wasn't updated when x2AVIC support was added. Opportunistically fix the comment for the max AVIC ID to align with the code, and clean up comment formatting too. Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode") Cc: stable@vger.kernel.org Cc: Alejandro Jimenez Cc: Suravee Suthikulpanit Signed-off-by: Sean Christopherson Reviewed-by: Suravee Suthikulpanit Tested-by: Suravee Suthikulpanit Message-Id: <20230207002156.521736-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 3dc40cf89b9b763910cb0540a35f9d66a067475d Author: Paolo Bonzini Date: Tue Mar 14 08:35:16 2023 -0400 selftests: KVM: skip hugetlb tests if huge pages are not available Right now, if KVM memory stress tests are run with hugetlb sources but hugetlb is not available (either in the kernel or because /proc/sys/vm/nr_hugepages is 0) the test will fail with a memory allocation error. This makes it impossible to add tests that default to hugetlb-backed memory, because on a machine with a default configuration they will fail. Therefore, check HugePages_Total as well and, if zero, direct the user to enable hugepages in procfs. Furthermore, return KSFT_SKIP whenever hugetlb is not available. Signed-off-by: Paolo Bonzini commit 53293cb81be6db06306666d51e85778725934be5 Author: Rong Tao Date: Wed Dec 21 20:28:49 2022 +0800 KVM: VMX: Use tabs instead of spaces for indentation Code indentation should use tabs where possible and miss a '*'. Signed-off-by: Rong Tao Message-Id: Signed-off-by: Paolo Bonzini commit 06e18547286068be803ba28c6d1c377e94f8745b Author: Rong Tao Date: Wed Dec 21 20:24:32 2022 +0800 KVM: VMX: Fix indentation coding style issue Code indentation should use tabs where possible. Signed-off-by: Rong Tao Message-Id: Signed-off-by: Paolo Bonzini commit 77900bffed14894476969042718a9ca05eb1f477 Author: Paolo Bonzini Date: Tue Mar 14 07:40:56 2023 -0400 KVM: nVMX: remove unnecessary #ifdef nested_vmx_check_controls() has already run by the time KVM checks host state, so the "host address space size" exit control can only be set on x86-64 hosts. Simplify the condition at the cost of adding some dead code to 32-bit kernels. Signed-off-by: Paolo Bonzini commit 112e66017bff7f2837030f34c2bc19501e9212d5 Author: Paolo Bonzini Date: Fri Mar 10 11:10:56 2023 -0500 KVM: nVMX: add missing consistency checks for CR0 and CR4 The effective values of the guest CR0 and CR4 registers may differ from those included in the VMCS12. In particular, disabling EPT forces CR4.PAE=1 and disabling unrestricted guest mode forces CR0.PG=CR0.PE=1. Therefore, checks on these bits cannot be delegated to the processor and must be performed by KVM. Reported-by: Reima ISHII Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit bceeedb2f0b803fa188b931b30c064ee60196f09 Merge: eeac8ede17557 47053904e1828 Author: Paolo Bonzini Date: Tue Mar 14 09:40:39 2023 -0400 Merge tag 'kvmarm-fixes-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.3, part #1 A single patch to address a rather annoying bug w.r.t. guest timer offsetting. Effectively the synchronization of timer offsets between vCPUs was broken, leading to inconsistent timer reads within the VM. commit 083a25b18d6ad9f1f540e629909aa3eaaaf01823 Author: Shengjiu Wang Date: Thu Mar 9 15:13:37 2023 +0800 ASoC: soc-pcm: fix hw->formats cleared by soc_pcm_hw_init() for dpcm The hw->formats may be set by snd_dmaengine_pcm_refine_runtime_hwparams() in component's startup()/open(), but soc_pcm_hw_init() will init hw->formats in dpcm_runtime_setup_fe() after component's startup()/open(), which causes the valuable hw->formats to be cleared. So need to store the hw->formats before initialization, then restore it after initialization. Signed-off-by: Shengjiu Wang Link: https://lore.kernel.org/r/1678346017-3660-1-git-send-email-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 9c691a42b8926c8966561265cdae3ddc7464d3a2 Author: Eugene Huang Date: Tue Mar 14 17:05:53 2023 +0800 ASoC: Intel: soc-acpi: add table for Intel 'Rooks County' NUC M15 Same topology as the HP Omen 16-k0005TX, except with the rt1316 amp on link2. Link: https://github.com/thesofproject/linux/issues/4088 Signed-off-by: Eugene Huang Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20230314090553.498664-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 3c728b1bc5b99c5275ac5c7788ef814c0e51ef54 Author: Eugene Huang Date: Tue Mar 14 17:05:52 2023 +0800 ASOC: Intel: sof_sdw: add quirk for Intel 'Rooks County' NUC M15 Same quirks as the 'Bishop County' NUC M15, except the rt711 is in the 'JD2 100K' jack detection mode. Link: https://github.com/thesofproject/linux/issues/4088 Signed-off-by: Eugene Huang Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20230314090553.498664-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 6175b70df95ed3b8fe177cb20b9b00b1f9008cc4 Author: Randy Dunlap Date: Wed Feb 22 23:01:15 2023 -0800 powerpc/pseries: RTAS work area requires GENERIC_ALLOCATOR The RTAS work area allocator uses code that is built by GENERIC_ALLOCATOR, so the PSERIES Kconfig should select the required Kconfig symbol to fix multiple build errors. powerpc64-linux-ld: arch/powerpc/platforms/pseries/rtas-work-area.o: in function `.rtas_work_area_allocator_init': rtas-work-area.c:(.init.text+0x288): undefined reference to `.gen_pool_create' powerpc64-linux-ld: rtas-work-area.c:(.init.text+0x2dc): undefined reference to `.gen_pool_set_algo' powerpc64-linux-ld: rtas-work-area.c:(.init.text+0x310): undefined reference to `.gen_pool_add_owner' powerpc64-linux-ld: rtas-work-area.c:(.init.text+0x43c): undefined reference to `.gen_pool_destroy' powerpc64-linux-ld: arch/powerpc/platforms/pseries/rtas-work-area.o:(.toc+0x0): undefined reference to `gen_pool_first_fit_order_align' powerpc64-linux-ld: arch/powerpc/platforms/pseries/rtas-work-area.o: in function `.__rtas_work_area_alloc': rtas-work-area.c:(.ref.text+0x14c): undefined reference to `.gen_pool_alloc_algo_owner' powerpc64-linux-ld: rtas-work-area.c:(.ref.text+0x238): undefined reference to `.gen_pool_alloc_algo_owner' powerpc64-linux-ld: arch/powerpc/platforms/pseries/rtas-work-area.o: in function `.rtas_work_area_free': rtas-work-area.c:(.ref.text+0x44c): undefined reference to `.gen_pool_free_owner' Fixes: 43033bc62d34 ("powerpc/pseries: add RTAS work area allocator") Signed-off-by: Randy Dunlap Reviewed-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org commit 172fa6366c0c84eda31f1bc34e6c3e4698786215 Author: Jules Maselbas Date: Wed Feb 22 18:30:09 2023 +0100 tee: optee: Fix typo Unuspported -> Unsupported Fix typo Unuspported -> Unsupported Signed-off-by: Jules Maselbas Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 773e8e7d07b753474b2ccd605ff092faaa9e65b9 Author: Enrico Sau Date: Tue Mar 14 10:00:59 2023 +0100 USB: serial: option: add Telit FE990 compositions Add the following Telit FE990 compositions: 0x1080: tty, adb, rmnet, tty, tty, tty, tty 0x1081: tty, adb, mbim, tty, tty, tty, tty 0x1082: rndis, tty, adb, tty, tty, tty, tty 0x1083: tty, adb, ecm, tty, tty, tty, tty Signed-off-by: Enrico Sau Link: https://lore.kernel.org/r/20230314090059.77876-1-enrico.sau@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit b3cdf730486b048ca0bf23bef050550d9fd40422 Author: Alexander Stein Date: Wed Mar 8 11:17:20 2023 +0100 arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes Add them to the SoC .dtsi, so that not every board has to specify them. Fixes: 1225396fefea ("arm64: dts: imx93: add lpi2c nodes") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 1adab2922c58e7ff4fa9f0b43695079402cce876 Author: Ivan Bornyakov Date: Mon Mar 6 16:25:26 2023 +0300 bus: imx-weim: fix branch condition evaluates to a garbage value If bus type is other than imx50_weim_devtype and have no child devices, variable 'ret' in function weim_parse_dt() will not be initialized, but will be used as branch condition and return value. Fix this by initializing 'ret' with 0. This was discovered with help of clang-analyzer, but the situation is quite possible in real life. Fixes: 52c47b63412b ("bus: imx-weim: improve error handling upon child probe-failure") Signed-off-by: Ivan Bornyakov Cc: stable@vger.kernel.org Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 62fb54148cd6eb456ff031be8fb447c98cf0bd9b Author: Marek Vasut Date: Tue Feb 28 22:52:44 2023 +0100 arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes Add #sound-dai-cells properties to SAI nodes. Reviewed-by: Adam Ford Reviewed-by: Fabio Estevam Fixes: 9e9860069725 ("arm64: dts: imx8mn: Add SAI nodes") Signed-off-by: Marek Vasut Reviewed-by: Marco Felsch Signed-off-by: Shawn Guo commit 1cd489e1ada1cffa56bd06fd4609f5a60a985d43 Author: Peng Fan Date: Sun Feb 26 21:12:14 2023 +0800 ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' Signed-off-by: Peng Fan Fixes: 9c7016f1ca6d ("ARM: dts: imx: add devicetree for Tolino Shine 2 HD") Signed-off-by: Shawn Guo commit 957c04e9784c7c757e8cc293d7fb2a60cdf461b6 Author: Peng Fan Date: Sun Feb 26 21:12:13 2023 +0800 ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' Signed-off-by: Peng Fan Fixes: c100ea86e6ab ("ARM: dts: add Netronix E60K02 board common file") Signed-off-by: Shawn Guo commit 3d37f7685d525e58674c23d607020e66d501dcd1 Author: Peng Fan Date: Sun Feb 26 21:12:12 2023 +0800 ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names' Signed-off-by: Peng Fan Fixes: 3bb3fd856505 ("ARM: dts: add Netronix E70K02 board common file") Signed-off-by: Shawn Guo commit 194c3e7d7e1230201fb341f40cfd87760a30e42a Author: Alexander Stein Date: Thu Feb 23 07:05:43 2023 +0100 arm64: dts: imx93: Fix eqos properties 'macirq' is supposed to be listed first. Also only 'snps,clk-csr' is listed in the bindings while 'clk_csr' is only supported for legacy reasons. See commit 83936ea8d8ad2 ("net: stmmac: add a parse for new property 'snps,clk-csr'") Fixes: 1f4263ea6a4b ("arm64: dts: imx93: add eqos support") Signed-off-by: Alexander Stein Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 1d0d5b917d6af71fa3c9599c3a7198a4175156a5 Author: Marek Vasut Date: Fri Feb 17 20:15:38 2023 +0100 arm64: dts: imx8mp: Fix LCDIF2 node clock order The 'axi' clock are the bus APB clock, the 'disp_axi' clock are the pixel data AXI clock. The naming is confusing. Fix the clock order. Fixes: 94e6197dadc9 ("arm64: dts: imx8mp: Add LCDIF2 & LDB nodes") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit 32f86da7c86b27ebed31c24453a0713f612e43fb Author: Krzysztof Kozlowski Date: Fri Feb 17 16:06:26 2023 +0100 arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name The WM8960 Linux driver expects the clock to be named "mclk". Otherwise the clock will be ignored and not prepared/enabled by the driver. Fixes: 40ba2eda0a7b ("arm64: dts: imx8mm-nitrogen-r2: add audio") Cc: Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit feafeb53140af3cde3fba46b292b15b3a0c0635c Author: Andrew Halaney Date: Tue Feb 14 11:15:05 2023 -0600 arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio The deprecated property is named snps,reset-gpio, but this devicetree used snps,reset-gpios instead which results in the reset not being used and the following make dtbs_check error: ./arch/arm64/boot/dts/freescale/imx8dxl-evk.dtb: ethernet@5b050000: 'snps,reset-gpio' is a dependency of 'snps,reset-delays-us' From schema: ./Documentation/devicetree/bindings/net/snps,dwmac.yaml Use the preferred method of defining the reset gpio in the phy node itself. Note that this drops the 10 us pre-delay, but prior this wasn't used at all and a pre-delay doesn't make much sense in this context so it should be fine. Fixes: 8dd495d12374 ("arm64: dts: freescale: add support for i.MX8DXL EVK board") Signed-off-by: Andrew Halaney Acked-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 512dd354718b98c60d4ff6017ff8c9f66c10d03f Author: Alex Elder Date: Fri Mar 10 13:37:09 2023 -0600 net: ipa: fix a surprising number of bad offsets A recent commit eliminated a hack that adjusted the offset used for many GSI registers. It became possible because we now specify all GSI register offsets explicitly for every version of IPA. Unfortunately, a large number of register offsets were *not* updated as they should have been in that commit. For IPA v4.5+, the offset for every GSI register *except* the two inter-EE interrupt masking registers were supposed to have been reduced by 0xd000. Tested-by: Luca Weiss Tested-by: Dmitry Baryshkov # SM8350-HDK Fixes: 59b12b1d27f3 ("net: ipa: kill gsi->virt_raw") Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20230310193709.1477102-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit 0b086d76e7b011772b0ac214c6e5fd5816eff2df Author: Arınç ÜNAL Date: Fri Mar 10 10:33:38 2023 +0300 net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used As my testing on the MCM MT7530 switch on MT7621 SoC shows, setting the PLL frequency does not affect MII modes other than trgmii on port 5 and port 6. So the assumption is that the operation here called "setting the PLL frequency" actually sets the frequency of the TRGMII TX clock. Make it so that it and the rest of the trgmii setup run only when the trgmii mode is used. Tested rgmii and trgmii modes of port 6 on MCM MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI Bananapi BPI-R2. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Tested-by: Arınç ÜNAL Signed-off-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230310073338.5836-2-arinc.unal@arinc9.com Signed-off-by: Jakub Kicinski commit feb03fd11c5616f3a47e4714d2f9917d0f1a2edd Author: Arınç ÜNAL Date: Fri Mar 10 10:33:37 2023 +0300 net: dsa: mt7530: remove now incorrect comment regarding port 5 Remove now incorrect comment regarding port 5 as GMAC5. This is supposed to be supported since commit 38f790a80560 ("net: dsa: mt7530: Add support for port 5") under mt7530_setup_port5(). Fixes: 38f790a80560 ("net: dsa: mt7530: Add support for port 5") Signed-off-by: Arınç ÜNAL Link: https://lore.kernel.org/r/20230310073338.5836-1-arinc.unal@arinc9.com Signed-off-by: Jakub Kicinski commit 1a9dc5610ef89d807acdcfbff93a558f341a44da Author: Daniil Tatianin Date: Thu Mar 9 23:15:56 2023 +0300 qed/qed_dev: guard against a possible division by zero Previously we would divide total_left_rate by zero if num_vports happened to be 1 because non_requested_count is calculated as num_vports - req_count. Guard against this by validating num_vports at the beginning and returning an error otherwise. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: bcd197c81f63 ("qed: Add vport WFQ configuration APIs") Signed-off-by: Daniil Tatianin Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230309201556.191392-1-d-tatianin@yandex-team.ru Signed-off-by: Jakub Kicinski commit 22a825c541d775c1dbe7b2402786025acad6727b Author: D. Wythe Date: Wed Mar 8 16:17:12 2023 +0800 net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() When performing a stress test on SMC-R by rmmod mlx5_ib driver during the wrk/nginx test, we found that there is a probability of triggering a panic while terminating all link groups. This issue dues to the race between smc_smcr_terminate_all() and smc_buf_create(). smc_smcr_terminate_all smc_buf_create /* init */ conn->sndbuf_desc = NULL; ... __smc_lgr_terminate smc_conn_kill smc_close_abort smc_cdc_get_slot_and_msg_send __softirqentry_text_start smc_wr_tx_process_cqe smc_cdc_tx_handler READ(conn->sndbuf_desc->len); /* panic dues to NULL sndbuf_desc */ conn->sndbuf_desc = xxx; This patch tries to fix the issue by always to check the sndbuf_desc before send any cdc msg, to make sure that no null pointer is seen during cqe processing. Fixes: 0b29ec643613 ("net/smc: immediate termination for SMCR link groups") Signed-off-by: D. Wythe Reviewed-by: Tony Lu Reviewed-by: Wenjia Zhang Link: https://lore.kernel.org/r/1678263432-17329-1-git-send-email-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 131db499162274858bdbd7b5323a639da4aab86c Author: Vadim Fedorenko Date: Fri Mar 10 07:13:56 2023 -0800 bnxt_en: reset PHC frequency in free-running mode When using a PHC in shared between multiple hosts, the previous frequency value may not be reset and could lead to host being unable to compensate the offset with timecounter adjustments. To avoid such state reset the hardware frequency of PHC to zero on init. Some refactoring is needed to make code readable. Fixes: 85036aee1938 ("bnxt_en: Add a non-real time mode to access NIC clock") Signed-off-by: Vadim Fedorenko Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230310151356.678059-1-vadfed@meta.com Signed-off-by: Jakub Kicinski commit 8b3a149db461d3286d1e211112de3b44ccaeaf71 Author: Ard Biesheuvel Date: Sun Mar 12 23:00:03 2023 +0100 efi: earlycon: Reprobe after parsing config tables Commit 732ea9db9d8a ("efi: libstub: Move screen_info handling to common code") reorganized the earlycon handling so that all architectures pass the screen_info data via a EFI config table instead of populating struct screen_info directly, as the latter is only possible when the EFI stub is baked into the kernel (and not into the decompressor). However, this means that struct screen_info may not have been populated yet by the time the earlycon probe takes place, and this results in a non-functional early console. So let's probe again right after parsing the config tables and populating struct screen_info. Note that this means that earlycon output starts a bit later than before, and so it may fail to capture issues that occur while doing the early EFI initialization. Fixes: 732ea9db9d8a ("efi: libstub: Move screen_info handling to common code") Reported-by: Shawn Guo Tested-by: Shawn Guo Signed-off-by: Ard Biesheuvel commit a33a6eaa19d3af261e8708bfc8ba62020703117f Merge: e8c8361cfdbf4 bf9bec4cb3a40 Author: Alexei Starovoitov Date: Mon Mar 13 13:20:58 2023 -0700 Merge branch 'bpf: Allow reads from uninit stack' Merge commit bf9bec4cb3a4 ("Merge branch 'bpf: Allow reads from uninit stack'") from bpf-next to bpf tree to address verification issues in some programs due to stack usage. Signed-off-by: Alexei Starovoitov commit 3bc57292278a0b6ac4656cad94c14f2453344b57 Author: NeilBrown Date: Mon Mar 6 09:36:25 2023 +1100 md: avoid signed overflow in slot_store() slot_store() uses kstrtouint() to get a slot number, but stores the result in an "int" variable (by casting a pointer). This can result in a negative slot number if the unsigned int value is very large. A negative number means that the slot is empty, but setting a negative slot number this way will not remove the device from the array. I don't think this is a serious problem, but it could cause confusion and it is best to fix it. Reported-by: Dan Carpenter Signed-off-by: NeilBrown Signed-off-by: Song Liu commit 9db481c909dd6312ccfbdc7e343b50e41c727483 Author: Johan Hovold Date: Mon Mar 6 08:56:48 2023 +0100 memory: tegra30-emc: fix interconnect registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: d5ef16ba5fbe ("memory: tegra20: Support interconnect framework") Cc: stable@vger.kernel.org # 5.11 Cc: Dmitry Osipenko Acked-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-21-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit c5587f61ec050f7e9ebb3e2da29d12af63e833d3 Author: Johan Hovold Date: Mon Mar 6 08:56:47 2023 +0100 memory: tegra20-emc: fix interconnect registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: d5ef16ba5fbe ("memory: tegra20: Support interconnect framework") Cc: stable@vger.kernel.org # 5.11 Cc: Dmitry Osipenko Acked-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-20-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit abd9f1b49cf25eebeaba193c7707355be3f48dae Author: Johan Hovold Date: Mon Mar 6 08:56:46 2023 +0100 memory: tegra124-emc: fix interconnect registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: 380def2d4cf2 ("memory: tegra124: Support interconnect framework") Cc: stable@vger.kernel.org # 5.12 Cc: Dmitry Osipenko Acked-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-19-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 5553055c62683ce339f9ef5fb2a26c8331485d68 Author: Johan Hovold Date: Mon Mar 6 08:56:45 2023 +0100 memory: tegra: fix interconnect registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: 06f079816d4c ("memory: tegra-mc: Add interconnect framework") Cc: stable@vger.kernel.org # 5.11 Cc: Dmitry Osipenko Acked-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-18-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 859ad5f177efa59f6b8a2fac20561ca5cb13c89f Author: Johan Hovold Date: Mon Mar 6 08:56:44 2023 +0100 interconnect: exynos: drop redundant link destroy There is no longer any need to explicitly destroy node links as this is now done when the node is destroyed as part of icc_nodes_remove(). Reviewed-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-17-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit c9e46ca612cfbb0cf890f7ae7389b742e90efe64 Author: Johan Hovold Date: Mon Mar 6 08:56:43 2023 +0100 interconnect: exynos: fix registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to trigger a NULL-pointer deference when either a NULL pointer or not fully initialised node is returned from exynos_generic_icc_xlate(). Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: 2f95b9d5cf0b ("interconnect: Add generic interconnect driver for Exynos SoCs") Cc: stable@vger.kernel.org # 5.11 Cc: Sylwester Nawrocki Reviewed-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-16-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 3aab264875bf3c915ea2517fae1eec213e0b4987 Author: Johan Hovold Date: Mon Mar 6 08:56:42 2023 +0100 interconnect: exynos: fix node leak in probe PM QoS error path Make sure to add the newly allocated interconnect node to the provider before adding the PM QoS request so that the node is freed on errors. Fixes: 2f95b9d5cf0b ("interconnect: Add generic interconnect driver for Exynos SoCs") Cc: stable@vger.kernel.org # 5.11 Cc: Sylwester Nawrocki Reviewed-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-15-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit bfe7bcd2b9f5215de2144f097f39971180e7ea54 Author: Johan Hovold Date: Mon Mar 6 08:56:39 2023 +0100 interconnect: qcom: msm8974: fix registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: 4e60a9568dc6 ("interconnect: qcom: add msm8974 driver") Cc: stable@vger.kernel.org # 5.5 Reviewed-by: Brian Masney Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-12-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 74240a5bebd48d8b843c6d0f1acfaa722a5abeb7 Author: Johan Hovold Date: Mon Mar 6 08:56:38 2023 +0100 interconnect: qcom: rpmh: fix registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: 976daac4a1c5 ("interconnect: qcom: Consolidate interconnect RPMh support") Cc: stable@vger.kernel.org # 5.7 Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-11-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 6570d1d46eeade82965ccc4a3ab7d778898ef4bf Author: Johan Hovold Date: Mon Mar 6 08:56:37 2023 +0100 interconnect: qcom: rpmh: fix probe child-node error handling Make sure to clean up and release resources properly also in case probe fails when populating child devices. Fixes: 57eb14779dfd ("interconnect: qcom: icc-rpmh: Support child NoC device probe") Cc: stable@vger.kernel.org # 6.0 Cc: Luca Weiss Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-10-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 90ae93d8affc1061cd87ca8ddd9a838c7d31a158 Author: Johan Hovold Date: Mon Mar 6 08:56:36 2023 +0100 interconnect: qcom: rpm: fix registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: 62feb14ee8a3 ("interconnect: qcom: Consolidate interconnect RPM support") Fixes: 30c8fa3ec61a ("interconnect: qcom: Add MSM8916 interconnect provider driver") Cc: stable@vger.kernel.org # 5.7 Reviewed-by: Konrad Dybcio Reviewed-by: Jun Nie Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-9-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 4928f67bc911e46a43004251a4d7eb2259ba6077 Author: Yishai Hadas Date: Wed Mar 8 17:57:23 2023 +0200 vfio/mlx5: Fix the report of dirty_bytes upon pre-copy Fix the report of dirty_bytes upon pre-copy to include both the existing data on the migration file and the device extra bytes. This gives a better close estimation to what can be passed any more as part of pre-copy. Fixes: 0dce165b1adf ("vfio/mlx5: Introduce vfio precopy ioctl implementation") Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/20230308155723.108218-1-yishaih@nvidia.com Signed-off-by: Alex Williamson commit ee06a3ef7e3cddb62b90ac40aa661d3c12f7cabc Author: Jurica Vukadin Date: Tue Mar 7 20:40:39 2023 +0100 kconfig: Update config changed flag before calling callback Prior to commit 5ee546594025 ("kconfig: change sym_change_count to a boolean flag"), the conf_updated flag was set to the new value *before* calling the callback. xconfig's save action depends on this behaviour, because xconfig calls conf_get_changed() directly from the callback and now sees the old value, thus never enabling the save button or the shortcut. Restore the previous behaviour. Fixes: 5ee546594025 ("kconfig: change sym_change_count to a boolean flag") Signed-off-by: Jurica Vukadin Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit f6da81f650fa47b61b847488f3938d43f90d093d Author: Reiji Watanabe Date: Sun Mar 12 20:32:34 2023 -0700 KVM: arm64: PMU: Don't save PMCR_EL0.{C,P} for the vCPU Presently, when a guest writes 1 to PMCR_EL0.{C,P}, which is WO/RAZ, KVM saves the register value, including these bits. When userspace reads the register using KVM_GET_ONE_REG, KVM returns the saved register value as it is (the saved value might have these bits set). This could result in userspace setting these bits on the destination during migration. Consequently, KVM may end up resetting the vPMU counter registers (PMCCNTR_EL0 and/or PMEVCNTR_EL0) to zero on the first KVM_RUN after migration. Fix this by not saving those bits when a guest writes 1 to those bits. Fixes: ab9468340d2b ("arm64: KVM: Add access handler for PMCR register") Cc: stable@vger.kernel.org Reviewed-by: Marc Zyngier Signed-off-by: Reiji Watanabe Link: https://lore.kernel.org/r/20230313033234.1475987-1-reijiw@google.com Signed-off-by: Oliver Upton commit 9228b26194d1cc00449f12f306f53ef2e234a55b Author: Reiji Watanabe Date: Sun Mar 12 20:32:08 2023 -0700 KVM: arm64: PMU: Fix GET_ONE_REG for vPMC regs to return the current value Have KVM_GET_ONE_REG for vPMU counter (vPMC) registers (PMCCNTR_EL0 and PMEVCNTR_EL0) return the sum of the register value in the sysreg file and the current perf event counter value. Values of vPMC registers are saved in sysreg files on certain occasions. These saved values don't represent the current values of the vPMC registers if the perf events for the vPMCs count events after the save. The current values of those registers are the sum of the sysreg file value and the current perf event counter value. But, when userspace reads those registers (using KVM_GET_ONE_REG), KVM returns the sysreg file value to userspace (not the sum value). Fix this to return the sum value for KVM_GET_ONE_REG. Fixes: 051ff581ce70 ("arm64: KVM: Add access handler for event counter register") Cc: stable@vger.kernel.org Reviewed-by: Marc Zyngier Signed-off-by: Reiji Watanabe Link: https://lore.kernel.org/r/20230313033208.1475499-1-reijiw@google.com Signed-off-by: Oliver Upton commit 3e453522593d74a87cf68a38e14aa36ebca1dbcd Author: Xiao Ni Date: Wed Feb 22 11:59:16 2023 +0800 md: Free resources in __md_stop If md_run() fails after ->active_io is initialized, then percpu_ref_exit is called in error path. However, later md_free_disk will call percpu_ref_exit again which leads to a panic because of null pointer dereference. It can also trigger this bug when resources are initialized but are freed in error path, then will be freed again in md_free_disk. BUG: kernel NULL pointer dereference, address: 0000000000000038 Oops: 0000 [#1] PREEMPT SMP Workqueue: md_misc mddev_delayed_delete RIP: 0010:free_percpu+0x110/0x630 Call Trace: __percpu_ref_exit+0x44/0x70 percpu_ref_exit+0x16/0x90 md_free_disk+0x2f/0x80 disk_release+0x101/0x180 device_release+0x84/0x110 kobject_put+0x12a/0x380 kobject_put+0x160/0x380 mddev_delayed_delete+0x19/0x30 process_one_work+0x269/0x680 worker_thread+0x266/0x640 kthread+0x151/0x1b0 ret_from_fork+0x1f/0x30 For creating raid device, md raid calls do_md_run->md_run, dm raid calls md_run. We alloc those memory in md_run. For stopping raid device, md raid calls do_md_stop->__md_stop, dm raid calls md_stop->__md_stop. So we can free those memory resources in __md_stop. Fixes: 72adae23a72c ("md: Change active_io to percpu") Reported-and-tested-by: Yu Kuai Signed-off-by: Xiao Ni Signed-off-by: Song Liu commit fc89d7fb499b0162e081f434d45e8d1b47e82ece Merge: eeac8ede17557 ae43c20da2a77 Author: Linus Torvalds Date: Mon Mar 13 10:43:09 2023 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Some virtio / vhost / vdpa fixes accumulated so far" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: tools/virtio: Ignore virtio-trace/trace-agent vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready vhost-vdpa: free iommu domain after last use during cleanup vdpa/mlx5: should not activate virtq object when suspended vp_vdpa: fix the crash in hot unplug with vp_vdpa commit 71f8afa2b66e356f435b6141b4a9ccf953e18356 Author: Kees Jan Koster Date: Sat Feb 18 15:18:30 2023 +0100 USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs The Silicon Labs IFS-USB-DATACABLE is used in conjunction with for example the Quint UPSes. It is used to enable Modbus communication with the UPS to query configuration, power and battery status. Signed-off-by: Kees Jan Koster Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 5683e1488aa9b0805a9403d215e48fed29d6d923 Author: Lorenzo Bianconi Date: Mon Mar 6 18:42:51 2023 +0100 wifi: mt76: connac: do not check WED status for non-mmio devices WED is supported just for mmio devices, so do not check it for usb or sdio devices. This patch fixes the crash reported below: [ 21.946627] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d [ 22.525298] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3) [ 22.548274] wlp0s3u1i3: authenticate with c4:41:1e:f5:2b:1d [ 22.557694] wlp0s3u1i3: send auth to c4:41:1e:f5:2b:1d (try 1/3) [ 22.565885] wlp0s3u1i3: authenticated [ 22.569502] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 1/3) [ 22.578966] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=30 aid=3) [ 22.579113] wlp0s3u1i3: c4:41:1e:f5:2b:1d rejected association temporarily; comeback duration 1000 TU (1024 ms) [ 23.649518] wlp0s3u1i3: associate with c4:41:1e:f5:2b:1d (try 2/3) [ 23.752528] wlp0s3u1i3: RX AssocResp from c4:41:1e:f5:2b:1d (capab=0x11 status=0 aid=3) [ 23.797450] wlp0s3u1i3: associated [ 24.959527] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) [ 24.959640] BUG: unable to handle page fault for address: ffff88800c223200 [ 24.959706] #PF: supervisor instruction fetch in kernel mode [ 24.959788] #PF: error_code(0x0011) - permissions violation [ 24.959846] PGD 2c01067 P4D 2c01067 PUD 2c02067 PMD c2a8063 PTE 800000000c223163 [ 24.959957] Oops: 0011 [#1] PREEMPT SMP [ 24.960009] CPU: 0 PID: 391 Comm: wpa_supplicant Not tainted 6.2.0-kvm #18 [ 24.960089] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 [ 24.960191] RIP: 0010:0xffff88800c223200 [ 24.960446] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282 [ 24.960513] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058 [ 24.960598] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010 [ 24.960682] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c [ 24.960766] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 0000000000000001 [ 24.960853] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644 [ 24.960950] FS: 00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 [ 24.961036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.961106] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0 [ 24.961190] Call Trace: [ 24.961219] [ 24.961245] ? mt76_connac_mcu_add_key+0x2cf/0x310 [ 24.961313] ? mt7921_set_key+0x150/0x200 [ 24.961365] ? drv_set_key+0xa9/0x1b0 [ 24.961418] ? ieee80211_key_enable_hw_accel+0xd9/0x240 [ 24.961485] ? ieee80211_key_replace+0x3f3/0x730 [ 24.961541] ? crypto_shash_setkey+0x89/0xd0 [ 24.961597] ? ieee80211_key_link+0x2d7/0x3a0 [ 24.961664] ? crypto_aead_setauthsize+0x31/0x50 [ 24.961730] ? sta_info_hash_lookup+0xa6/0xf0 [ 24.961785] ? ieee80211_add_key+0x1fc/0x250 [ 24.961842] ? rdev_add_key+0x41/0x140 [ 24.961882] ? nl80211_parse_key+0x6c/0x2f0 [ 24.961940] ? nl80211_new_key+0x24a/0x290 [ 24.961984] ? genl_rcv_msg+0x36c/0x3a0 [ 24.962036] ? rdev_mod_link_station+0xe0/0xe0 [ 24.962102] ? nl80211_set_key+0x410/0x410 [ 24.962143] ? nl80211_pre_doit+0x200/0x200 [ 24.962187] ? genl_bind+0xc0/0xc0 [ 24.962217] ? netlink_rcv_skb+0xaa/0xd0 [ 24.962259] ? genl_rcv+0x24/0x40 [ 24.962300] ? netlink_unicast+0x224/0x2f0 [ 24.962345] ? netlink_sendmsg+0x30b/0x3d0 [ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 [ 24.962388] ? ____sys_sendmsg+0x109/0x1b0 [ 24.962440] ? __import_iovec+0x2e/0x110 [ 24.962482] ? ___sys_sendmsg+0xbe/0xe0 [ 24.962525] ? mod_objcg_state+0x25c/0x330 [ 24.962576] ? __dentry_kill+0x19e/0x1d0 [ 24.962618] ? call_rcu+0x18f/0x270 [ 24.962660] ? __dentry_kill+0x19e/0x1d0 [ 24.962702] ? __x64_sys_sendmsg+0x70/0x90 [ 24.962744] ? do_syscall_64+0x3d/0x80 [ 24.962796] ? exit_to_user_mode_prepare+0x1b/0x70 [ 24.962852] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 24.962913] [ 24.962939] Modules linked in: [ 24.962981] CR2: ffff88800c223200 [ 24.963022] ---[ end trace 0000000000000000 ]--- [ 24.963087] RIP: 0010:0xffff88800c223200 [ 24.963323] RSP: 0018:ffffc90000ff7698 EFLAGS: 00010282 [ 24.963376] RAX: ffff888028397010 RBX: ffff88800c26e630 RCX: 0000000000000058 [ 24.963458] RDX: ffff88800c26f844 RSI: 0000000000000006 RDI: ffff888028397010 [ 24.963538] RBP: ffff88800ea72f00 R08: 18b873fbab2b964c R09: be06b38235f3c63c [ 24.963622] R10: 18b873fbab2b964c R11: be06b38235f3c63c R12: 0000000000000001 [ 24.963705] R13: ffff88800c26f84c R14: ffff8880063f0ff8 R15: ffff88800c26e644 [ 24.963788] FS: 00007effcea327c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 [ 24.963871] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.963941] CR2: ffff88800c223200 CR3: 000000000eaa2000 CR4: 00000000000006b0 [ 24.964018] note: wpa_supplicant[391] exited with irqs disabled Fixes: d1369e515efe ("wifi: mt76: connac: introduce mt76_connac_mcu_sta_wed_update utility routine") Signed-off-by: Lorenzo Bianconi Acked-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/c42168429453474213fa8244bf4b069de4531f40.1678124335.git.lorenzo@kernel.org commit c2f73eacee3bf1df2cfe25e1f08a3cae98b1df3d Author: Felix Fietkau Date: Wed Mar 1 17:37:39 2023 +0100 wifi: mt76: mt7915: add back 160MHz channel width support for MT7915 A number of users reported that this support was working fine before it got removed. Add it back, but leave out the unsupported 80+80 mode. Fixes: ac922bd60ace ("wifi: mt76: mt7915: remove BW160 and BW80+80 support") Signed-off-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230301163739.52314-1-nbd@nbd.name commit 41130c32f3a18fcc930316da17f3a5f3bc326aa1 Author: Lorenzo Bianconi Date: Thu Feb 23 00:10:25 2023 +0100 wifi: mt76: do not run mt76_unregister_device() on unregistered hw Trying to probe a mt7921e pci card without firmware results in a successful probe where ieee80211_register_hw hasn't been called. When removing the driver, ieee802111_unregister_hw is called unconditionally leading to a kernel NULL pointer dereference. Fix the issue running mt76_unregister_device routine just for registered hw. Link: https://bugs.debian.org/1029116 Link: https://bugs.kali.org/view.php?id=8140 Reported-by: Stuart Hayhurst Fixes: 1c71e03afe4b ("mt76: mt7921: move mt7921_init_hw in a dedicated work") Tested-by: Helmut Grohne Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/be3457d82f4e44bb71a22b2b5db27b644a37b1e1.1677107277.git.lorenzo@kernel.org commit dda5c809d42389b82f37cbbe562044d8a29083c6 Merge: e041a2a550582 eeac8ede17557 Author: Mark Brown Date: Mon Mar 13 13:18:59 2023 +0000 Merge tag 'v6.3-rc2' into asoc-6.3 to fix clock related failures Linux 6.3-rc2 commit 72f7754dcf31c87c92c0c353dcf747814cc5ce10 Author: Dionna Glaze Date: Thu Feb 16 11:08:02 2023 +0100 virt/coco/sev-guest: Add throttling awareness A potentially malicious SEV guest can constantly hammer the hypervisor using this driver to send down requests and thus prevent or at least considerably hinder other guests from issuing requests to the secure processor which is a shared platform resource. Therefore, the host is permitted and encouraged to throttle such guest requests. Add the capability to handle the case when the hypervisor throttles excessive numbers of requests issued by the guest. Otherwise, the VM platform communication key will be disabled, preventing the guest from attesting itself. Realistically speaking, a well-behaved guest should not even care about throttling. During its lifetime, it would end up issuing a handful of requests which the hardware can easily handle. This is more to address the case of a malicious guest. Such guest should get throttled and if its VMPCK gets disabled, then that's its own wrongdoing and perhaps that guest even deserves it. To the implementation: the hypervisor signals with SNP_GUEST_REQ_ERR_BUSY that the guest requests should be throttled. That error code is returned in the upper 32-bit half of exitinfo2 and this is part of the GHCB spec v2. So the guest is given a throttling period of 1 minute in which it retries the request every 2 seconds. This is a good default but if it turns out to not pan out in practice, it can be tweaked later. For safety, since the encryption algorithm in GHCBv2 is AES_GCM, control must remain in the kernel to complete the request with the current sequence number. Returning without finishing the request allows the guest to make another request but with different message contents. This is IV reuse, and breaks cryptographic protections. [ bp: - Rewrite commit message and do a simplified version. - The stable tags are supposed to denote that a cleanup should go upfront before backporting this so that any future fixes to this can preserve the sanity of the backporter(s). ] Fixes: d5af44dde546 ("x86/sev: Provide support for SNP guest request NAEs") Signed-off-by: Dionna Glaze Co-developed-by: Borislav Petkov (AMD) Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Cc: # d6fd48eff750 ("virt/coco/sev-guest: Check SEV_SNP attribute at probe time") Cc: # 970ab823743f (" virt/coco/sev-guest: Simplify extended guest request handling") Cc: # c5a338274bdb ("virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request()") Cc: # 0fdb6cc7c89c ("virt/coco/sev-guest: Carve out the request issuing logic into a helper") Cc: # d25bae7dc7b0 ("virt/coco/sev-guest: Do some code style cleanups") Cc: # fa4ae42cc60a ("virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case") Link: https://lore.kernel.org/r/20230214164638.1189804-2-dionnaglaze@google.com commit fa4ae42cc60a7dea30e8f2db444b808d80862345 Author: Borislav Petkov (AMD) Date: Thu Feb 16 10:50:11 2023 +0100 virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case snp_issue_guest_request() checks the value returned by the hypervisor in sw_exit_info_2 and returns a different error depending on it. Convert those checks into a switch-case to make it more readable when more error values are going to be checked in the future. No functional changes. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20230307192449.24732-8-bp@alien8.de commit d25bae7dc7b0668cb2a1325c64eb32d5fea4e5a9 Author: Borislav Petkov (AMD) Date: Wed Feb 15 11:54:59 2023 +0100 virt/coco/sev-guest: Do some code style cleanups Remove unnecessary linebreaks, make the code more compact. No functional changes. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20230307192449.24732-7-bp@alien8.de commit 2cde14b187b458b7dcf99360fe4435dae1645a1f Author: Stanislaw Gruszka Date: Wed Mar 1 17:25:08 2023 +0100 accel: Build sub-directories based on config options When accel drivers are disabled do not process into sub-directories and create built-in archives: AR drivers/accel/habanalabs/built-in.a AR drivers/accel/ivpu/built-in.a Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Signed-off-by: Stanislaw Gruszka Reviewed-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20230301162508.3963484-1-stanislaw.gruszka@linux.intel.com (cherry picked from commit dd61bbd0d1fba48cd9464e047a7f90b70a463e39) Signed-off-by: Jacek Lawrynowicz commit 0fdb6cc7c89cb5e0cbc45dbdbafb8e3fb92ddc95 Author: Borislav Petkov (AMD) Date: Tue Mar 7 09:19:19 2023 -0600 virt/coco/sev-guest: Carve out the request issuing logic into a helper This makes the code flow a lot easier to follow. No functional changes. [ Tom: touchups. ] Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230307192449.24732-6-bp@alien8.de commit c5a338274bdb894f088767bea856be344d0ccaef Author: Borislav Petkov (AMD) Date: Wed Feb 15 11:43:43 2023 +0100 virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request() Call the function directly instead. No functional changes. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20230307192449.24732-5-bp@alien8.de commit 970ab823743fb54b42002ec76c51481f67436444 Author: Borislav Petkov (AMD) Date: Wed Feb 15 11:39:41 2023 +0100 virt/coco/sev-guest: Simplify extended guest request handling Return a specific error code - -ENOSPC - to signal the too small cert data buffer instead of checking exit code and exitinfo2. While at it, hoist the *fw_err assignment in snp_issue_guest_request() so that a proper error value is returned to the callers. [ Tom: check override_err instead of err. ] Signed-off-by: Borislav Petkov (AMD) Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230307192449.24732-4-bp@alien8.de commit d6fd48eff7506bb866a54e40369df8899f2078a9 Author: Borislav Petkov (AMD) Date: Wed Feb 15 11:01:42 2023 +0100 virt/coco/sev-guest: Check SEV_SNP attribute at probe time No need to check it on every ioctl. And yes, this is a common SEV driver but it does only SNP-specific operations currently. This can be revisited later, when more use cases appear. No functional changes. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20230307192449.24732-3-bp@alien8.de commit c82510b1d87bdebfe916048857d2ef46f1778aa5 Author: Mika Westerberg Date: Tue Dec 27 11:55:26 2022 +0200 thunderbolt: Use scale field when allocating USB3 bandwidth When tunneling aggregated USB3 (20 Gb/s) the bandwidth values that are programmed to the ADP_USB3_CS_2 go higher than 4096 and that does not fit anymore to the 12-bit field. Fix this by scaling the value using the scale field accordingly. Fixes: 3b1d8d577ca8 ("thunderbolt: Implement USB3 bandwidth negotiation routines") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit f0a57dd33b3eadf540912cd130db727ea824d174 Author: Gil Fine Date: Tue Jan 31 13:04:52 2023 +0200 thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers Current Intel USB4 host routers have hardware limitation that the USB3 bandwidth cannot go higher than 16376 Mb/s. Work this around by adding a new quirk that limits the bandwidth for the affected host routers. Cc: stable@vger.kernel.org Signed-off-by: Gil Fine Signed-off-by: Mika Westerberg commit d2d6ddf188f609861489d5d188d545856a3ed399 Author: Mika Westerberg Date: Fri Feb 3 15:55:41 2023 +0200 thunderbolt: Call tb_check_quirks() after initializing adapters In order to apply quirks based on certain adapter types move call to tb_check_quirks() happen after the adapters are initialized. This should not affect the existing quirks. Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit cd0c1e582b055dea615001b8bd8eccaf6f69f7ce Author: Gil Fine Date: Fri Mar 3 00:17:24 2023 +0200 thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access According to USB4 retimer specification, the process of firmware update sequence requires issuing a SET_INBOUND_SBTX port operation that later shall be followed by UNSET_INBOUND_SBTX port operation. This last step is not currently issued by the driver but it is necessary to make sure the retimers are put back to passthrough mode even during enumeration. If this step is missing the link may not come up properly after soft-reboot for example. For this reason issue UNSET_INBOUND_SBTX after SET_INBOUND_SBTX for enumeration and also when the NVM upgrade is run. Reported-by: Christian Schaubschläger Link: https://lore.kernel.org/linux-usb/b556f5ed-5ee8-9990-9910-afd60db93310@gmx.at/ Cc: stable@vger.kernel.org Signed-off-by: Gil Fine Signed-off-by: Mika Westerberg commit acec726473822bc6b585961f4ca2a11fa7f28341 Author: Mika Westerberg Date: Fri Mar 3 11:25:08 2023 +0200 thunderbolt: Fix memory leak in margining Memory for the usb4->margining needs to be relased for the upstream port of the router as well, even though the debugfs directory gets released with the router device removal. Fix this. Fixes: d0f1e0c2a699 ("thunderbolt: Add support for receiver lane margining") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit e0e6b416b25ee14716f3549e0cbec1011b193809 Author: Janusz Krzysztofik Date: Thu Mar 2 13:08:20 2023 +0100 drm/i915/active: Fix misuse of non-idle barriers as fence trackers Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications. Root cause analysis pointed at an issue in barrier processing code -- a race among perf open / close replacing active barriers with perf requests on kernel context and concurrent barrier preallocate / acquire operations performed during user context first pin / last unpin. When adding a request to a composite tracker, we try to reuse an existing fence tracker, already allocated and registered with that composite. The tracker we obtain may already track another fence, may be an idle barrier, or an active barrier. If the tracker we get occurs a non-idle barrier then we try to delete that barrier from a list of barrier tasks it belongs to. However, while doing that we don't respect return value from a function that performs the barrier deletion. Should the deletion ever fail, we would end up reusing the tracker still registered as a barrier task. Since the same structure field is reused with both fence callback lists and barrier tasks list, list corruptions would likely occur. Barriers are now deleted from a barrier tasks list by temporarily removing the list content, traversing that content with skip over the node to be deleted, then populating the list back with the modified content. Should that intentionally racy concurrent deletion attempts be not serialized, one or more of those may fail because of the list being temporary empty. Related code that ignores the results of barrier deletion was initially introduced in v5.4 by commit d8af05ff38ae ("drm/i915: Allow sharing the idle-barrier from other kernel requests"). However, all users of the barrier deletion routine were apparently serialized at that time, then the issue didn't exhibit itself. Results of git bisect with help of a newly developed igt@gem_barrier_race@remote-request IGT test indicate that list corruptions might start to appear after commit 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles"), introduced in v5.5. Respect results of barrier deletion attempts -- mark the barrier as idle only if successfully deleted from the list. Then, before proceeding with setting our fence as the one currently tracked, make sure that the tracker we've got is not a non-idle barrier. If that check fails then don't use that tracker but go back and try to acquire a new, usable one. v3: use unlikely() to document what outcome we expect (Andi), - fix bad grammar in commit description. v2: no code changes, - blame commit 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles"), v5.5, not commit d8af05ff38ae ("drm/i915: Allow sharing the idle-barrier from other kernel requests"), v5.4, - reword commit description. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6333 Fixes: 311770173fac ("drm/i915/gt: Schedule request retirement when timeline idles") Cc: Chris Wilson Cc: stable@vger.kernel.org # v5.5 Cc: Andi Shyti Signed-off-by: Janusz Krzysztofik Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20230302120820.48740-1-janusz.krzysztofik@linux.intel.com (cherry picked from commit 506006055769b10d1b2b4e22f636f3b45e0e9fc7) Signed-off-by: Jani Nikula commit 193c41926d152761764894f46e23b53c00186a82 Author: Andrea Righi Date: Mon Feb 20 18:18:58 2023 +0100 drm/i915/sseu: fix max_subslices array-index-out-of-bounds access It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format") exposed a potential out-of-bounds access, reported by UBSAN as following on a laptop with a gen 11 i915 card: UBSAN: array-index-out-of-bounds in drivers/gpu/drm/i915/gt/intel_sseu.c:65:27 index 6 is out of range for type 'u16 [6]' CPU: 2 PID: 165 Comm: systemd-udevd Not tainted 6.2.0-9-generic #9-Ubuntu Hardware name: Dell Inc. XPS 13 9300/077Y9N, BIOS 1.11.0 03/22/2022 Call Trace: show_stack+0x4e/0x61 dump_stack_lvl+0x4a/0x6f dump_stack+0x10/0x18 ubsan_epilogue+0x9/0x3a __ubsan_handle_out_of_bounds.cold+0x42/0x47 gen11_compute_sseu_info+0x121/0x130 [i915] intel_sseu_info_init+0x15d/0x2b0 [i915] intel_gt_init_mmio+0x23/0x40 [i915] i915_driver_mmio_probe+0x129/0x400 [i915] ? intel_gt_probe_all+0x91/0x2e0 [i915] i915_driver_probe+0xe1/0x3f0 [i915] ? drm_privacy_screen_get+0x16d/0x190 [drm] ? acpi_dev_found+0x64/0x80 i915_pci_probe+0xac/0x1b0 [i915] ... According to the definition of sseu_dev_info, eu_mask->hsw is limited to a maximum of GEN_MAX_SS_PER_HSW_SLICE (6) sub-slices, but gen11_sseu_info_init() can potentially set 8 sub-slices, in the !IS_JSL_EHL(gt->i915) case. Fix this by reserving up to 8 slots for max_subslices in the eu_mask struct. Reported-by: Emil Renner Berthing Signed-off-by: Andrea Righi Fixes: bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format") Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230220171858.131416-1-andrea.righi@canonical.com (cherry picked from commit 3cba09a6ac86ea1d456909626eb2685596c07822) Signed-off-by: Jani Nikula commit 46bc23dcd94569270d02c4c1f7e62ae01ebd53bb Author: Ankit Nautiyal Date: Thu Feb 23 10:06:19 2023 +0530 drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz Add snps phy table values for HDMI pixel clocks 267.30 MHz and 319.89 MHz. Values are based on the Bspec algorithm for PLL programming for HDMI. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8008 Signed-off-by: Ankit Nautiyal Reviewed-by: Uma Shankar Signed-off-by: Uma Shankar Link: https://patchwork.freedesktop.org/patch/msgid/20230223043619.3941382-1-ankit.k.nautiyal@intel.com (cherry picked from commit d46746b8b13cbd377ffc733e465d25800459a31b) Signed-off-by: Jani Nikula commit 71c602103c74b277bef3d20a308874a33ec8326d Author: Jouni Högander Date: Tue Feb 21 10:53:04 2023 +0200 drm/i915/psr: Use calculated io and fast wake lines Currently we are using hardcoded 7 for io and fast wake lines. According to Bspec io and fast wake times are both 42us for DISPLAY_VER >= 12 and 50us and 32us for older platforms. Calculate line counts for these and configure them into PSR2_CTL accordingly Use 45 us for the fast wake calculation as 42 seems to be too tight based on testing. Bspec: 49274, 4289 Cc: Mika Kahola Cc: José Roberto de Souza Fixes: 64cf40a125ff ("drm/i915/psr: Program default IO buffer Wake and Fast Wake") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7725 Signed-off-by: Jouni Högander Reviewed-by: Stanislav Lisovskiy Link: https://patchwork.freedesktop.org/patch/msgid/20230221085304.3382297-1-jouni.hogander@intel.com (cherry picked from commit cb42e8ede5b475c096e473b86c356b1158b4bc3b) Signed-off-by: Jani Nikula commit 897f453c106380e57600c19a0a0485ceb4f3b0d9 Author: Ville Syrjälä Date: Mon Feb 20 17:17:30 2023 +0200 drm/i915: Fix audio ELD handling for DP MST I forgot to call intel_audio_compute_config() on DP MST, which means ELD doesn't get populated and passed to the audio driver. References: https://gitlab.freedesktop.org/drm/intel/-/issues/8097 Fixes: 5d986635e296 ("drm/i915/audio: Precompute the ELD") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230220151731.6852-1-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar (cherry picked from commit 518b761a7b0e2bb2fac2518f041c71b461adf761) Signed-off-by: Jani Nikula commit ee892ea83d99610fa33bea612de058e0955eec3a Author: Ashutosh Dixit Date: Fri Feb 3 07:53:09 2023 -0800 drm/i915/hwmon: Enable PL1 power limit Previous documentation suggested that PL1 power limit is always enabled. However we now find this not to be the case on some platforms (such as ATSM). Therefore enable PL1 power limit during hwmon initialization. Bspec: 51864 v2: Add Bspec reference (Gwan-gyeong) v3: Add Fixes tag Fixes: 99f55efb79114 ("drm/i915/hwmon: Power PL1 limit and TDP setting") Signed-off-by: Ashutosh Dixit Reviewed-by: Gwan-gyeong Mun Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20230203155309.1042297-1-ashutosh.dixit@intel.com (cherry picked from commit 0349c41b05968befaffa5fbb7e73d0ee6004f610) Signed-off-by: Jani Nikula commit b3c9a04135bdbd3aabd5e9534bad0fe6df505f8a Merge: fe9ae05cfbe58 eeac8ede17557 Author: Thomas Zimmermann Date: Mon Mar 13 10:14:05 2023 +0100 Merge drm/drm-fixes into drm-misc-fixes Backmerging to get latest upstream. Signed-off-by: Thomas Zimmermann commit d7a0bdbf17276b757d2b89f5351bbee9ecf58fe6 Author: Heiko Carstens Date: Fri Mar 10 14:19:55 2023 +0100 s390: update defconfigs Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik commit ab909509850b27fd39b8ba99e44cda39dbc3858c Author: Niklas Schnelle Date: Mon Mar 6 16:10:11 2023 +0100 PCI: s390: Fix use-after-free of PCI resources with per-function hotplug On s390 PCI functions may be hotplugged individually even when they belong to a multi-function device. In particular on an SR-IOV device VFs may be removed and later re-added. In commit a50297cf8235 ("s390/pci: separate zbus creation from scanning") it was missed however that struct pci_bus and struct zpci_bus's resource list retained a reference to the PCI functions MMIO resources even though those resources are released and freed on hot-unplug. These stale resources may subsequently be claimed when the PCI function re-appears resulting in use-after-free. One idea of fixing this use-after-free in s390 specific code that was investigated was to simply keep resources around from the moment a PCI function first appeared until the whole virtual PCI bus created for a multi-function device disappears. The problem with this however is that due to the requirement of artificial MMIO addreesses (address cookies) extra logic is then needed to keep the address cookies compatible on re-plug. At the same time the MMIO resources semantically belong to the PCI function so tying their lifecycle to the function seems more logical. Instead a simpler approach is to remove the resources of an individually hot-unplugged PCI function from the PCI bus's resource list while keeping the resources of other PCI functions on the PCI bus untouched. This is done by introducing pci_bus_remove_resource() to remove an individual resource. Similarly the resource also needs to be removed from the struct zpci_bus's resource list. It turns out however, that there is really no need to add the MMIO resources to the struct zpci_bus's resource list at all and instead we can simply use the zpci_bar_struct's resource pointer directly. Fixes: a50297cf8235 ("s390/pci: separate zbus creation from scanning") Signed-off-by: Niklas Schnelle Reviewed-by: Matthew Rosato Acked-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20230306151014.60913-2-schnelle@linux.ibm.com Signed-off-by: Vasily Gorbik commit a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9 Author: Sven Schnelle Date: Tue Mar 7 14:35:23 2023 +0100 s390/ipl: add missing intersection check to ipl_report handling The code which handles the ipl report is searching for a free location in memory where it could copy the component and certificate entries to. It checks for intersection between the sections required for the kernel and the component/certificate data area, but fails to check whether the data structures linking these data areas together intersect. This might cause the iplreport copy code to overwrite the iplreport itself. Fix this by adding two addtional intersection checks. Cc: Fixes: 9641b8cc733f ("s390/ipl: read IPL report at early boot") Signed-off-by: Sven Schnelle Reviewed-by: Vasily Gorbik Signed-off-by: Vasily Gorbik commit ae43c20da2a77c508715a9c77845b4e87e6a1e25 Author: Rong Tao Date: Thu Mar 9 14:13:07 2023 +0800 tools/virtio: Ignore virtio-trace/trace-agent since commit 108fc82596e3("tools: Add guest trace agent as a user tool") introduce virtio-trace/trace-agent, it should be ignored in the git tree. Signed-off-by: Rong Tao Message-Id: Signed-off-by: Michael S. Tsirkin commit b4cca6d48eb3fa6f0d9caba4329b1a2b0ff67a77 Author: Eugenio Pérez Date: Thu Mar 2 19:18:57 2023 +0100 vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready Starting from an used_idx different than 0 is needed in use cases like virtual machine migration. Not doing so and letting the caller set an avail idx different than 0 causes destination device to try to use old buffers that source driver already recover and are not available anymore. Since vdpa_sim does not support receive inflight descriptors as a destination of a migration, let's set both avail_idx and used_idx the same at vq start. This is how vhost-user works in a VHOST_SET_VRING_BASE call. Although the simple fix is to set last_used_idx at vdpasim_set_vq_state, it would be reset at vdpasim_queue_ready. The last_avail_idx case is fixed with commit 0e84f918fac8 ("vdpa_sim: not reset state in vdpasim_queue_ready"). Since the only option is to make it equal to last_avail_idx, adding the only change needed here. This was discovered and tested live migrating the vdpa_sim_net device. Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator") Reviewed-by: Stefano Garzarella Signed-off-by: Eugenio Pérez Message-Id: <20230302181857.925374-1-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin commit 5a522150093a0eabae9470a70a37a6e436bfad08 Author: Gautam Dawar Date: Wed Mar 1 22:02:01 2023 +0530 vhost-vdpa: free iommu domain after last use during cleanup Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling `iommu_unmap(v->domain, map->start, map->size);` from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't provide DMA config operations. However, the IOMMU domain referred to by `v->domain` is freed in vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in vhost_vdpa_release() which results in NULL pointer de-reference. Accordingly, moving the call to vhost_vdpa_free_domain() in vhost_vdpa_cleanup() would makes sense. This will also help detaching the dma device in error handling of vhost_vdpa_alloc_domain(). This issue was observed on terminating QEMU with SIGQUIT. Fixes: 037d4305569a ("vhost-vdpa: call vhost_vdpa_cleanup during the release") Signed-off-by: Gautam Dawar Message-Id: <20230301163203.29883-1-gautam.dawar@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Stefano Garzarella commit eeac8ede17557680855031c6f305ece2378af326 Author: Linus Torvalds Date: Sun Mar 12 16:36:44 2023 -0700 Linux 6.3-rc2 commit 79d1ed5ca7db67d48e870c979f0e0f6b0947944a Author: Hector Martin Date: Sat Mar 11 23:19:14 2023 +0900 wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" This reverts part of commit 015b8cc5e7c4 ("wifi: cfg80211: Fix use after free for wext") This commit broke WPA offload by unconditionally clearing the crypto modes for non-WEP connections. Drop that part of the patch. Signed-off-by: Hector Martin Reported-by: Ilya Reported-and-tested-by: Janne Grunau Reviewed-by: Eric Curtin Fixes: 015b8cc5e7c4 ("wifi: cfg80211: Fix use after free for wext") Cc: stable@kernel.org Link: https://lore.kernel.org/linux-wireless/ZAx0TWRBlGfv7pNl@kroah.com/T/#m11e6e0915ab8fa19ce8bc9695ab288c0fe018edf Signed-off-by: Linus Torvalds commit c4ecd87f75ec4d5ac3006ef21ce07e812982e46e Merge: 2e545d69bd43a f1324bbc4011e Author: Linus Torvalds Date: Sun Mar 12 16:15:36 2023 -0700 Merge tag 'tpm-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "Two additional bug fixes for v6.3" * tag 'tpm-v6.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: disable hwrng for fTPM on some AMD designs tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address commit 06615d11cc78162dfd5116efb71f29eb29502d37 Author: Zheng Wang Date: Sun Mar 12 01:46:50 2023 +0800 power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition In da9150_charger_probe, &charger->otg_work is bound with da9150_charger_otg_work. da9150_charger_otg_ncb may be called to start the work. If we remove the module which will call da9150_charger_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: Fix it by canceling the work before cleanup in the da9150_charger_remove CPU0 CPUc1 |da9150_charger_otg_work da9150_charger_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_changed(charger->usb); | //use Fixes: c1a281e34dae ("power: Add support for DA9150 Charger") Signed-off-by: Zheng Wang Signed-off-by: Sebastian Reichel commit f1324bbc4011ed8aef3f4552210fc429bcd616da Author: Mario Limonciello Date: Mon Feb 27 20:44:39 2023 -0600 tpm: disable hwrng for fTPM on some AMD designs AMD has issued an advisory indicating that having fTPM enabled in BIOS can cause "stuttering" in the OS. This issue has been fixed in newer versions of the fTPM firmware, but it's up to system designers to decide whether to distribute it. This issue has existed for a while, but is more prevalent starting with kernel 6.1 because commit b006c439d58db ("hwrng: core - start hwrng kthread also for untrusted sources") started to use the fTPM for hwrng by default. However, all uses of /dev/hwrng result in unacceptable stuttering. So, simply disable registration of the defective hwrng when detecting these faulty fTPM versions. As this is caused by faulty firmware, it is plausible that such a problem could also be reproduced by other TPM interactions, but this hasn't been shown by any user's testing or reports. It is hypothesized to be triggered more frequently by the use of the RNG because userspace software will fetch random numbers regularly. Intentionally continue to register other TPM functionality so that users that rely upon PCR measurements or any storage of data will still have access to it. If it's found later that another TPM functionality is exacerbating this problem a module parameter it can be turned off entirely and a module parameter can be introduced to allow users who rely upon fTPM functionality to turn it on even though this problem is present. Link: https://www.amd.com/en/support/kb/faq/pa-410 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216989 Link: https://lore.kernel.org/all/20230209153120.261904-1-Jason@zx2c4.com/ Fixes: b006c439d58d ("hwrng: core - start hwrng kthread also for untrusted sources") Cc: stable@vger.kernel.org Cc: Jarkko Sakkinen Cc: Thorsten Leemhuis Cc: James Bottomley Tested-by: reach622@mailcuk.com Tested-by: Bell <1138267643@qq.com> Co-developed-by: Jason A. Donenfeld Signed-off-by: Jason A. Donenfeld Signed-off-by: Mario Limonciello Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 80a6c216b16d7f5c584d2148c2e4345ea4eb06ce Author: Morten Linderud Date: Wed Feb 15 10:25:52 2023 +0100 tpm/eventlog: Don't abort tpm_read_log on faulty ACPI address tpm_read_log_acpi() should return -ENODEV when no eventlog from the ACPI table is found. If the firmware vendor includes an invalid log address we are unable to map from the ACPI memory and tpm_read_log() returns -EIO which would abort discovery of the eventlog. Change the return value from -EIO to -ENODEV when acpi_os_map_iomem() fails to map the event log. The following hardware was used to test this issue: Framework Laptop (Pre-production) BIOS: INSYDE Corp, Revision: 3.2 TPM Device: NTC, Firmware Revision: 7.2 Dump of the faulty ACPI TPM2 table: [000h 0000 4] Signature : "TPM2" [Trusted Platform Module hardware interface Table] [004h 0004 4] Table Length : 0000004C [008h 0008 1] Revision : 04 [009h 0009 1] Checksum : 2B [00Ah 0010 6] Oem ID : "INSYDE" [010h 0016 8] Oem Table ID : "TGL-ULT" [018h 0024 4] Oem Revision : 00000002 [01Ch 0028 4] Asl Compiler ID : "ACPI" [020h 0032 4] Asl Compiler Revision : 00040000 [024h 0036 2] Platform Class : 0000 [026h 0038 2] Reserved : 0000 [028h 0040 8] Control Address : 0000000000000000 [030h 0048 4] Start Method : 06 [Memory Mapped I/O] [034h 0052 12] Method Parameters : 00 00 00 00 00 00 00 00 00 00 00 00 [040h 0064 4] Minimum Log Length : 00010000 [044h 0068 8] Log Address : 000000004053D000 Fixes: 0cf577a03f21 ("tpm: Fix handling of missing event log") Tested-by: Erkki Eilonen Signed-off-by: Morten Linderud Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 00d85e81796b17a29a0e096c5a4735daa47adef8 Author: Krzysztof Kozlowski Date: Sun Mar 12 20:37:23 2023 +0100 hwmon: tmp512: drop of_match_ptr for ID table The driver will match mostly by DT table (even thought there is regular ID table) so there is little benefit in of_match_ptr (this also allows ACPI matching via PRP0001, even though it might not be relevant here). This also fixes !CONFIG_OF error: drivers/hwmon/tmp513.c:610:34: error: ‘tmp51x_of_match’ defined but not used [-Werror=unused-const-variable=] Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230312193723.478032-2-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck commit 8d655e65237643c48ada2c131b83679bf1105373 Author: Lars-Peter Clausen Date: Sun Mar 12 09:03:12 2023 -0700 hwmon: (ucd90320) Add minimum delay between bus accesses When probing the ucd90320 access to some of the registers randomly fails. Sometimes it NACKs a transfer, sometimes it returns just random data and the PEC check fails. Experimentation shows that this seems to be triggered by a register access directly back to back with a previous register write. Experimentation also shows that inserting a small delay after register writes makes the issue go away. Use a similar solution to what the max15301 driver does to solve the same problem. Create a custom set of bus read and write functions that make sure that the delay is added. Fixes: a470f11c5ba2 ("hwmon: (pmbus/ucd9000) Add support for UCD90320 Power Sequencer") Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20230312160312.2227405-1-lars@metafoo.de Signed-off-by: Guenter Roeck commit 4783b9cb374af02d49740e00e2da19fd4ed6dec4 Author: Yazen Ghannam Date: Wed Mar 1 22:14:20 2023 +0000 x86/mce: Make sure logged MCEs are processed after sysfs update A recent change introduced a flag to queue up errors found during boot-time polling. These errors will be processed during late init once the MCE subsystem is fully set up. A number of sysfs updates call mce_restart() which goes through a subset of the CPU init flow. This includes polling MCA banks and logging any errors found. Since the same function is used as boot-time polling, errors will be queued. However, the system is now past late init, so the errors will remain queued until another error is found and the workqueue is triggered. Call mce_schedule_work() at the end of mce_restart() so that queued errors are processed. Fixes: 3bff147b187d ("x86/mce: Defer processing of early errors") Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tony Luck Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230301221420.2203184-1-yazen.ghannam@amd.com commit c93f5e2ab53243b17febabb9422a697017d3d49a Author: Marcus Folkesson Date: Fri Mar 10 08:50:35 2023 +0100 hwmon: (ina3221) return prober error code ret is set to 0 which do not indicate an error. Return -EINVAL instead. Fixes: a9e9dd9c6de5 ("hwmon: (ina3221) Read channel input source info from DT") Signed-off-by: Marcus Folkesson Link: https://lore.kernel.org/r/20230310075035.246083-1-marcus.folkesson@gmail.com Signed-off-by: Guenter Roeck commit cb090e64cf25602b9adaf32d5dfc9c8bec493cd1 Author: Zheng Wang Date: Fri Mar 10 16:40:07 2023 +0800 hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work. Then it will be started. If we remove the driver which will call xgene_hwmon_remove to clean up, there may be unfinished work. The possible sequence is as follows: Fix it by finishing the work before cleanup in xgene_hwmon_remove. CPU0 CPU1 |xgene_hwmon_evt_work xgene_hwmon_remove | kfifo_free(&ctx->async_msg_fifo);| | |kfifo_out_spinlocked |//use &ctx->async_msg_fifo Fixes: 2ca492e22cb7 ("hwmon: (xgene) Fix crash when alarm occurs before driver probe") Signed-off-by: Zheng Wang Link: https://lore.kernel.org/r/20230310084007.1403388-1-zyytlz.wz@163.com Signed-off-by: Guenter Roeck commit 2e545d69bd43a97879309493864529194661bb43 Merge: 134231664868e 8ac5b996bf519 Author: Linus Torvalds Date: Sun Mar 12 09:47:08 2023 -0700 Merge tag 'xfs-6.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: - Fix a crash if mount time quotacheck fails when there are inodes queued for garbage collection. - Fix an off by one error when discarding folios after writeback failure. * tag 'xfs-6.3-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix off-by-one-block in xfs_discard_folio() xfs: quotacheck failure can race with background inode inactivation commit 134231664868e163580cfe79e8c923560d7de302 Merge: d3d0cac69fc50 fdf6c2309f425 Author: Linus Torvalds Date: Sun Mar 12 09:17:30 2023 -0700 Merge tag 'staging-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes and removal from Greg KH: "Here are four small staging driver fixes, and one big staging driver deletion for 6.3-rc2. The fixes are: - rtl8192e driver fixes for where the driver was attempting to execute various programs directly from the disk for unknown reasons - rtl8723bs driver fixes for issues found by Hans in testing The deleted driver is the removal of the r8188eu wireless driver as now in 6.3-rc1 we have a "real" wifi driver for one that includes support for many many more devices than this old driver did. So it's time to remove it as it is no longer needed. The maintainers of this driver all have acked its removal. Many thanks to them over the years for working to clean it up and keep it working while the real driver was being developed. All of these have been in linux-next this week with no reported problems" * tag 'staging-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: r8188eu: delete driver staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss() staging: rtl8723bs: Fix key-store index handling staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script commit d3d0cac69fc509ece28a267c093d2f1094f88dba Merge: f5eded1f5f117 b0563468eeac8 Author: Linus Torvalds Date: Sun Mar 12 09:12:03 2023 -0700 Merge tag 'x86_urgent_for_v6.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: "A single erratum fix for AMD machines: - Disable XSAVES on AMD Zen1 and Zen2 machines due to an erratum. No impact to anything as those machines will fallback to XSAVEC which is equivalent there" * tag 'x86_urgent_for_v6.3_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Disable XSAVES on AMD family 0x17 commit f5eded1f5f117ed2151f605867ad7df1fd7d1bbe Merge: 3b11717f95b18 515bddf0ec415 Author: Linus Torvalds Date: Sun Mar 12 09:04:28 2023 -0700 Merge tag 'kernel.fork.v6.3-rc2' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux Pull clone3 fix from Christian Brauner: "A simple fix for the clone3() system call. The CLONE_NEWTIME allows the creation of time namespaces. The flag reuses a bit from the CSIGNAL bits that are used in the legacy clone() system call to set the signal that gets sent to the parent after the child exits. The clone3() system call doesn't rely on CSIGNAL anymore as it uses a dedicated .exit_signal field in struct clone_args. So we blocked all CSIGNAL bits in clone3_args_valid(). When CLONE_NEWTIME was introduced and reused a CSIGNAL bit we forgot to adapt clone3_args_valid() causing CLONE_NEWTIME with clone3() to be rejected. Fix this" * tag 'kernel.fork.v6.3-rc2' of gitolite.kernel.org:pub/scm/linux/kernel/git/brauner/linux: selftests/clone3: test clone3 with CLONE_NEWTIME fork: allow CLONE_NEWTIME in clone3 flags commit 3b11717f95b1880b9cab4b90bbaf61268e6bda2b Merge: 40d0c0901e6c1 42d0c4bdf7530 Author: Linus Torvalds Date: Sun Mar 12 09:00:54 2023 -0700 Merge tag 'vfs.misc.v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfs fixes from Christian Brauner: - When allocating pages for a watch queue failed, we didn't return an error causing userspace to proceed even though all subsequent notifcations would be lost. Make sure to return an error. - Fix a misformed tree entry for the idmapping maintainers entry. - When setting file leases from an idmapped mount via generic_setlease() we need to take the idmapping into account otherwise taking a lease would fail from an idmapped mount. - Remove two redundant assignments, one in splice code and the other in locks code, that static checkers complained about. * tag 'vfs.misc.v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: filelocks: use mount idmapping for setlease permission check fs/locks: Remove redundant assignment to cmd splice: Remove redundant assignment to ret MAINTAINERS: repair a malformed T: entry in IDMAPPED MOUNTS watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths commit 40d0c0901e6c19cf268d2f505bce0b50319c5653 Merge: e7304080e0e50 f5361da1e60d5 Author: Linus Torvalds Date: Sun Mar 12 08:55:55 2023 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Bug fixes and regressions for ext4, the most serious of which is a potential deadlock during directory renames that was introduced during the merge window discovered by a combination of syzbot and lockdep" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: zero i_disksize when initializing the bootloader inode ext4: make sure fs error flag setted before clear journal error ext4: commit super block if fs record error when journal record without error ext4, jbd2: add an optimized bmap for the journal inode ext4: fix WARNING in ext4_update_inline_data ext4: move where set the MAY_INLINE_DATA flag is set ext4: Fix deadlock during directory rename ext4: Fix comment about the 64BIT feature docs: ext4: modify the group desc size to 64 ext4: fix another off-by-one fsmap error on 1k block filesystems ext4: fix RENAME_WHITEOUT handling for inline directories ext4: make kobj_type structures constant ext4: fix cgroup writeback accounting with fs-layer encryption commit e7304080e0e50d979ce9eaf694ad8283e2e539ea Author: Linus Torvalds Date: Sun Mar 12 08:52:03 2023 -0700 cpumask: relax sanity checking constraints The cpumask_check() was unnecessarily tight, and causes problems for the users of cpumask_next(). We have a number of users that take the previous return value of one of the bit scanning functions and subtract one to keep it in "range". But since the scanning functions end up returning up to 'small_cpumask_bits' instead of the tighter 'nr_cpumask_bits', the range really needs to be using that widened form. [ This "previous-1" behavior is also the reason we have all those comments about /* -1 is a legal arg here. */ and separate checks for that being ok. So we could have just made "small_cpumask_bits-1" be a similar special "don't check this" value. Tetsuo Handa even suggested a patch that only does that for cpumask_next(), since that seems to be the only actual case that triggers, but that all makes it even _more_ magical and special. So just relax the check ] One example of this kind of pattern being the 'c_start()' function in arch/x86/kernel/cpu/proc.c, but also duplicated in various forms on other architectures. Reported-by: syzbot+96cae094d90877641f32@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=96cae094d90877641f32 Reported-by: Tetsuo Handa Link: https://lore.kernel.org/lkml/c1f4cc16-feea-b83c-82cf-1a1f007b7eb9@I-love.SAKURA.ne.jp/ Fixes: 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask optimizations") Signed-off-by: Linus Torvalds commit 7b3825e9487d77e83bf1e27b10a74cd729b8f972 Author: Nuno Sá Date: Tue Mar 7 10:53:03 2023 +0100 iio: adc: max11410: fix read_poll_timeout() usage Even though we are passing 'ret' as stop condition for read_poll_timeout(), that return code is still being ignored. The reason is that the poll will stop if the passed condition is true which will happen if the passed op() returns error. However, read_poll_timeout() returns 0 if the *complete* condition evaluates to true. Therefore, the error code returned by op() will be ignored. To fix this we need to check for both error codes: * The one returned by read_poll_timeout() which is either 0 or ETIMEDOUT. * The one returned by the passed op(). Fixes: a44ef7c46097 ("iio: adc: add max11410 adc driver") Signed-off-by: Nuno Sá Acked-by: Ibrahim Tilki Link: https://lore.kernel.org/r/20230307095303.713251-1-nuno.sa@analog.com Cc: Signed-off-by: Jonathan Cameron commit 44ac5abac86b20856e6d9e5e5e40dcc2623fe330 Author: Vegard Nossum Date: Sun Mar 5 23:00:04 2023 +0100 Documentation/security-bugs: move from admin-guide/ to process/ Jiri Kosina, Jonathan Corbet, and Willy Tarreau all expressed a desire to move this document under process/. Create a new section for security issues in the index and group it with embargoed-hardware-issues. I'm doing this at the start of the series to make all the subsequent changes show up in 'git blame'. Existing references were updated using: git grep -l security-bugs ':!Documentation/translations/' | xargs sed -i 's|admin-guide/security-bugs|process/security-bugs|g' git grep -l security-bugs Documentation/translations/ | xargs sed -i 's|Documentation/admin-guide/security-bugs|Documentation/process/security-bugs|g' git grep -l security-bugs Documentation/translations/ | xargs sed -i '/Original:/s|\.\./admin-guide/security-bugs|\.\./process/security-bugs|g' Notably, the page is not moved in the translations (due to my lack of knowledge of these languages), but the translations have been updated to point to the new location of the original document where these references exist. Link: https://lore.kernel.org/all/nycvar.YFH.7.76.2206062326230.10851@cbobk.fhfr.pm/ Suggested-by: Jiri Kosina Cc: Alex Shi Cc: Yanteng Si Cc: Hu Haowen Cc: Federico Vaga Cc: Tsugikazu Shibata Cc: Minchan Kim Cc: Jeimi Lee Cc: Carlos Bilbao Cc: Akira Yokosawa Signed-off-by: Vegard Nossum Acked-by: Carlos Bilbao Reviewed-by: Yanteng Si Reviewed-by: Akira Yokosawa Acked-by: Federico Vaga Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20230305220010.20895-2-vegard.nossum@oracle.com Signed-off-by: Greg Kroah-Hartman commit 81ff855485a366a391dc3aed3942715e676ed132 Merge: e25c54d17914b 9e5f81f9a6e78 Author: Linus Torvalds Date: Sat Mar 11 09:24:05 2023 -0800 Merge tag 'i2c-for-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "This marks the end of a transition to let I2C have the same probe semantics as other subsystems. Uwe took care that no drivers in the current tree nor in -next use the deprecated .probe call. So, it is a good time to switch to the new, standard semantics now. There is also a regression fix: - regression fix for the notifier handling of the I2C core - final coversions of drivers away from deprecated .probe - make .probe_new the standard probe and convert I2C core to use it * tag 'i2c-for-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: dev: Fix bus callback return values i2c: Convert drivers to new .probe() callback i2c: mux: Convert all drivers to new .probe() callback i2c: Switch .probe() to not take an id parameter media: i2c: ov2685: convert to i2c's .probe_new() media: i2c: ov5695: convert to i2c's .probe_new() w1: ds2482: Convert to i2c's .probe_new() serial: sc16is7xx: Convert to i2c's .probe_new() mtd: maps: pismo: Convert to i2c's .probe_new() misc: ad525x_dpot-i2c: Convert to i2c's .probe_new() commit e25c54d17914b0df4f902d1f25cd52f54e20cfbf Author: Richard Weinberger Date: Sat Mar 11 10:29:29 2023 +0100 ubi: block: Fix missing blk_mq_end_request Switching to BLK_MQ_F_BLOCKING wrongly removed the call to blk_mq_end_request(). Add it back to have our IOs finished Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING") Analyzed-by: Linus Torvalds Reported-by: Daniel Palmer Link: https://lore.kernel.org/linux-mtd/CAHk-=wi29bbBNh3RqJKu3PxzpjDN5D5K17gEVtXrb7-6bfrnMQ@mail.gmail.com/ Signed-off-by: Richard Weinberger Reviewed-by: Christoph Hellwig Tested-by: Daniel Palmer Signed-off-by: Linus Torvalds commit c3701185ee1973845db088d8b0fc443397ab0eb2 Author: William Breathitt Gray Date: Fri Mar 10 19:22:48 2023 -0500 iio: dac: cio-dac: Fix max DAC write value check for 12-bit The CIO-DAC series of devices only supports DAC values up to 12-bit rather than 16-bit. Trying to write a 16-bit value results in only the lower 12 bits affecting the DAC output which is not what the user expects. Instead, adjust the DAC write value check to reject values larger than 12-bit so that they fail explicitly as invalid for the user. Fixes: 3b8df5fd526e ("iio: Add IIO support for the Measurement Computing CIO-DAC family") Cc: stable@vger.kernel.org Signed-off-by: William Breathitt Gray Link: https://lore.kernel.org/r/20230311002248.8548-1-william.gray@linaro.org Signed-off-by: Jonathan Cameron commit 47053904e18282af4525a02e3e0f519f014fc7f9 Author: Marc Zyngier Date: Fri Feb 24 19:16:40 2023 +0000 KVM: arm64: timers: Convert per-vcpu virtual offset to a global value Having a per-vcpu virtual offset is a pain. It needs to be synchronized on each update, and expands badly to a setup where different timers can have different offsets, or have composite offsets (as with NV). So let's start by replacing the use of the CNTVOFF_EL2 shadow register (which we want to reclaim for NV anyway), and make the virtual timer carry a pointer to a VM-wide offset. This simplifies the code significantly. It also addresses two terrible bugs: - The use of CNTVOFF_EL2 leads to some nice offset corruption when the sysreg gets reset, as reported by Joey. - The kvm mutex is taken from a vcpu ioctl, which goes against the locking rules... Reported-by: Joey Gouly Reviewed-by: Reiji Watanabe Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230224173915.GA17407@e124191.cambridge.arm.com Tested-by: Joey Gouly Link: https://lore.kernel.org/r/20230224191640.3396734-1-maz@kernel.org Signed-off-by: Oliver Upton commit 064d70527aaab23ef46c2481df706451f6814106 Merge: dee85ac02c1ac 493924519b1fe Author: Jakub Kicinski Date: Fri Mar 10 21:45:03 2023 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) nft_parse_register_load() gets an incorrect datatype size as input, from Jeremy Sowden. 2) incorrect maximum netlink attribute in nft_redir, also from Jeremy. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_redir: correct value of inet type `.maxattrs` netfilter: nft_redir: correct length for loading protocol registers netfilter: nft_masq: correct length for loading protocol registers netfilter: nft_nat: correct length for loading protocol registers ==================== Link: https://lore.kernel.org/r/20230309174655.69816-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit f5361da1e60d54ec81346aee8e3d8baf1be0b762 Author: Zhihao Cheng Date: Wed Mar 8 11:26:43 2023 +0800 ext4: zero i_disksize when initializing the bootloader inode If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size to 0. However, if the "never before used" boot loader has a non-zero i_size, then i_disksize will be non-zero, and the inconsistency between i_size and i_disksize can trigger a kernel warning: WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319 CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa RIP: 0010:ext4_file_write_iter+0xbc7/0xd10 Call Trace: vfs_write+0x3b1/0x5c0 ksys_write+0x77/0x160 __x64_sys_write+0x22/0x30 do_syscall_64+0x39/0x80 Reproducer: 1. create corrupted image and mount it: mke2fs -t ext4 /tmp/foo.img 200 debugfs -wR "sif <5> size 25700" /tmp/foo.img mount -t ext4 /tmp/foo.img /mnt cd /mnt echo 123 > file 2. Run the reproducer program: posix_memalign(&buf, 1024, 1024) fd = open("file", O_RDWR | O_DIRECT); ioctl(fd, EXT4_IOC_SWAP_BOOT); write(fd, buf, 1024); Fix this by setting i_disksize as well as i_size to zero when initiaizing the boot loader inode. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217159 Cc: stable@kernel.org Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20230308032643.641113-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit f57886ca1606ba74cc4ec4eb5cbf073934ffa559 Author: Ye Bin Date: Tue Mar 7 14:17:03 2023 +0800 ext4: make sure fs error flag setted before clear journal error Now, jounral error number maybe cleared even though ext4_commit_super() failed. This may lead to error flag miss, then fsck will miss to check file system deeply. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230307061703.245965-3-yebin@huaweicloud.com commit eee00237fa5ec8f704f7323b54e48cc34e2d9168 Author: Ye Bin Date: Tue Mar 7 14:17:02 2023 +0800 ext4: commit super block if fs record error when journal record without error Now, 'es->s_state' maybe covered by recover journal. And journal errno maybe not recorded in journal sb as IO error. ext4_update_super() only update error information when 'sbi->s_add_error_count' large than zero. Then 'EXT4_ERROR_FS' flag maybe lost. To solve above issue just recover 'es->s_state' error flag after journal replay like error info. Signed-off-by: Ye Bin Reviewed-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230307061703.245965-2-yebin@huaweicloud.com commit 62913ae96de747091c4dacd06d158e7729c1a76d Author: Theodore Ts'o Date: Tue Mar 7 23:15:49 2023 -0500 ext4, jbd2: add an optimized bmap for the journal inode The generic bmap() function exported by the VFS takes locks and does checks that are not necessary for the journal inode. So allow the file system to set a journal-optimized bmap function in journal->j_bmap. Reported-by: syzbot+9543479984ae9e576000@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=e4aaa78795e490421c79f76ec3679006c8ff4cf0 Signed-off-by: Theodore Ts'o commit 2b96b4a5d9443ca4cad58b0040be455803c05a42 Author: Ye Bin Date: Tue Mar 7 09:52:53 2023 +0800 ext4: fix WARNING in ext4_update_inline_data Syzbot found the following issue: EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" fscrypt: AES-256-XTS using implementation "xts-aes-aesni" ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5071 at mm/page_alloc.c:5525 __alloc_pages+0x30a/0x560 mm/page_alloc.c:5525 Modules linked in: CPU: 1 PID: 5071 Comm: syz-executor263 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:__alloc_pages+0x30a/0x560 mm/page_alloc.c:5525 RSP: 0018:ffffc90003c2f1c0 EFLAGS: 00010246 RAX: ffffc90003c2f220 RBX: 0000000000000014 RCX: 0000000000000000 RDX: 0000000000000028 RSI: 0000000000000000 RDI: ffffc90003c2f248 RBP: ffffc90003c2f2d8 R08: dffffc0000000000 R09: ffffc90003c2f220 R10: fffff52000785e49 R11: 1ffff92000785e44 R12: 0000000000040d40 R13: 1ffff92000785e40 R14: dffffc0000000000 R15: 1ffff92000785e3c FS: 0000555556c0d300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f95d5e04138 CR3: 00000000793aa000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __alloc_pages_node include/linux/gfp.h:237 [inline] alloc_pages_node include/linux/gfp.h:260 [inline] __kmalloc_large_node+0x95/0x1e0 mm/slab_common.c:1113 __do_kmalloc_node mm/slab_common.c:956 [inline] __kmalloc+0xfe/0x190 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] kzalloc include/linux/slab.h:720 [inline] ext4_update_inline_data+0x236/0x6b0 fs/ext4/inline.c:346 ext4_update_inline_dir fs/ext4/inline.c:1115 [inline] ext4_try_add_inline_entry+0x328/0x990 fs/ext4/inline.c:1307 ext4_add_entry+0x5a4/0xeb0 fs/ext4/namei.c:2385 ext4_add_nondir+0x96/0x260 fs/ext4/namei.c:2772 ext4_create+0x36c/0x560 fs/ext4/namei.c:2817 lookup_open fs/namei.c:3413 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x12ac/0x2dd0 fs/namei.c:3711 do_filp_open+0x264/0x4f0 fs/namei.c:3741 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_openat fs/open.c:1342 [inline] __se_sys_openat fs/open.c:1337 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1337 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Above issue happens as follows: ext4_iget ext4_find_inline_data_nolock ->i_inline_off=164 i_inline_size=60 ext4_try_add_inline_entry __ext4_mark_inode_dirty ext4_expand_extra_isize_ea ->i_extra_isize=32 s_want_extra_isize=44 ext4_xattr_shift_entries ->after shift i_inline_off is incorrect, actually is change to 176 ext4_try_add_inline_entry ext4_update_inline_dir get_max_inline_xattr_value_size if (EXT4_I(inode)->i_inline_off) entry = (struct ext4_xattr_entry *)((void *)raw_inode + EXT4_I(inode)->i_inline_off); free += EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size)); ->As entry is incorrect, then 'free' may be negative ext4_update_inline_data value = kzalloc(len, GFP_NOFS); -> len is unsigned int, maybe very large, then trigger warning when 'kzalloc()' To resolve the above issue we need to update 'i_inline_off' after 'ext4_xattr_shift_entries()'. We do not need to set EXT4_STATE_MAY_INLINE_DATA flag here, since ext4_mark_inode_dirty() already sets this flag if needed. Setting EXT4_STATE_MAY_INLINE_DATA when it is needed may trigger a BUG_ON in ext4_writepages(). Reported-by: syzbot+d30838395804afc2fa6f@syzkaller.appspotmail.com Cc: stable@kernel.org Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230307015253.2232062-3-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit 1dcdce5919115a471bf4921a57f20050c545a236 Author: Ye Bin Date: Tue Mar 7 09:52:52 2023 +0800 ext4: move where set the MAY_INLINE_DATA flag is set The only caller of ext4_find_inline_data_nolock() that needs setting of EXT4_STATE_MAY_INLINE_DATA flag is ext4_iget_extra_inode(). In ext4_write_inline_data_end() we just need to update inode->i_inline_off. Since we are going to add one more caller that does not need to set EXT4_STATE_MAY_INLINE_DATA, just move setting of EXT4_STATE_MAY_INLINE_DATA out to ext4_iget_extra_inode(). Signed-off-by: Ye Bin Cc: stable@kernel.org Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230307015253.2232062-2-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit dee85ac02c1ac5420ebb9a92c6ba3ab0e03a3f2e Merge: 12508b3eb69e2 cee4034a3db1d Author: Jakub Kicinski Date: Fri Mar 10 21:42:58 2023 -0800 Merge branch 'mptcp-fixes-for-6-3' Matthieu Baerts says: ==================== mptcp: fixes for 6.3 Patch 1 fixes a possible deadlock in subflow_error_report() reported by lockdep. The report was in fact a false positive but the modification makes sense and silences lockdep to allow syzkaller to find real issues. The regression has been introduced in v5.12. Patch 2 is a refactoring needed to be able to fix the two next issues. It improves the situation and can be backported up to v6.0. Patches 3 and 4 fix UaF reported by KASAN. It fixes issues potentially visible since v5.7 and v5.19 but only reproducible until recently (v6.0). These two patches depend on patch 2/7. Patch 5 fixes the order of the printed values: expected vs seen values. The regression has been introduced recently: v6.3-rc1. Patch 6 adds missing ro_after_init flags. A previous patch added them for other functions but these two have been missed. This previous patch has been backported to stable versions (up to v5.12) so probably better to do the same here. Patch 7 fixes tcp_set_state() being called twice in a row since v5.10. Patch 8 fixes another lockdep false positive issue but this time in MPTCP PM code. Same here, some modifications in the code has been made to silence this issue and help finding real ones later. This issue can be seen since v6.2. v1: https://lore.kernel.org/r/20230227-upstream-net-20230227-mptcp-fixes-v1-0-070e30ae4a8e@tessares.net ==================== Link: https://lore.kernel.org/r/20230227-upstream-net-20230227-mptcp-fixes-v2-0-47c2e95eada9@tessares.net Signed-off-by: Jakub Kicinski commit cee4034a3db1d30c3243dd51506a9d4ab1a849fa Author: Paolo Abeni Date: Thu Mar 9 15:50:04 2023 +0100 mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() Christoph reports a lockdep splat in the mptcp_subflow_create_socket() error path, when such function is invoked by mptcp_pm_nl_create_listen_socket(). Such code path acquires two separates, nested socket lock, with the internal lock operation lacking the "nested" annotation. Adding that in sock_release() for mptcp's sake only could be confusing. Instead just add a new lockclass to the in-kernel msk socket, re-initializing the lockdep infra after the socket creation. Fixes: ad2171009d96 ("mptcp: fix locking for in-kernel listener creation") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/354 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Tested-by: Christoph Paasch Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 3ba14528684f528566fb7d956bfbfb958b591d86 Author: Matthieu Baerts Date: Thu Mar 9 15:50:03 2023 +0100 mptcp: avoid setting TCP_CLOSE state twice tcp_set_state() is called from tcp_done() already. There is then no need to first set the state to TCP_CLOSE, then call tcp_done(). Fixes: d582484726c4 ("mptcp: fix fallback for MP_JOIN subflows") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/362 Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 822467a48e938e661965d09df5fcac66f7291050 Author: Geliang Tang Date: Thu Mar 9 15:50:02 2023 +0100 mptcp: add ro_after_init for tcp{,v6}_prot_override Add __ro_after_init labels for the variables tcp_prot_override and tcpv6_prot_override, just like other variables adjacent to them, to indicate that they are initialised from the init hooks and no writes occur afterwards. Fixes: b19bc2945b40 ("mptcp: implement delegated actions") Cc: stable@vger.kernel.org Fixes: 51fa7f8ebf0e ("mptcp: mark ops structures as ro_after_init") Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 840742b7ed0e123e47af9c5c3902746f3d6b64a2 Author: Matthieu Baerts Date: Thu Mar 9 15:50:01 2023 +0100 selftests: mptcp: userspace pm: fix printed values In case of errors, the printed message had the expected and the seen value inverted. This patch simply correct the order: first the expected value, then the one that has been seen. Fixes: 10d4273411be ("selftests: mptcp: userspace: print error details if any") Cc: stable@vger.kernel.org Acked-by: Geliang Tang Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 0a3f4f1f9c27215e4ddcd312558342e57b93e518 Author: Paolo Abeni Date: Thu Mar 9 15:50:00 2023 +0100 mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue. BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0 Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266 CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 kasan_check_range+0x14a/0x1a0 _raw_spin_lock_bh+0x73/0xe0 subflow_error_report+0x6d/0x110 sk_error_report+0x3b/0x190 tcp_disconnect+0x138c/0x1aa0 inet_child_forget+0x6f/0x2e0 inet_csk_listen_stop+0x209/0x1060 __mptcp_close_ssk+0x52d/0x610 mptcp_destroy_common+0x165/0x640 mptcp_destroy+0x13/0x80 __mptcp_destroy_sock+0xe7/0x270 __mptcp_close+0x70e/0x9b0 mptcp_close+0x2b/0x150 inet_release+0xe9/0x1f0 __sock_release+0xd2/0x280 sock_close+0x15/0x20 __fput+0x252/0xa20 task_work_run+0x169/0x250 exit_to_user_mode_prepare+0x113/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The msk grace period can legitly expire in between the last reference count dropped in mptcp_subflow_queue_clean() and the later eventual access in inet_csk_listen_stop() After the previous patch we don't need anymore special-casing msk listener socket cleanup: the mptcp worker will process each of the unaccepted msk sockets. Just drop the now unnecessary code. Please note this commit depends on the two parent ones: mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets Fixes: 6aeed9045071 ("mptcp: fix race on unaccepted mptcp sockets") Cc: stable@vger.kernel.org Reported-and-tested-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/346 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit b6985b9b82954caa53f862d6059d06c0526254f0 Author: Paolo Abeni Date: Thu Mar 9 15:49:59 2023 +0100 mptcp: use the workqueue to destroy unaccepted sockets Christoph reported a UaF at token lookup time after having refactored the passive socket initialization part: BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260 Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198 CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 __token_bucket_busy+0x253/0x260 mptcp_token_new_connect+0x13d/0x490 mptcp_connect+0x4ed/0x860 __inet_stream_connect+0x80e/0xd90 tcp_sendmsg_fastopen+0x3ce/0x710 mptcp_sendmsg+0xff1/0x1a20 inet_sendmsg+0x11d/0x140 __sys_sendto+0x405/0x490 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc We need to properly clean-up all the paired MPTCP-level resources and be sure to release the msk last, even when the unaccepted subflow is destroyed by the TCP internals via inet_child_forget(). We can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra, explicitly checking that for the critical scenario: the closed subflow is the MPC one, the msk is not accepted and eventually going through full cleanup. With such change, __mptcp_destroy_sock() is always called on msk sockets, even on accepted ones. We don't need anymore to transiently drop one sk reference at msk clone time. Please note this commit depends on the parent one: mptcp: refactor passive socket initialization Fixes: 58b09919626b ("mptcp: create msk early") Cc: stable@vger.kernel.org Reported-and-tested-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/347 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 3a236aef280ed5122b2d47087eb514d0921ae033 Author: Paolo Abeni Date: Thu Mar 9 15:49:58 2023 +0100 mptcp: refactor passive socket initialization After commit 30e51b923e43 ("mptcp: fix unreleased socket in accept queue") unaccepted msk sockets go throu complete shutdown, we don't need anymore to delay inserting the first subflow into the subflow lists. The reference counting deserve some extra care, as __mptcp_close() is unaware of the request socket linkage to the first subflow. Please note that this is more a refactoring than a fix but because this modification is needed to include other corrections, see the following commits. Then a Fixes tag has been added here to help the stable team. Fixes: 30e51b923e43 ("mptcp: fix unreleased socket in accept queue") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Tested-by: Christoph Paasch Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit b7a679ba7c652587b85294f4953f33ac0b756d40 Author: Paolo Abeni Date: Thu Mar 9 15:49:57 2023 +0100 mptcp: fix possible deadlock in subflow_error_report Christoph reported a possible deadlock while the TCP stack destroys an unaccepted subflow due to an incoming reset: the MPTCP socket error path tries to acquire the msk-level socket lock while TCP still owns the listener socket accept queue spinlock, and the reverse dependency already exists in the TCP stack. Note that the above is actually a lockdep false positive, as the chain involves two separate sockets. A different per-socket lockdep key will address the issue, but such a change will be quite invasive. Instead, we can simply stop earlier the socket error handling for orphaned or unaccepted subflows, breaking the critical lockdep chain. Error handling in such a scenario is a no-op. Reported-and-tested-by: Christoph Paasch Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") Cc: stable@vger.kernel.org Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/355 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 12508b3eb69e2c13e82bbc746ec74b6fcaf33fd4 Merge: 7e4f8a0c49541 481e96fc1307e Author: Jakub Kicinski Date: Fri Mar 10 21:33:49 2023 -0800 Merge branch 'update-xdp_features-flag-according-to-nic-re-configuration' Lorenzo Bianconi says: ==================== update xdp_features flag according to NIC re-configuration Changes since v1: - rebase on top of net tree - remove NETDEV_XDP_ACT_NDO_XMIT_SG support in mlx5e driver - always enable NETDEV_XDP_ACT_NDO_XMIT support in mlx5e driver ==================== Link: https://lore.kernel.org/r/cover.1678364612.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 481e96fc1307eb52c0c449608e629921ecbbaf15 Author: Matteo Croce Date: Thu Mar 9 13:25:32 2023 +0100 mvpp2: take care of xdp_features when reconfiguring queues XDP is supported only if enough queues are present, so when reconfiguring the queues set xdp_features accordingly. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Suggested-by: Lorenzo Bianconi Signed-off-by: Matteo Croce Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit 4d5ab0ad964df178beba031b89429a601893ff61 Author: Lorenzo Bianconi Date: Thu Mar 9 13:25:31 2023 +0100 net/mlx5e: take into account device reconfiguration for xdp_features flag Take into account LRO and GRO configuration setting device xdp_features flag. Consider channel rq_wq_type enabling rx scatter-gatter support in xdp_features flag and disable NETDEV_XDP_ACT_NDO_XMIT_SG since it is not supported yet by the driver. Moreover always enable NETDEV_XDP_ACT_NDO_XMIT as the ndo_xdp_xmit callback does not require to load a dummy xdp program on the NIC. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Co-developed-by: Tariq Toukan Signed-off-by: Tariq Toukan Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit fccca038f3003daa8f28a5e5d97efe50f04b8d9d Author: Lorenzo Bianconi Date: Thu Mar 9 13:25:30 2023 +0100 veth: take into account device reconfiguration for xdp_features flag Take into account tx/rx queues reconfiguration setting device xdp_features flag. Moreover consider NETIF_F_GRO flag in order to enable ndo_xdp_xmit callback. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit 7aa6dc351b92abbfead9ebe25ce7a7ac0384ea6d Author: Lorenzo Bianconi Date: Thu Mar 9 13:25:29 2023 +0100 net: ena: take into account xdp_features setting tx/rx queues ena nic allows xdp just if enough hw queues are available for XDP. Take into account queues configuration setting xdp_features. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Reviewed-by: Shay Agroskin Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit 3c249fe4de1608a9af56563606d4f6eb3a64a47f Author: Lorenzo Bianconi Date: Thu Mar 9 13:25:28 2023 +0100 net: thunderx: take into account xdp_features setting tx/rx queues thunderx nic allows xdp just if enough hw queues are available for XDP. Take into account queues configuration setting xdp_features. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit f85949f98206b3b11d92d695cea4efda6a81f00e Author: Lorenzo Bianconi Date: Thu Mar 9 13:25:27 2023 +0100 xdp: add xdp_set_features_flag utility routine Introduce xdp_set_features_flag utility routine in order to update dynamically xdp_features according to the dynamic hw configuration via ethtool (e.g. changing number of hw rx/tx queues). Add xdp_clear_features_flag() in order to clear all xdp_feature flag. Reviewed-by: Shay Agroskin Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit bf51d27704c963ea52c0843096e23c9f404b13af Author: Lorenzo Bianconi Date: Thu Mar 9 13:25:26 2023 +0100 tools: ynl: fix get_mask utility routine Fix get_mask utility routine in order to take into account possible gaps in the elements list. Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit 8f76a4f80fba8096a611b6b60c40a0f4cab3ddfb Author: Lorenzo Bianconi Date: Thu Mar 9 13:25:25 2023 +0100 tools: ynl: fix render-max for flags definition Properly manage render-max property for flags definition type introducing mask value and setting it to (last_element << 1) - 1 instead of adding max value set to last_element + 1 Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") Signed-off-by: Lorenzo Bianconi Signed-off-by: Jakub Kicinski commit 7e4f8a0c495413a50413e8c9f1032ce1bc633bae Author: Ivan Vecera Date: Thu Mar 9 10:45:09 2023 -0800 i40e: Fix kernel crash during reboot when adapter is in recovery mode If the driver detects during probe that firmware is in recovery mode then i40e_init_recovery_mode() is called and the rest of probe function is skipped including pci_set_drvdata(). Subsequent i40e_shutdown() called during shutdown/reboot dereferences NULL pointer as pci_get_drvdata() returns NULL. To fix call pci_set_drvdata() also during entering to recovery mode. Reproducer: 1) Lets have i40e NIC with firmware in recovery mode 2) Run reboot Result: [ 139.084698] i40e: Intel(R) Ethernet Connection XL710 Network Driver [ 139.090959] i40e: Copyright (c) 2013 - 2019 Intel Corporation. [ 139.108438] i40e 0000:02:00.0: Firmware recovery mode detected. Limiting functionality. [ 139.116439] i40e 0000:02:00.0: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode. [ 139.129499] i40e 0000:02:00.0: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a] [ 139.215932] i40e 0000:02:00.0 enp2s0f0: renamed from eth0 [ 139.223292] i40e 0000:02:00.1: Firmware recovery mode detected. Limiting functionality. [ 139.231292] i40e 0000:02:00.1: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode. [ 139.244406] i40e 0000:02:00.1: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a] [ 139.329209] i40e 0000:02:00.1 enp2s0f1: renamed from eth0 ... [ 156.311376] BUG: kernel NULL pointer dereference, address: 00000000000006c2 [ 156.318330] #PF: supervisor write access in kernel mode [ 156.323546] #PF: error_code(0x0002) - not-present page [ 156.328679] PGD 0 P4D 0 [ 156.331210] Oops: 0002 [#1] PREEMPT SMP NOPTI [ 156.335567] CPU: 26 PID: 15119 Comm: reboot Tainted: G E 6.2.0+ #1 [ 156.343126] Hardware name: Abacus electric, s.r.o. - servis@abacus.cz Super Server/H12SSW-iN, BIOS 2.4 04/13/2022 [ 156.353369] RIP: 0010:i40e_shutdown+0x15/0x130 [i40e] [ 156.358430] Code: c1 fc ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 48 89 fd 53 48 8b 9f 48 01 00 00 80 8b c2 06 00 00 04 f0 80 8b c0 06 00 00 08 48 8d bb 08 08 00 [ 156.377168] RSP: 0018:ffffb223c8447d90 EFLAGS: 00010282 [ 156.382384] RAX: ffffffffc073ee70 RBX: 0000000000000000 RCX: 0000000000000001 [ 156.389510] RDX: 0000000080000001 RSI: 0000000000000246 RDI: ffff95db49988000 [ 156.396634] RBP: ffff95db49988000 R08: ffffffffffffffff R09: ffffffff8bd17d40 [ 156.403759] R10: 0000000000000001 R11: ffffffff8a5e3d28 R12: ffff95db49988000 [ 156.410882] R13: ffffffff89a6fe17 R14: ffff95db49988150 R15: 0000000000000000 [ 156.418007] FS: 00007fe7c0cc3980(0000) GS:ffff95ea8ee80000(0000) knlGS:0000000000000000 [ 156.426083] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 156.431819] CR2: 00000000000006c2 CR3: 00000003092fc005 CR4: 0000000000770ee0 [ 156.438944] PKRU: 55555554 [ 156.441647] Call Trace: [ 156.444096] [ 156.446199] pci_device_shutdown+0x38/0x60 [ 156.450297] device_shutdown+0x163/0x210 [ 156.454215] kernel_restart+0x12/0x70 [ 156.457872] __do_sys_reboot+0x1ab/0x230 [ 156.461789] ? vfs_writev+0xa6/0x1a0 [ 156.465362] ? __pfx_file_free_rcu+0x10/0x10 [ 156.469635] ? __call_rcu_common.constprop.85+0x109/0x5a0 [ 156.475034] do_syscall_64+0x3e/0x90 [ 156.478611] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 156.483658] RIP: 0033:0x7fe7bff37ab7 Fixes: 4ff0ee1af016 ("i40e: Introduce recovery mode support") Signed-off-by: Ivan Vecera Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230309184509.984639-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 59a0b022aa249e3f5735d93de0849341722c4754 Author: Jianguo Wu Date: Thu Mar 9 10:03:36 2023 +0800 ipvlan: Make skb->skb_iif track skb->dev for l3s mode For l3s mode, skb->dev is set to ipvlan interface in ipvlan_nf_input(): skb->dev = addr->master->dev but, skb->skb_iif remain unchanged, this will cause socket lookup failed if a target socket is bound to a interface, like the following example: ip link add ipvlan0 link eth0 type ipvlan mode l3s ip addr add dev ipvlan0 192.168.124.111/24 ip link set ipvlan0 up ping -c 1 -I ipvlan0 8.8.8.8 100% packet loss This is because there is no match sk in __raw_v4_lookup() as sk->sk_bound_dev_if != dif(skb->skb_iif). Fix this by make skb->skb_iif track skb->dev in ipvlan_nf_input(). Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes") Signed-off-by: Jianguo Wu Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/29865b1f-6db7-c07a-de89-949d3721ea30@163.com Signed-off-by: Jakub Kicinski commit 8ba572052a4b8fe5b205854d27e54e3486049b71 Author: Radu Pirea (OSS) Date: Thu Mar 9 12:01:11 2023 +0200 net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit According to the TJA1103 user manual, the bit for the reversed role in MII or RMII modes is bit 4. Cc: # 5.15+ Fixes: b050f2f15e04 ("phy: nxp-c45: add driver for tja1103") Signed-off-by: Radu Pirea (OSS) Link: https://lore.kernel.org/r/20230309100111.1246214-1-radu-nicolae.pirea@oss.nxp.com Signed-off-by: Jakub Kicinski commit ef5f68cc1f829b492b19cd4df5af4454aa816b93 Merge: 40f879bdd3450 288b3271d920c Author: Linus Torvalds Date: Fri Mar 10 20:45:53 2023 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Twenty fixes all in drivers except the one zone storage revalidation fix to sd. The megaraid_sas fixes are more on the level of a driver update (enabling crash dump and increasing lun number) but I thought you could let this slide on -rc1 and the next most extensive update is a load of fixes to mpi3mr" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sd: Fix wrong zone_write_granularity value during revalidate scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file scsi: megaraid_sas: Driver version update to 07.725.01.00-rc1 scsi: megaraid_sas: Add crash dump mode capability bit in MFI capabilities scsi: megaraid_sas: Update max supported LD IDs to 240 scsi: mpi3mr: Bad drive in topology results kernel crash scsi: mpi3mr: NVMe command size greater than 8K fails scsi: mpi3mr: Return proper values for failures in firmware init path scsi: mpi3mr: Wait for diagnostic save during controller init scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt scsi: lpfc: Avoid usage of list iterator variable after loop scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() scsi: ufs: mcq: qcom: Clean the return path of ufs_qcom_mcq_config_resource() scsi: ufs: mcq: qcom: Fix passing zero to PTR_ERR scsi: ufs: ufs-qcom: Remove impossible check scsi: ufs: core: Add soft dependency on governor_simpleondemand scsi: hisi_sas: Check devm_add_action() return value scsi: qla2xxx: Add option to disable FC2 Target support scsi: target: iscsi: Fix an error message in iscsi_check_key() commit 40f879bdd3450f20ff1db48e7a8366fc24dcc7fe Merge: d33d4c9e0888e e2f2a39452c43 Author: Linus Torvalds Date: Fri Mar 10 20:06:49 2023 -0800 Merge tag 'block-6.3-2023-03-09' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fix a regression in exclusive mode handling of the partition code, introduced in this merge windoe (Yu) - Fix for a use-after-free in BFQ (Yu) - Add sysfs documentation for the 'hidden' attribute (Sagi) * tag 'block-6.3-2023-03-09' of git://git.kernel.dk/linux: block, bfq: fix uaf for 'stable_merge_bfqq' docs: sysfs-block: document hidden sysfs entry block: fix wrong mode for blkdev_put() from disk_scan_partitions() commit d33d4c9e0888e9ee7666813b3f9ecc244a64d127 Merge: 4831f76247bc9 849ad04cf562a Author: Linus Torvalds Date: Fri Mar 10 19:09:18 2023 -0800 Merge tag 'pull-highmem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull put_and_unmap_page() helper from Al Viro: "kmap_local_page() conversions in local filesystems keep running into kunmap_local_page()+put_page() combinations. We can keep inventing names for identical inline helpers, but it's getting rather inconvenient. I've added a trivial helper to linux/highmem.h instead. I would've held that back until the merge window, if not for the mess it causes in tree topology - I've several branches merging from that one, and it's only going to get worse if e.g. ext2 stuff gets picked by Jan" * tag 'pull-highmem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: new helper: put_and_unmap_page() commit 4831f76247bc939ed1b6d71ddd23337ec8b56b8e Merge: a0aefd306ebb3 609d54441493c Author: Linus Torvalds Date: Fri Mar 10 19:04:10 2023 -0800 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc fixes from Al Viro: "pick_file() speculation fix + fix for alpha mis(merge,cherry-pick) The fs/file.c one is a genuine missing speculation barrier in pick_file() (reachable e.g. via close(2)). The alpha one is strictly speaking not a bug fix, but only because confusion between preempt_enable() and preempt_disable() is harmless on architecture without CONFIG_PREEMPT. Looks like alpha.git picked the wrong version of patch - that braino used to be there in early versions, but it had been fixed quite a while ago..." * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: prevent out-of-bounds array speculation when closing a file descriptor alpha: fix lazy-FPU mis(merged/applied/whatnot) commit a0aefd306ebb394ea72e04f53f64d76b05d5e39f Merge: 55a21105ecc15 52f04f10b9005 Author: Linus Torvalds Date: Fri Mar 10 19:01:15 2023 -0800 Merge tag 'thermal-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fix from Rafael Wysocki: "Fix a recently introduced deadlock in the int340x thermal control driver (Srinivas Pandruvada)" * tag 'thermal-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: int340x: processor_thermal: Fix deadlock commit 27c30b9b449aaee3b85006b63e08b33016cf7333 Merge: 71582371a5ee0 96c0695083775 Author: Jakub Kicinski Date: Fri Mar 10 18:19:55 2023 -0800 Merge tag 'wireless-2023-03-10' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just a few fixes: * MLO connection socket ownership didn't work * basic rates validation was missing (reported by by a private syzbot instances) * puncturing bitmap netlink policy was completely broken * properly check chandef for NULL channel, it can be pointing to a chandef that's still uninitialized * tag 'wireless-2023-03-10' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: cfg80211: fix MLO connection ownership wifi: mac80211: check basic rates validity wifi: nl80211: fix puncturing bitmap policy wifi: nl80211: fix NULL-ptr deref in offchan check ==================== Link: https://lore.kernel.org/r/20230310114647.35422-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 71582371a5ee09272b4b4b0a07fa6eb78c9d2f90 Author: Jiri Pirko Date: Thu Mar 9 12:49:11 2023 +0100 MAINTAINERS: make my email address consistent Use jiri@resnulli.us in all MAINTAINERS entries and fixup .mailmap so all other addresses point to that one. Signed-off-by: Jiri Pirko Link: https://lore.kernel.org/r/20230309114911.923460-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 19631658e64e1a00742cdb14aa18f9159fd7e461 Merge: 484b7059796e3 cd1c604aa1d8c Author: Jakub Kicinski Date: Fri Mar 10 16:46:02 2023 -0800 Merge branch 'add-checking-sq-is-full-inside-xdp-xmit' Xuan Zhuo says: ==================== add checking sq is full inside xdp xmit If the queue of xdp xmit is not an independent queue, then when the xdp xmit used all the desc, the xmit from the __dev_queue_xmit() may encounter the following error. net ens4: Unexpected TXQ (0) queue failure: -28 This patch adds a check whether sq is full in XDP Xmit. ==================== Link: https://lore.kernel.org/r/20230308024935.91686-1-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski commit cd1c604aa1d8c641f5edcb58b76352d4eba06ec1 Author: Xuan Zhuo Date: Wed Mar 8 10:49:35 2023 +0800 virtio_net: add checking sq is full inside xdp xmit If the queue of xdp xmit is not an independent queue, then when the xdp xmit used all the desc, the xmit from the __dev_queue_xmit() may encounter the following error. net ens4: Unexpected TXQ (0) queue failure: -28 This patch adds a check whether sq is full in xdp xmit. Fixes: 56434a01b12e ("virtio_net: add XDP_TX support") Reported-by: Yichun Zhang Signed-off-by: Xuan Zhuo Reviewed-by: Alexander Duyck Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: Jakub Kicinski commit b8ef4809bc7faa22e63de921ef56de21ed191af0 Author: Xuan Zhuo Date: Wed Mar 8 10:49:34 2023 +0800 virtio_net: separate the logic of checking whether sq is full Separate the logic of checking whether sq is full. The subsequent patch will reuse this func. Signed-off-by: Xuan Zhuo Reviewed-by: Alexander Duyck Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: Jakub Kicinski commit 25074a44ac4e5dae5b4a25dcb9bbfcbd00f15ae2 Author: Xuan Zhuo Date: Wed Mar 8 10:49:33 2023 +0800 virtio_net: reorder some funcs The purpose of this is to facilitate the subsequent addition of new functions without introducing a separate declaration. Signed-off-by: Xuan Zhuo Acked-by: Michael S. Tsirkin Signed-off-by: Jakub Kicinski commit 484b7059796e3bc1cb527caa61dfc60da649b4f6 Author: Fedor Pchelkin Date: Thu Mar 9 19:50:50 2023 +0300 nfc: pn533: initialize struct pn533_out_arg properly struct pn533_out_arg used as a temporary context for out_urb is not initialized properly. Its uninitialized 'phy' field can be dereferenced in error cases inside pn533_out_complete() callback function. It causes the following failure: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc3-next-20230110-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:pn533_out_complete.cold+0x15/0x44 drivers/nfc/pn533/usb.c:441 Call Trace: __usb_hcd_giveback_urb+0x2b6/0x5c0 drivers/usb/core/hcd.c:1671 usb_hcd_giveback_urb+0x384/0x430 drivers/usb/core/hcd.c:1754 dummy_timer+0x1203/0x32d0 drivers/usb/gadget/udc/dummy_hcd.c:1988 call_timer_fn+0x1da/0x800 kernel/time/timer.c:1700 expire_timers+0x234/0x330 kernel/time/timer.c:1751 __run_timers kernel/time/timer.c:2022 [inline] __run_timers kernel/time/timer.c:1995 [inline] run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035 __do_softirq+0x1fb/0xaf6 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107 Initialize the field with the pn533_usb_phy currently used. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 9dab880d675b ("nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()") Reported-by: syzbot+1e608ba4217c96d1952f@syzkaller.appspotmail.com Signed-off-by: Fedor Pchelkin Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230309165050.207390-1-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit e8c8361cfdbf450f760e8a2bdbd4222d1947366b Author: Alexei Starovoitov Date: Fri Mar 10 12:47:51 2023 -0800 selftests/bpf: Fix progs/test_deny_namespace.c issues. The following build error can be seen: progs/test_deny_namespace.c:22:19: error: call to undeclared function 'BIT_LL'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] __u64 cap_mask = BIT_LL(CAP_SYS_ADMIN); The struct kernel_cap_struct no longer exists in the kernel as well. Adjust bpf prog to fix both issues. Fixes: f122a08b197d ("capability: just use a 'u64' instead of a 'u32[2]' array") Signed-off-by: Alexei Starovoitov commit 32513d40d908b267508d37994753d9bd1600914b Author: Alexei Starovoitov Date: Fri Mar 10 12:41:18 2023 -0800 selftests/bpf: Fix progs/find_vma_fail1.c build error. The commit 11e456cae91e ("selftests/bpf: Fix compilation errors: Assign a value to a constant") fixed the issue cleanly in bpf-next. This is an alternative fix in bpf tree to avoid merge conflict between bpf and bpf-next. Signed-off-by: Alexei Starovoitov commit 624c60f326c6e5a80b008e8a5c7feffe8c27dc72 Author: Guillaume Tucker Date: Tue Aug 9 16:22:31 2022 +0200 selftests: fix LLVM build for i386 and x86_64 Add missing cases for the i386 and x86_64 architectures when determining the LLVM target for building kselftest. Fixes: 795285ef2425 ("selftests: Fix clang cross compilation") Signed-off-by: Guillaume Tucker Reviewed-by: Nathan Chancellor Signed-off-by: Shuah Khan commit d6f7ff9dd387861fa30cbc6375d15b586da17d33 Author: Jesus Sanchez-Palencia Date: Wed Mar 8 16:48:36 2023 -0800 libbpf: Revert poisoning of strlcpy This reverts commit 6d0c4b11e743("libbpf: Poison strlcpy()"). It added the pragma poison directive to libbpf_internal.h to protect against accidental usage of strlcpy but ended up breaking the build for toolchains based on libcs which provide the strlcpy() declaration from string.h (e.g. uClibc-ng). The include order which causes the issue is: string.h, from Iibbpf_common.h:12, from libbpf.h:20, from libbpf_internal.h:26, from strset.c:9: Fixes: 6d0c4b11e743 ("libbpf: Poison strlcpy()") Signed-off-by: Jesus Sanchez-Palencia Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230309004836.2808610-1-jesussanp@google.com Signed-off-by: Alexei Starovoitov commit dbf56d2fb53b7397002219bd221cfc72aadfdc82 Author: Alessandro Manca Date: Fri Mar 10 17:49:33 2023 +0100 HID: topre: Add support for 87 keys Realforce R2 The tenkeyless version of the Realforce R2 has the same issue of the full size one, the report fixup is needed to make n-key rollover work instead of 6 key rollover Signed-off-by: Alessandro Manca Signed-off-by: Jiri Kosina commit 55a21105ecc156495446d8ae75d7d73f66baed7b Merge: b0d14d2aaf7d4 2a8db5ec4a28a Author: Linus Torvalds Date: Fri Mar 10 09:19:30 2023 -0800 Merge tag 'riscv-for-linus-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - RISC-V architecture-specific ELF attributes have been disabled in the kernel builds - A fix for a locking failure while during errata patching that manifests on SiFive-based systems - A fix for a KASAN failure during stack unwinding - A fix for some lockdep failures during text patching * tag 'riscv-for-linus-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: Don't check text_mutex during stop_machine riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode RISC-V: fix taking the text_mutex twice during sifive errata patching RISC-V: Stop emitting attributes commit 0b04d4c0542e8573a837b1d81b94209e48723b25 Author: Douglas Raillard Date: Mon Mar 6 12:25:49 2023 +0000 f2fs: Fix f2fs_truncate_partial_nodes ftrace event Fix the nid_t field so that its size is correctly reported in the text format embedded in trace.dat files. As it stands, it is reported as being of size 4: field:nid_t nid[3]; offset:24; size:4; signed:0; Instead of 12: field:nid_t nid[3]; offset:24; size:12; signed:0; This also fixes the reported offset of subsequent fields so that they match with the actual struct layout. Signed-off-by: Douglas Raillard Reviewed-by: Mukesh Ojha Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b0d14d2aaf7d4b36b44f5a09955ebdf9eef4b0f8 Merge: 388a810192fd3 519b23310aa10 Author: Linus Torvalds Date: Fri Mar 10 08:57:46 2023 -0800 Merge tag 'drm-fixes-2023-03-10' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Weekly fixes. msm and amdgpu are the vast majority of these, otherwise some straggler misc from last week for nouveau and cirrus and a mailmap update for a drm developer. mailmap: - add an entry nouveau: - fix system shutdown regression - build warning fix cirrus: - NULL ptr deref fix msm: - fix invalid ptr free in syncobj cleanup - sync GMU removal in teardown - a5xx preemption fixes - fix runpm imbalance - DPU hw fixes - stack corruption fix - clear DSPP reservation amdgpu: - Misc display fixes - UMC 8.10 fixes - Driver unload fixes - NBIO 7.3.0 fix - Error checking fixes for soc15, nv, soc21 read register interface - Fix video cap query for VCN 4.0.4 amdkfd: - Fix return check in doorbell handling" * tag 'drm-fixes-2023-03-10' of git://anongit.freedesktop.org/drm/drm: (42 commits) drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 drm/amdgpu: Fix the warning info when removing amdgpu device drm/amdgpu: fix return value check in kfd drm/amd: Fix initialization mistake for NBIO 7.3.0 drm/amdgpu: Fix call trace warning and hang when removing amdgpu device mailmap: add mailmap entries for Faith. drm/msm: DEVFREQ_GOV_SIMPLE_ONDEMAND is no longer needed drm/amd/display: Update clock table to include highest clock setting drm/amd/pm: Enable ecc_info table support for smu v13_0_10 drm/amdgpu: Support umc node harvest config on umc v8_10 drm/connector: print max_requested_bpc in state debugfs drm/display: Don't block HDR_OUTPUT_METADATA on unknown EOTF drm/msm/dpu: clear DSPP reservations in rm release drm/msm/disp/dpu: fix sc7280_pp base offset drm/msm/dpu: fix stack smashing in dpu_hw_ctl_setup_blendstage drm/msm/dpu: don't use DPU_CLK_CTRL_CURSORn for DMA SSPP clocks drm/msm/dpu: fix clocks settings for msm8998 SSPP blocks ... commit 388a810192fd383acce6933e7f272dd6a6802bb0 Merge: 92cadfcffac3f 3993f4f456309 Author: Linus Torvalds Date: Fri Mar 10 08:51:57 2023 -0800 Merge tag 'erofs-for-6.3-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "The most important one reverts an improper fix which can cause an unexpected warning more often on specific images, and another one fixes LZMA decompression on 32-bit platforms. The others are minor fixes and cleanups. - Fix LZMA decompression failure on HIGHMEM platforms - Revert an inproper fix since it is actually an implementation issue of vmalloc() - Avoid a wrong DBG_BUGON since it could be triggered with -EINTR - Minor cleanups" * tag 'erofs-for-6.3-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: use wrapper i_blocksize() in erofs_file_read_iter() erofs: get rid of a useless DBG_BUGON erofs: Revert "erofs: fix kvcalloc() misuse with __GFP_NOFAIL" erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms erofs: mark z_erofs_lzma_init/erofs_pcpubuf_init w/ __init commit 92cadfcffac3ff2dafc892b7725d1016c8a1b6ee Merge: ae195ca1a8a4a 9ca6705d9d609 Author: Linus Torvalds Date: Fri Mar 10 08:45:30 2023 -0800 Merge tag 'nfsd-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - Protect NFSD writes against filesystem freezing - Fix a potential memory leak during server shutdown * tag 'nfsd-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Fix a server shutdown leak NFSD: Protect against filesystem freezing commit ae195ca1a8a4af75073e82c485148897c923f88f Merge: f331c5de7960d 675dfe1223a69 Author: Linus Torvalds Date: Fri Mar 10 08:39:13 2023 -0800 Merge tag 'for-6.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "First batch of fixes. Among them there are two updates to sysfs and ioctl which are not strictly fixes but are used for testing so there's no reason to delay them. - fix block group item corruption after inserting new block group - fix extent map logging bit not cleared for split maps after dropping range - fix calculation of unusable block group space reporting bogus values due to 32/64b division - fix unnecessary increment of read error stat on write error - improve error handling in inode update - export per-device fsid in DEV_INFO ioctl to distinguish seeding devices, needed for testing - allocator size classes: - fix potential dead lock in size class loading logic - print sysfs stats for the allocation classes" * tag 'for-6.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix block group item corruption after inserting new block group btrfs: fix extent map logging bit not cleared for split maps after dropping range btrfs: fix percent calculation for bg reclaim message btrfs: fix unnecessary increment of read error stat on write error btrfs: handle btrfs_del_item errors in __btrfs_update_delayed_inode btrfs: ioctl: return device fsid from DEV_INFO ioctl btrfs: fix potential dead lock in size class loading logic btrfs: sysfs: add size class stats commit f331c5de7960d69fc767d2dc08f5f5859ce70061 Merge: 49be4fb28109b fa780334a8c39 Author: Linus Torvalds Date: Fri Mar 10 08:31:29 2023 -0800 Merge tag 'io_uring-6.3-2023-03-09' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Stop setting PF_NO_SETAFFINITY on io-wq workers. This has been reported in the past as it confuses some applications, as some of their threads will fail with -1/EINVAL if attempted affinitized. Most recent report was on cpusets, where enabling that with io-wq workers active will fail. Just deal with the mask changing by checking when a worker times out, and then exit if we have no work pending. - Fix an issue with passthrough support where we don't properly check if the file type has pollable uring_cmd support. - Fix a reported W=1 warning on a variable being set and unused. Add a special helper for iterating these lists that doesn't save the previous list element, if that iterator never ends up using it. * tag 'io_uring-6.3-2023-03-09' of git://git.kernel.dk/linux: io_uring: silence variable ‘prev’ set but not used warning io_uring/uring_cmd: ensure that device supports IOPOLL io_uring/io-wq: stop setting PF_NO_SETAFFINITY on io-wq workers commit 49be4fb28109b86a8ffe117415c306389a394cb2 Merge: 44889ba56cbb3 5b201a82cd9d0 Author: Linus Torvalds Date: Fri Mar 10 08:18:46 2023 -0800 Merge tag 'perf-tools-fixes-for-v6.3-1-2023-03-09' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Add Adrian Hunter to MAINTAINERS as a perf tools reviewer - Sync various tools/ copies of kernel headers with the kernel sources, this time trying to avoid first merging with upstream to then update but instead copy from upstream so that a merge is avoided and the end result after merging this pull request is the one expected, tools/perf/check-headers.sh (mostly) happy, less warnings while building tools/perf/ - Fix counting when initial delay configured by setting perf_attr.enable_on_exec when starting workloads from the perf command line - Don't avoid emitting a PERF_RECORD_MMAP2 in 'perf inject --buildid-all' when that record comes with a build-id, otherwise we end up not being able to resolve symbols - Don't use comma as the CSV output separator the "stat+csv_output" test, as comma can appear on some tests as a modifier for an event, use @ instead, ditto for the JSON linter test - The offcpu test was looking for some bits being set on task_struct->prev_state without masking other bits not important for this specific 'perf test', fix it * tag 'perf-tools-fixes-for-v6.3-1-2023-03-09' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf tools: Add Adrian Hunter to MAINTAINERS as a reviewer tools headers UAPI: Sync linux/perf_event.h with the kernel sources tools headers x86 cpufeatures: Sync with the kernel sources tools include UAPI: Sync linux/vhost.h with the kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers kvm: Sync uapi/{asm/linux} kvm.h headers with the kernel sources tools include UAPI: Synchronize linux/fcntl.h with the kernel sources tools headers: Synchronize {linux,vdso}/bits.h with the kernel sources tools headers UAPI: Sync linux/prctl.h with the kernel sources tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench' perf stat: Fix counting when initial delay configured tools headers svm: Sync svm headers with the kernel sources perf test: Avoid counting commas in json linter perf tests stat+csv_output: Switch CSV separator to @ perf inject: Fix --buildid-all not to eat up MMAP2 tools arch x86: Sync the msr-index.h copy with the kernel sources perf test: Fix offcpu test prev_state check commit 50c6b976fb66f623440066f8e44309b4c2f687a0 Author: Philippe Troin Date: Mon Mar 6 10:18:36 2023 -0800 HID: add HP 13t-aw100 & 14t-ea100 digitizer battery quirks Similar to many other devices using the Synopsys Designware Elantech hardware, HP Spectre x360 13t-aw100 and 14t-ea100 report an empty battery devices, supposedly for the active stylus. Apply the HID_BATTERY_QUIRK_IGNORE quirk to ignore the battery reports from these devices. Note that there are multiple versions of the panel installed in the 14t-ea100. Signed-off-by: Philippe Troin Signed-off-by: Jiri Kosina commit e57d06527738798039b8e91af762fbd33881b34d Author: Chuck Lever Date: Wed Mar 8 09:45:09 2023 -0500 NFS & NFSD: Update GSS dependencies Geert reports that: > On v6.2, "make ARCH=m68k defconfig" gives you > CONFIG_RPCSEC_GSS_KRB5=m > On v6.3, it became builtin, due to dropping the dependencies on > the individual crypto modules. > > $ grep -E "CRYPTO_(MD5|DES|CBC|CTS|ECB|HMAC|SHA1|AES)" .config > CONFIG_CRYPTO_AES=y > CONFIG_CRYPTO_AES_TI=m > CONFIG_CRYPTO_DES=m > CONFIG_CRYPTO_CBC=m > CONFIG_CRYPTO_CTS=m > CONFIG_CRYPTO_ECB=m > CONFIG_CRYPTO_HMAC=m > CONFIG_CRYPTO_MD5=m > CONFIG_CRYPTO_SHA1=m This behavior is triggered by the "default y" in the definition of RPCSEC_GSS. The "default y" was added in 2010 by commit df486a25900f ("NFS: Fix the selection of security flavours in Kconfig"). However, svc_gss_principal was removed in 2012 by commit 03a4e1f6ddf2 ("nfsd4: move principal name into svc_cred"), so the 2010 fix is no longer necessary. We can safely change the NFS_V4 and NFSD_V4 dependencies back to RPCSEC_GSS_KRB5 to get the nicer v6.2 behavior back. Selecting KRB5 symbolically represents the true requirement here: that all spec-compliant NFSv4 implementations must have Kerberos available to use. Reported-by: Geert Uytterhoeven Fixes: dfe9a123451a ("SUNRPC: Enable rpcsec_gss_krb5.ko to be built without CRYPTO_DES") Signed-off-by: Chuck Lever commit fe9ae05cfbe587dda724fcf537c00bc2f287da62 Author: Takashi Iwai Date: Wed Mar 8 11:50:12 2023 +0100 fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() The recent fix for the deferred I/O by the commit 3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices") caused a regression when the same fb device is opened/closed while it's being used. It resulted in a frozen screen even if something is redrawn there after the close. The breakage is because the patch was made under a wrong assumption of a single open; in the current code, fb_deferred_io_release() cleans up the page mapping of the pageref list and it calls cancel_delayed_work_sync() unconditionally, where both are no correct behavior for multiple opens. This patch adds a refcount for the opens of the device, and applies the cleanup only when all files get closed. As both fb_deferred_io_open() and _close() are called always in the fb_info lock (mutex), it's safe to use the normal int for the refcounting. Also, a useless BUG_ON() is dropped. Fixes: 3efc61d95259 ("fbdev: Fix invalid page access after closing deferred I/O devices") Cc: Signed-off-by: Takashi Iwai Reviewed-by: Patrik Jakobsson Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230308105012.1845-1-tiwai@suse.de commit 3c66bb1918c262dd52fb4221a8d372619c5da70a Author: Ard Biesheuvel Date: Fri Mar 10 13:30:05 2023 +0100 arm64: efi: Set NX compat flag in PE/COFF header The PE/COFF header has a NX compat flag which informs the firmware that the application does not rely on memory regions being mapped with both executable and writable permissions at the same time. This is typically used by the firmware to decide whether it can set the NX attribute on all allocations it returns, but going forward, it may be used to enforce a policy that only permits applications with the NX flag set to be loaded to begin wiht in some configurations, e.g., when Secure Boot is in effect. Even though the arm64 version of the EFI stub may relocate the kernel before executing it, it always did so after disabling the MMU, and so we were always in line with what the NX compat flag conveys, we just never bothered to set it. So let's set the flag now. Cc: Signed-off-by: Ard Biesheuvel commit 3c60f67b4bd1bc01fa9194e9dc925ac6cb56156c Author: Ard Biesheuvel Date: Fri Mar 10 12:55:41 2023 +0100 efi/libstub: arm64: Remap relocated image with strict permissions After relocating the executable image, use the EFI memory attributes protocol to remap the code and data regions with the appropriate permissions. Signed-off-by: Ard Biesheuvel commit c7d9e628b8ff4d52a365a441bdacb3209ee83c81 Author: Ard Biesheuvel Date: Fri Mar 10 12:15:24 2023 +0100 efi/libstub: zboot: Mark zboot EFI application as NX compatible Now that the zboot loader will invoke the EFI memory attributes protocol to remap the decompressed code and rodata as read-only/executable, we can set the PE/COFF header flag that indicates to the firmware that the application does not rely on writable memory being executable at the same time. Cc: # v6.2+ Signed-off-by: Ard Biesheuvel commit 96c069508377547f913e7265a80fffe9355de592 Author: Johannes Berg Date: Wed Mar 1 12:09:33 2023 +0200 wifi: cfg80211: fix MLO connection ownership When disconnecting from an MLO connection we need the AP MLD address, not an arbitrary BSSID. Fix the code to do that. Fixes: 9ecff10e82a5 ("wifi: nl80211: refactor BSS lookup in nl80211_associate()") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230301115906.4c1b3b18980e.I008f070c7f3b8e8bde9278101ef9e40706a82902@changeid Signed-off-by: Johannes Berg commit ce04abc3fcc62cd5640af981ebfd7c4dc3bded28 Author: Johannes Berg Date: Fri Feb 24 10:52:19 2023 +0100 wifi: mac80211: check basic rates validity When userspace sets basic rates, it might send us some rates list that's empty or consists of invalid values only. We're currently ignoring invalid values and then may end up with a rates bitmap that's empty, which later results in a warning. Reject the call if there were no valid rates. Signed-off-by: Johannes Berg commit b27f07c50a73e34eefb6b1030b235192b7ded850 Author: Johannes Berg Date: Fri Feb 24 13:36:57 2023 +0100 wifi: nl80211: fix puncturing bitmap policy This was meant to be a u32, and while applying the patch I tried to use policy validation for it. However, not only did I copy/paste it to u8 instead of u32, but also used the policy range erroneously. Fix both of these issues. Fixes: d7c1a9a0ed18 ("wifi: nl80211: validate and configure puncturing bitmap") Signed-off-by: Johannes Berg commit f624bb6fad23df3270580b4fcef415c6e7bf7705 Author: Johannes Berg Date: Wed Mar 1 12:09:29 2023 +0200 wifi: nl80211: fix NULL-ptr deref in offchan check If, e.g. in AP mode, the link was already created by userspace but not activated yet, it has a chandef but the chandef isn't valid and has no channel. Check for this and ignore this link. Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230301115906.71bd4803fbb9.Iee39c0f6c2d3a59a8227674dc55d52e38b1090cf@changeid Signed-off-by: Johannes Berg commit 06be62083c5308c76a891ca975d66d832e2afc07 Author: Michael Walle Date: Fri Mar 10 09:48:45 2023 +0000 nvmem: core: return -ENOENT if nvmem cell is not found Prior to commit 5d8e6e6c10a3 ("nvmem: core: add an index parameter to the cell") of_nvmem_cell_get() would return -ENOENT if the cell wasn't found. Particularly, if of_property_match_string() returned -EINVAL, that return code was passed as the index to of_parse_phandle(), which then detected it as invalid and returned NULL. That led to an return code of -ENOENT. With the new code, the negative index will lead to an -EINVAL of of_parse_phandle_with_optional_args() which pass straight to the caller and break those who expect an -ENOENT. Fix it by always returning -ENOENT. Fixes: 5d8e6e6c10a3 ("nvmem: core: add an index parameter to the cell") Reported-by: Alexander Stein Link: https://lore.kernel.org/r/2143916.GUh0CODmnK@steina-w/ Signed-off-by: Michael Walle Tested-by: Alexander Stein Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230310094845.139400-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman commit 09e65ee9059d76b89cb713795748805efd3f50c6 Author: Si-Wei Liu Date: Tue Feb 14 17:30:40 2023 -0800 vdpa/mlx5: should not activate virtq object when suspended Otherwise the virtqueue object to instate could point to invalid address that was unmapped from the MTT: mlx5_core 0000:41:04.2: mlx5_cmd_out_err:782:(pid 8321): CREATE_GENERAL_OBJECT(0xa00) op_mod(0xd) failed, status bad parameter(0x3), syndrome (0x5fa1c), err(-22) Fixes: cae15c2ed8e6 ("vdpa/mlx5: Implement susupend virtqueue callback") Cc: Eli Cohen Signed-off-by: Si-Wei Liu Reviewed-by: Eli Cohen Message-Id: <1676424640-11673-1-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit aed8efddd39b3434c96718d39009285c52b1cafc Author: Cindy Lu Date: Tue Feb 14 16:09:24 2023 +0800 vp_vdpa: fix the crash in hot unplug with vp_vdpa While unplugging the vp_vdpa device, it triggers a kernel panic The root cause is: vdpa_mgmtdev_unregister() will accesses modern devices which will cause a use after free. So need to change the sequence in vp_vdpa_remove [ 195.003359] BUG: unable to handle page fault for address: ff4e8beb80199014 [ 195.004012] #PF: supervisor read access in kernel mode [ 195.004486] #PF: error_code(0x0000) - not-present page [ 195.004960] PGD 100000067 P4D 1001b6067 PUD 1001b7067 PMD 1001b8067 PTE 0 [ 195.005578] Oops: 0000 1 PREEMPT SMP PTI [ 195.005968] CPU: 13 PID: 164 Comm: kworker/u56:10 Kdump: loaded Not tainted 5.14.0-252.el9.x86_64 #1 [ 195.006792] Hardware name: Red Hat KVM/RHEL, BIOS edk2-20221207gitfff6d81270b5-2.el9 unknown [ 195.007556] Workqueue: kacpi_hotplug acpi_hotplug_work_fn [ 195.008059] RIP: 0010:ioread8+0x31/0x80 [ 195.008418] Code: 77 28 48 81 ff 00 00 01 00 76 0b 89 fa ec 0f b6 c0 c3 cc cc cc cc 8b 15 ad 72 93 01 b8 ff 00 00 00 85 d2 75 0f c3 cc cc cc cc <8a> 07 0f b6 c0 c3 cc cc cc cc 83 ea 01 48 83 ec 08 48 89 fe 48 c7 [ 195.010104] RSP: 0018:ff4e8beb8067bab8 EFLAGS: 00010292 [ 195.010584] RAX: ffffffffc05834a0 RBX: ffffffffc05843c0 RCX: ff4e8beb8067bae0 [ 195.011233] RDX: ff1bcbd580f88000 RSI: 0000000000000246 RDI: ff4e8beb80199014 [ 195.011881] RBP: ff1bcbd587e39000 R08: ffffffff916fa2d0 R09: ff4e8beb8067ba68 [ 195.012527] R10: 000000000000001c R11: 0000000000000000 R12: ff1bcbd5a3de9120 [ 195.013179] R13: ffffffffc062d000 R14: 0000000000000080 R15: ff1bcbe402bc7805 [ 195.013826] FS: 0000000000000000(0000) GS:ff1bcbe402740000(0000) knlGS:0000000000000000 [ 195.014564] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 195.015093] CR2: ff4e8beb80199014 CR3: 0000000107dea002 CR4: 0000000000771ee0 [ 195.015741] PKRU: 55555554 [ 195.016001] Call Trace: [ 195.016233] [ 195.016434] vp_modern_get_status+0x12/0x20 [ 195.016823] vp_vdpa_reset+0x1b/0x50 [vp_vdpa] [ 195.017238] virtio_vdpa_reset+0x3c/0x48 [virtio_vdpa] [ 195.017709] remove_vq_common+0x1f/0x3a0 [virtio_net] [ 195.018178] virtnet_remove+0x5d/0x70 [virtio_net] [ 195.018618] virtio_dev_remove+0x3d/0x90 [ 195.018986] device_release_driver_internal+0x1aa/0x230 [ 195.019466] bus_remove_device+0xd8/0x150 [ 195.019841] device_del+0x18b/0x3f0 [ 195.020167] ? kernfs_find_ns+0x35/0xd0 [ 195.020526] device_unregister+0x13/0x60 [ 195.020894] unregister_virtio_device+0x11/0x20 [ 195.021311] device_release_driver_internal+0x1aa/0x230 [ 195.021790] bus_remove_device+0xd8/0x150 [ 195.022162] device_del+0x18b/0x3f0 [ 195.022487] device_unregister+0x13/0x60 [ 195.022852] ? vdpa_dev_remove+0x30/0x30 [vdpa] [ 195.023270] vp_vdpa_dev_del+0x12/0x20 [vp_vdpa] [ 195.023694] vdpa_match_remove+0x2b/0x40 [vdpa] [ 195.024115] bus_for_each_dev+0x78/0xc0 [ 195.024471] vdpa_mgmtdev_unregister+0x65/0x80 [vdpa] [ 195.024937] vp_vdpa_remove+0x23/0x40 [vp_vdpa] [ 195.025353] pci_device_remove+0x36/0xa0 [ 195.025719] device_release_driver_internal+0x1aa/0x230 [ 195.026201] pci_stop_bus_device+0x6c/0x90 [ 195.026580] pci_stop_and_remove_bus_device+0xe/0x20 [ 195.027039] disable_slot+0x49/0x90 [ 195.027366] acpiphp_disable_and_eject_slot+0x15/0x90 [ 195.027832] hotplug_event+0xea/0x210 [ 195.028171] ? hotplug_event+0x210/0x210 [ 195.028535] acpiphp_hotplug_notify+0x22/0x80 [ 195.028942] ? hotplug_event+0x210/0x210 [ 195.029303] acpi_device_hotplug+0x8a/0x1d0 [ 195.029690] acpi_hotplug_work_fn+0x1a/0x30 [ 195.030077] process_one_work+0x1e8/0x3c0 [ 195.030451] worker_thread+0x50/0x3b0 [ 195.030791] ? rescuer_thread+0x3a0/0x3a0 [ 195.031165] kthread+0xd9/0x100 [ 195.031459] ? kthread_complete_and_exit+0x20/0x20 [ 195.031899] ret_from_fork+0x22/0x30 [ 195.032233] Fixes: ffbda8e9df10 ("vdpa/vp_vdpa : add vdpa tool support in vp_vdpa") Tested-by: Lei Yang Cc: stable@vger.kernel.org Signed-off-by: Cindy Lu Message-Id: <20230214080924.131462-1-lulu@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 83a458e330ff54951d3ddd378f970ab96b864020 Author: Bjorn Helgaas Date: Tue Mar 7 14:19:37 2023 -0600 fpga: dfl-pci: Drop redundant pci_enable_pcie_error_reporting() pci_enable_pcie_error_reporting() enables the device to send ERR_* Messages. Since f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is native"), the PCI core does this for all devices during enumeration, so the driver doesn't need to do it itself. Remove the redundant pci_enable_pcie_error_reporting() call from the driver. Also remove the corresponding pci_disable_pcie_error_reporting() from the driver .remove() path. Note that this only controls ERR_* Messages from the device. An ERR_* Message may cause the Root Port to generate an interrupt, depending on the AER Root Error Command register managed by the AER service driver. Signed-off-by: Bjorn Helgaas Acked-by: Xu Yilun Link: https://lore.kernel.org/r/20230307201937.880084-1-helgaas@kernel.org Signed-off-by: Xu Yilun commit bced3f7db95ff2e6ca29dc4d1c9751ab5e736a09 Author: Breno Leitao Date: Wed Mar 8 11:07:45 2023 -0800 tcp: tcp_make_synack() can be called from process context tcp_rtx_synack() now could be called in process context as explained in 0a375c822497 ("tcp: tcp_rtx_synack() can be called from process context"). tcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU variables with preemption enabled. This causes the following BUG: BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464 caller is tcp_make_synack+0x841/0xac0 Call Trace: dump_stack_lvl+0x10d/0x1a0 check_preemption_disabled+0x104/0x110 tcp_make_synack+0x841/0xac0 tcp_v6_send_synack+0x5c/0x450 tcp_rtx_synack+0xeb/0x1f0 inet_rtx_syn_ack+0x34/0x60 tcp_check_req+0x3af/0x9e0 tcp_rcv_state_process+0x59b/0x2030 tcp_v6_do_rcv+0x5f5/0x700 release_sock+0x3a/0xf0 tcp_sendmsg+0x33/0x40 ____sys_sendmsg+0x2f2/0x490 __sys_sendmsg+0x184/0x230 do_syscall_64+0x3d/0x90 Avoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use TCP_INC_STATS() which is safe to be called from context switch. Fixes: 8336886f786f ("tcp: TCP Fast Open Server - support TFO listeners") Signed-off-by: Breno Leitao Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230308190745.780221-1-leitao@debian.org Signed-off-by: Jakub Kicinski commit c24ff3ec55f08788fb2c404c312f213d9081e1ba Merge: ff447886e6759 e041a2a550582 Author: Takashi Iwai Date: Fri Mar 10 06:52:15 2023 +0100 Merge tag 'asoc-fix-v6.3-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.3 More fixes that came in since -rc1, a lot from Intel - looks like they've been busy test. Everything is driver specific. commit 519b23310aa100073f0b58c39df120a486ed7f8e Merge: 3a43e30b8e2cf 6ce2ea07c5ff0 Author: Dave Airlie Date: Fri Mar 10 14:17:34 2023 +1000 Merge tag 'amd-drm-fixes-6.3-2023-03-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.3-2023-03-09: amdgpu: - Misc display fixes - UMC 8.10 fixes - Driver unload fixes - NBIO 7.3.0 fix - Error checking fixes for soc15, nv, soc21 read register interface - Fix video cap query for VCN 4.0.4 amdkfd: - Fix return check in doorbell handling Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230310031314.1296929-1-alexander.deucher@amd.com commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 Author: Theodore Ts'o Date: Mon Mar 6 13:54:50 2023 -0500 fs: prevent out-of-bounds array speculation when closing a file descriptor Google-Bug-Id: 114199369 Signed-off-by: Theodore Ts'o Signed-off-by: Al Viro commit aa69f814920d85a2d4cfd5c294757c3d59d2fba6 Author: Arnd Bergmann Date: Tue Jan 31 10:36:30 2023 +0100 ftrace,kcfi: Define ftrace_stub_graph conditionally When CONFIG_FUNCTION_GRAPH_TRACER is disabled, __kcfi_typeid_ftrace_stub_graph is missing, causing a link failure: ld.lld: error: undefined symbol: __kcfi_typeid_ftrace_stub_graph referenced by arch/x86/kernel/ftrace_64.o:(__cfi_ftrace_stub_graph) in archive vmlinux.a Mark the reference to it as conditional on the same symbol, as is done on arm64. Link: https://lore.kernel.org/linux-trace-kernel/20230131093643.3850272-1-arnd@kernel.org Cc: Peter Zijlstra Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: "H. Peter Anvin" Cc: Josh Poimboeuf Fixes: 883bbbffa5a4 ("ftrace,kcfi: Separate ftrace_stub() and ftrace_stub_graph()") See-also: 2598ac6ec493 ("arm64: ftrace: Define ftrace_stub_graph only with FUNCTION_GRAPH_TRACER") Signed-off-by: Arnd Bergmann Signed-off-by: Steven Rostedt (Google) commit ee92fa443358f4fc0017c1d0d325c27b37802504 Author: Chen Zhongjin Date: Thu Mar 9 16:02:30 2023 +0800 ftrace: Fix invalid address access in lookup_rec() when index is 0 KASAN reported follow problem: BUG: KASAN: use-after-free in lookup_rec Read of size 8 at addr ffff000199270ff0 by task modprobe CPU: 2 Comm: modprobe Call trace: kasan_report __asan_load8 lookup_rec ftrace_location arch_check_ftrace_location check_kprobe_address_safe register_kprobe When checking pg->records[pg->index - 1].ip in lookup_rec(), it can get a pg which is newly added to ftrace_pages_start in ftrace_process_locs(). Before the first pg->index++, index is 0 and accessing pg->records[-1].ip will cause this problem. Don't check the ip when pg->index is 0. Link: https://lore.kernel.org/linux-trace-kernel/20230309080230.36064-1-chenzhongjin@huawei.com Cc: stable@vger.kernel.org Fixes: 9644302e3315 ("ftrace: Speed up search by skipping pages by address") Suggested-by: Steven Rostedt (Google) Signed-off-by: Chen Zhongjin Signed-off-by: Steven Rostedt (Google) commit 9f116f76fa8c04c81aef33ad870dbf9a158e5b70 Author: Steven Rostedt (Google) Date: Wed Mar 1 20:00:53 2023 -0500 tracing: Check field value in hist_field_name() The function hist_field_name() cannot handle being passed a NULL field parameter. It should never be NULL, but due to a previous bug, NULL was passed to the function and the kernel crashed due to a NULL dereference. Mark Rutland reported this to me on IRC. The bug was fixed, but to prevent future bugs from crashing the kernel, check the field and add a WARN_ON() if it is NULL. Link: https://lkml.kernel.org/r/20230302020810.762384440@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Andrew Morton Reported-by: Mark Rutland Fixes: c6afad49d127f ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers") Tested-by: Mark Rutland Signed-off-by: Steven Rostedt (Google) commit e0213434fe3e4a0d118923dc98d31e7ff1cd9e45 Author: Steven Rostedt (Google) Date: Wed Mar 1 20:00:52 2023 -0500 tracing: Do not let histogram values have some modifiers Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or grouped in buckets or log. Give an error if a value is set to do so. Note, the histogram code was not prepared to handle these modifiers for histograms and caused a bug. Mark Rutland reported: # echo 'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events # echo 'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' > /sys/kernel/tracing/events/kprobes/copy_to_user/trigger # cat /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR = 0x0000000096000004 [ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits [ 143.695889] SET = 0, FnV = 0 [ 143.696077] EA = 0, S1PTW = 0 [ 143.696302] FSC = 0x04: level 0 translation fault [ 143.702381] Data abort info: [ 143.702614] ISV = 0, ISS = 0x00000004 [ 143.702832] CM = 0, WnR = 0 [ 143.703087] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000 [ 143.703407] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted 6.2.0-00003-g6fc512c10a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 143.707120] pc : hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp : ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0 [ 143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800 [ 143.708776] x23: ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001 [ 143.709127] x20: ffff10d303ec2000 x19: 0000000000000000 x18: 0000000000000000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023 [ 143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c [ 143.710584] x8 : 000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c [ 143.710915] x5 : ffff10d303b0103e x4 : ffffd7a653b20261 x3 : 000000000000003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 : 0000000000000000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642] hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125] event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521] seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043] ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [ 143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970] el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [ 143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace 0000000000000000 ]--- Segmentation fault Link: https://lkml.kernel.org/r/20230302020810.559462599@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Andrew Morton Fixes: c6afad49d127f ("tracing: Add hist trigger 'sym' and 'sym-offset' modifiers") Reported-by: Mark Rutland Tested-by: Mark Rutland Signed-off-by: Steven Rostedt (Google) commit 6ce2ea07c5ff0a8188eab0e5cd1f0e4899b36835 Author: Veerabadhran Gopalakrishnan Date: Wed Mar 8 19:33:53 2023 +0530 drm/amdgpu/soc21: Add video cap query support for VCN_4_0_4 Added the video capability query support for VCN version 4_0_4 Signed-off-by: Veerabadhran Gopalakrishnan Reviewed-by: Leo Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit b42fee5e0b44344cfe4c38e61341ee250362c83f Author: Alex Deucher Date: Tue Mar 7 08:59:13 2023 -0500 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for nv Properly skip non-existent registers as well. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2442 Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 2915e43a033a778816fa4bc621f033576796521e Author: Alex Deucher Date: Mon Mar 6 10:35:34 2023 -0500 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc21 Properly skip non-existent registers as well. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2442 Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 0dcdf8498eae2727bb33cef3576991dc841d4343 Author: Alex Deucher Date: Mon Mar 6 10:34:20 2023 -0500 drm/amdgpu: fix error checking in amdgpu_read_mm_registers for soc15 Properly skip non-existent registers as well. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2442 Reviewed-by: Hawking Zhang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8879ec6dfdcdcca7718eeb4a584805eb205288bf Author: lyndonli Date: Fri Mar 3 14:55:05 2023 +0800 drm/amdgpu: Fix the warning info when removing amdgpu device Actually, the drm_dev_enter in psp_cmd_submit_buf does not protect anything. If DRM device is unplugged, it will always check the condition in WARN_ON. So drop drm_dev_enter and drm_dev_exit in psp_cmd_submit_buf. When removing amdgpu, the calling order is as follows: amdgpu_pci_remove drm_dev_unplug amdgpu_driver_unload_kms amdgpu_device_fini_hw amdgpu_device_ip_fini_early psp_hw_fini psp_ras_terminate psp_ta_unloadye psp_cmd_submit_buf [ 4507.740388] Call Trace: [ 4507.740389] [ 4507.740391] psp_ta_unload+0x44/0x70 [amdgpu] [ 4507.740485] psp_ras_terminate+0x4d/0x70 [amdgpu] [ 4507.740575] psp_hw_fini+0x28/0xa0 [amdgpu] [ 4507.740662] amdgpu_device_fini_hw+0x328/0x442 [amdgpu] [ 4507.740791] amdgpu_driver_unload_kms+0x51/0x60 [amdgpu] [ 4507.740875] amdgpu_pci_remove+0x5a/0x140 [amdgpu] [ 4507.740962] ? _raw_spin_unlock_irqrestore+0x27/0x43 [ 4507.740965] ? __pm_runtime_resume+0x60/0x90 [ 4507.740968] pci_device_remove+0x39/0xb0 [ 4507.740971] device_remove+0x46/0x70 [ 4507.740972] device_release_driver_internal+0xd1/0x160 [ 4507.740974] driver_detach+0x4a/0x90 [ 4507.740975] bus_remove_driver+0x6c/0xf0 [ 4507.740976] driver_unregister+0x31/0x50 [ 4507.740977] pci_unregister_driver+0x40/0x90 [ 4507.740978] amdgpu_exit+0x15/0x120 [amdgpu] v2: fix commit message style issue Signed-off-by: lyndonli Reviewed-by: Guchun Chen Acked-by: Christian König Signed-off-by: Alex Deucher commit 20534dbcc7b7bfb447279cdcfb0d88ee3b779a18 Author: Shashank Sharma Date: Mon Feb 27 15:42:28 2023 +0100 drm/amdgpu: fix return value check in kfd This patch fixes a return value check in kfd doorbell handling. This function should return 0(error) only when the ida_simple_get returns < 0(error), return > 0 is a success case. Cc: Felix Kuehling Cc: Alex Deucher Fixes: 16f0013157bf ("drm/amdkfd: Allocate doorbells only when needed") Acked-by: Christian Koenig Reviewed-by: Felix Kuehling Signed-off-by: Shashank Sharma Signed-off-by: Alex Deucher commit 1717cc5f2962a4652c76ed3858b499ccae6c277c Author: Mario Limonciello Date: Wed Mar 1 09:36:06 2023 -0600 drm/amd: Fix initialization mistake for NBIO 7.3.0 The same strapping initialization issue that happened on NBIO 7.5.1 appears to be happening on NBIO 7.3.0. Apply the same fix to 7.3.0 as well. Note: This workaround relies upon the integrated GPU being enabled in BIOS. If the integrated GPU is disabled in BIOS a different workaround will be required. Reported-by: Thomas Glanzmann Cc: Basavaraj Natikar Link: https://lore.kernel.org/linux-usb/Y%2Fz9GdHjPyF2rNG3@glanzmann.de/T/#u Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 93bb18d2a873d2fa9625c8ea927723660a868b95 Author: lyndonli Date: Thu Mar 2 14:18:12 2023 +0800 drm/amdgpu: Fix call trace warning and hang when removing amdgpu device On GPUs with RAS enabled, below call trace and hang are observed when shutting down device. v2: use DRM device unplugged flag instead of shutdown flag as the check to prevent memory wipe in shutdown stage. [ +0.000000] RIP: 0010:amdgpu_vram_mgr_fini+0x18d/0x1c0 [amdgpu] [ +0.000001] PKRU: 55555554 [ +0.000001] Call Trace: [ +0.000001] [ +0.000002] amdgpu_ttm_fini+0x140/0x1c0 [amdgpu] [ +0.000183] amdgpu_bo_fini+0x27/0xa0 [amdgpu] [ +0.000184] gmc_v11_0_sw_fini+0x2b/0x40 [amdgpu] [ +0.000163] amdgpu_device_fini_sw+0xb6/0x510 [amdgpu] [ +0.000152] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] [ +0.000090] drm_dev_release+0x28/0x50 [drm] [ +0.000016] devm_drm_dev_init_release+0x38/0x60 [drm] [ +0.000011] devm_action_release+0x15/0x20 [ +0.000003] release_nodes+0x40/0xc0 [ +0.000001] devres_release_all+0x9e/0xe0 [ +0.000001] device_unbind_cleanup+0x12/0x80 [ +0.000003] device_release_driver_internal+0xff/0x160 [ +0.000001] driver_detach+0x4a/0x90 [ +0.000001] bus_remove_driver+0x6c/0xf0 [ +0.000001] driver_unregister+0x31/0x50 [ +0.000001] pci_unregister_driver+0x40/0x90 [ +0.000003] amdgpu_exit+0x15/0x120 [amdgpu] Signed-off-by: lyndonli Reviewed-by: Guchun Chen Reviewed-by: Christian König Signed-off-by: Alex Deucher commit c6001025d53ab56d7159cf313313c6b5bd250380 Author: Asutosh Das Date: Wed Mar 8 15:13:23 2023 -0800 scsi: ufs: mcq: Use active_reqs to check busy in clock scaling Multi Circular Queue doesn't use outstanding_reqs. However, the UFS clock scaling functions use outstanding_reqs to determine if there are requests pending. When MCQ is enabled, this check always returns false. Hence use active_reqs to check if there are pending requests. Fixes: eacb139b77ff ("scsi: ufs: core: mcq: Enable multi-circular queue") Signed-off-by: Asutosh Das Reviewed-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/a24e0d646aac70eae0fc5e05fac0c58bb7e6e680.1678317160.git.quic_asutoshd@quicinc.com Signed-off-by: Martin K. Petersen commit be03df3d4bfe7e8866d4aa43d62e648ffe884f5f Author: Bart Van Assche Date: Tue Mar 7 13:44:28 2023 -0800 scsi: core: Fix a procfs host directory removal regression scsi_proc_hostdir_rm() decreases a reference counter and hence must only be called once per host that is removed. This change does not require a scsi_add_host_with_dma() change since scsi_add_host_with_dma() will return 0 (success) if scsi_proc_host_add() is called. Fixes: fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") Cc: John Garry Reported-by: John Garry Link: https://lore.kernel.org/all/ed6b8027-a9d9-1b45-be8e-df4e8c6c4605@oracle.com/ Reported-by: syzbot+645a4616b87a2f10e398@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-scsi/000000000000890fab05f65342b6@google.com/ Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20230307214428.3703498-1-bvanassche@acm.org Tested-by: John Garry Tested-by: Shin'ichiro Kawasaki Signed-off-by: Martin K. Petersen commit 4b1a2c2a8e0ddcb89c5f6c5003bd9b53142f69e3 Author: Lee Duncan Date: Wed Sep 28 11:13:50 2022 -0700 scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD Some storage, such as AIX VDASD (virtual storage) and IBM 2076 (front end), fail as a result of commit c92a6b5d6335 ("scsi: core: Query VPD size before getting full page"). That commit changed getting SCSI VPD pages so that we now read just enough of the page to get the actual page size, then read the whole page in a second read. The problem is that the above mentioned hardware returns zero for the page size, because of a firmware error. In such cases, until the firmware is fixed, this new blacklist flag says to revert to the original method of reading the VPD pages, i.e. try to read a whole buffer's worth on the first try. [mkp: reworked somewhat] Fixes: c92a6b5d6335 ("scsi: core: Query VPD size before getting full page") Reported-by: Martin Wilck Suggested-by: Hannes Reinecke Signed-off-by: Lee Duncan Link: https://lore.kernel.org/r/20220928181350.9948-1-leeman.duncan@gmail.com Tested-by: Srikar Dronamraju Signed-off-by: Martin K. Petersen commit 5cf9d015be160e2d90d29ae74ef1364390e8fce8 Author: Nathan Chancellor Date: Wed Mar 8 13:47:11 2023 -0700 clk: Avoid invalid function names in CLK_OF_DECLARE() After commit c28cd1f3433c ("clk: Mark a fwnode as initialized when using CLK_OF_DECLARE() macro"), drivers/clk/mvebu/kirkwood.c fails to build: drivers/clk/mvebu/kirkwood.c:358:1: error: expected identifier or '(' CLK_OF_DECLARE(98dx1135_clk, "marvell,mv98dx1135-core-clock", ^ include/linux/clk-provider.h:1367:21: note: expanded from macro 'CLK_OF_DECLARE' static void __init name##_of_clk_init_declare(struct device_node *np) \ ^ :124:1: note: expanded from here 98dx1135_clk_of_clk_init_declare ^ drivers/clk/mvebu/kirkwood.c:358:1: error: invalid digit 'd' in decimal constant include/linux/clk-provider.h:1372:34: note: expanded from macro 'CLK_OF_DECLARE' OF_DECLARE_1(clk, name, compat, name##_of_clk_init_declare) ^ :125:3: note: expanded from here 98dx1135_clk_of_clk_init_declare ^ drivers/clk/mvebu/kirkwood.c:358:1: error: invalid digit 'd' in decimal constant include/linux/clk-provider.h:1372:34: note: expanded from macro 'CLK_OF_DECLARE' OF_DECLARE_1(clk, name, compat, name##_of_clk_init_declare) ^ :125:3: note: expanded from here 98dx1135_clk_of_clk_init_declare ^ drivers/clk/mvebu/kirkwood.c:358:1: error: invalid digit 'd' in decimal constant include/linux/clk-provider.h:1372:34: note: expanded from macro 'CLK_OF_DECLARE' OF_DECLARE_1(clk, name, compat, name##_of_clk_init_declare) ^ :125:3: note: expanded from here 98dx1135_clk_of_clk_init_declare ^ C function names must start with either an alphabetic letter or an underscore. To avoid generating invalid function names from clock names, add two underscores to the beginning of the identifier. Fixes: c28cd1f3433c ("clk: Mark a fwnode as initialized when using CLK_OF_DECLARE() macro") Suggested-by: Saravana Kannan Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230308-clk_of_declare-fix-v1-1-317b741e2532@kernel.org Reviewed-by: Saravana Kannan Reported-by: Naresh Kamboju Signed-off-by: Stephen Boyd commit 47c29d69212911f50bdcdd0564b5999a559010d4 Author: Zheng Wang Date: Fri Mar 10 01:47:28 2023 +0800 power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition In bq24190_probe, &bdi->input_current_limit_work is bound with bq24190_input_current_limit_work. When external power changed, it will call bq24190_charger_external_power_changed to start the work. If we remove the module which will call bq24190_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows: CPU0 CPUc1 |bq24190_input_current_limit_work bq24190_remove | power_supply_unregister | device_unregister | power_supply_dev_release| kfree(psy) | | | power_supply_get_property_from_supplier | //use Fix it by finishing the work before cleanup in the bq24190_remove Fixes: 97774672573a ("power_supply: Initialize changed_work before calling device_add") Signed-off-by: Zheng Wang Signed-off-by: Sebastian Reichel commit 9b7fef255c80db8fc33fc06f2ad6d8e3ced1389b Merge: 2a8db5ec4a28a 82dd33fde0268 Author: Palmer Dabbelt Date: Thu Mar 9 15:22:05 2023 -0800 Merge patch series "riscv: asid: switch to alternative way to fix stale TLB entries" Sergey Matyukevich says: Some time ago two different patches have been posted to fix stale TLB entries that caused applications crashes. The patch [0] suggested 'aggregating' mm_cpumask, i.e. current cpu is not cleared for the switched-out task in switch_mm function. For additional explanations see the commit message by Guo Ren. The same approach is used by arc architecture, so another good comment is for switch_mm in arch/arc/include/asm/mmu_context.h. The patch [1] attempted to reduce the number of TLB flushes by deferring (and possibly avoiding) them for CPUs not running the task. Patch [1] has been merged. However we already have two bug reports from different vendors. So apparently something is missing in the approach suggested in [1]. In both cases the patch [0] fixed the issue. This patch series reverts [1] and replaces it by [0]. [0] https://lore.kernel.org/linux-riscv/20221111075902.798571-1-guoren@kernel.org/ [1] https://lore.kernel.org/linux-riscv/20220829205219.283543-1-geomatsi@gmail.com/ * b4-shazam-merge: riscv: asid: Fixup stale TLB entry cause application crash Revert "riscv: mm: notify remote harts about mmu cache updates" Link: https://lore.kernel.org/r/20230226150137.1919750-1-geomatsi@gmail.com Signed-off-by: Palmer Dabbelt commit 82dd33fde0268cc622d3d1ac64971f3f61634142 Author: Guo Ren Date: Sun Feb 26 18:01:37 2023 +0300 riscv: asid: Fixup stale TLB entry cause application crash After use_asid_allocator is enabled, the userspace application will crash by stale TLB entries. Because only using cpumask_clear_cpu without local_flush_tlb_all couldn't guarantee CPU's TLB entries were fresh. Then set_mm_asid would cause the user space application to get a stale value by stale TLB entry, but set_mm_noasid is okay. Here is the symptom of the bug: unhandled signal 11 code 0x1 (coredump) 0x0000003fd6d22524 <+4>: auipc s0,0x70 0x0000003fd6d22528 <+8>: ld s0,-148(s0) # 0x3fd6d92490 => 0x0000003fd6d2252c <+12>: ld a5,0(s0) (gdb) i r s0 s0 0x8082ed1cc3198b21 0x8082ed1cc3198b21 (gdb) x /2x 0x3fd6d92490 0x3fd6d92490: 0xd80ac8a8 0x0000003f The core dump file shows that register s0 is wrong, but the value in memory is correct. Because 'ld s0, -148(s0)' used a stale mapping entry in TLB and got a wrong result from an incorrect physical address. When the task ran on CPU0, which loaded/speculative-loaded the value of address(0x3fd6d92490), then the first version of the mapping entry was PTWed into CPU0's TLB. When the task switched from CPU0 to CPU1 (No local_tlb_flush_all here by asid), it happened to write a value on the address (0x3fd6d92490). It caused do_page_fault -> wp_page_copy -> ptep_clear_flush -> ptep_get_and_clear & flush_tlb_page. The flush_tlb_page used mm_cpumask(mm) to determine which CPUs need TLB flush, but CPU0 had cleared the CPU0's mm_cpumask in the previous switch_mm. So we only flushed the CPU1 TLB and set the second version mapping of the PTE. When the task switched from CPU1 to CPU0 again, CPU0 still used a stale TLB mapping entry which contained a wrong target physical address. It raised a bug when the task happened to read that value. CPU0 CPU1 - switch 'task' in - read addr (Fill stale mapping entry into TLB) - switch 'task' out (no tlb_flush) - switch 'task' in (no tlb_flush) - write addr cause pagefault do_page_fault() (change to new addr mapping) wp_page_copy() ptep_clear_flush() ptep_get_and_clear() & flush_tlb_page() write new value into addr - switch 'task' out (no tlb_flush) - switch 'task' in (no tlb_flush) - read addr again (Use stale mapping entry in TLB) get wrong value from old phyical addr, BUG! The solution is to keep all CPUs' footmarks of cpumask(mm) in switch_mm, which could guarantee to invalidate all stale TLB entries during TLB flush. Fixes: 65d4b9c53017 ("RISC-V: Implement ASID allocator") Signed-off-by: Guo Ren Signed-off-by: Guo Ren Tested-by: Lad Prabhakar Tested-by: Zong Li Tested-by: Sergey Matyukevich Cc: Anup Patel Cc: Palmer Dabbelt Cc: stable@vger.kernel.org Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230226150137.1919750-3-geomatsi@gmail.com Signed-off-by: Palmer Dabbelt commit e921050022f1f12d5029d1487a7dfc46cde15523 Author: Sergey Matyukevich Date: Sun Feb 26 18:01:36 2023 +0300 Revert "riscv: mm: notify remote harts about mmu cache updates" This reverts the remaining bits of commit 4bd1d80efb5a ("riscv: mm: notify remote harts harts about mmu cache updates"). According to bug reports, suggested approach to fix stale TLB entries is not sufficient. It needs to be replaced by a more robust solution. Fixes: 4bd1d80efb5a ("riscv: mm: notify remote harts about mmu cache updates") Reported-by: Zong Li Reported-by: Lad Prabhakar Signed-off-by: Sergey Matyukevich Cc: stable@vger.kernel.org Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20230226150137.1919750-2-geomatsi@gmail.com Signed-off-by: Palmer Dabbelt commit bf6c880d5d1448489ebf92e2d13d5713ff644930 Author: Denis Arefev Date: Tue Dec 6 12:17:23 2022 +0300 power: supply: axp288_fuel_gauge: Added check for negative values Variable 'pirq', which may receive negative value in platform_get_irq(). Used as an index in a function regmap_irq_get_virq(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Denis Arefev Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 14c76b2e75bca4d96e2b85a0c12aa43e84fe3f74 Author: Grant Grundler Date: Mon Dec 12 13:38:57 2022 -0800 power: supply: cros_usbpd: reclassify "default case!" as debug This doesn't need to be printed every second as an error: ... <3>[17438.628385] cros-usbpd-charger cros-usbpd-charger.3.auto: Port 1: default case! <3>[17439.634176] cros-usbpd-charger cros-usbpd-charger.3.auto: Port 1: default case! <3>[17440.640298] cros-usbpd-charger cros-usbpd-charger.3.auto: Port 1: default case! ... Reduce priority from ERROR to DEBUG. Signed-off-by: Grant Grundler Reviewed-by: Guenter Roeck Signed-off-by: Sebastian Reichel commit 3268a4d9b0b85a4382e93bdf7be5400a73db74c5 Author: Jiapeng Chong Date: Wed Dec 14 11:23:16 2022 +0800 power: supply: rk817: Fix unsigned comparison with less than zero The tmp is defined as u32 type, which results in invalid processing of tmp<0 in function rk817_read_or_set_full_charge_on_boot(). Therefore, drop the comparison. drivers/power/supply/rk817_charger.c:828 rk817_read_or_set_full_charge_on_boot() warn: unsigned 'tmp' is never less than zero. drivers/power/supply/rk817_charger.c:788 rk817_read_or_set_full_charge_on_boot() warn: unsigned 'tmp' is never less than zero. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3444 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Tested-by: Chris Morgan Signed-off-by: Sebastian Reichel commit 2a8db5ec4a28a0fce822d10224db9471a44b6925 Author: Conor Dooley Date: Fri Mar 3 14:37:55 2023 +0000 RISC-V: Don't check text_mutex during stop_machine We're currently using stop_machine() to update ftrace & kprobes, which means that the thread that takes text_mutex during may not be the same as the thread that eventually patches the code. This isn't actually a race because the lock is still held (preventing any other concurrent accesses) and there is only one thread running during stop_machine(), but it does trigger a lockdep failure. This patch just elides the lockdep check during stop_machine. Fixes: c15ac4fd60d5 ("riscv/ftrace: Add dynamic function tracer support") Suggested-by: Steven Rostedt Reported-by: Changbin Du Signed-off-by: Palmer Dabbelt Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230303143754.4005217-1-conor.dooley@microchip.com Signed-off-by: Palmer Dabbelt commit 76950340cf03b149412fe0d5f0810e52ac1df8cb Author: Alexandre Ghiti Date: Wed Mar 8 10:16:39 2023 +0100 riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is unset, the stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can lead to the following backtrace: [ 0.000000] ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [] walk_stackframe+0x0/0x11a [ 0.000000] [] init_param_lock+0x26/0x2a [ 0.000000] [] walk_stackframe+0xa2/0x11a [ 0.000000] [] dump_stack_lvl+0x22/0x36 [ 0.000000] [] print_report+0x198/0x4a8 [ 0.000000] [] init_param_lock+0x26/0x2a [ 0.000000] [] walk_stackframe+0xa2/0x11a [ 0.000000] [] kasan_report+0x9a/0xc8 [ 0.000000] [] walk_stackframe+0xa2/0x11a [ 0.000000] [] walk_stackframe+0xa2/0x11a [ 0.000000] [] desc_make_final+0x80/0x84 [ 0.000000] [] stack_trace_save+0x88/0xa6 [ 0.000000] [] filter_irq_stacks+0x72/0x76 [ 0.000000] [] devkmsg_read+0x32a/0x32e [ 0.000000] [] kasan_save_stack+0x28/0x52 [ 0.000000] [] desc_make_final+0x7c/0x84 [ 0.000000] [] stack_trace_save+0x84/0xa6 [ 0.000000] [] kasan_set_track+0x12/0x20 [ 0.000000] [] __kasan_slab_alloc+0x58/0x5e [ 0.000000] [] __kmem_cache_create+0x21e/0x39a [ 0.000000] [] create_boot_cache+0x70/0x9c [ 0.000000] [] kmem_cache_init+0x6c/0x11e [ 0.000000] [] mm_init+0xd8/0xfe [ 0.000000] [] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] The buggy address belongs to stack of task swapper/0 [ 0.000000] and is located at offset 0 in frame: [ 0.000000] stack_trace_save+0x0/0xa6 [ 0.000000] [ 0.000000] This frame has 1 object: [ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] The buggy address belongs to the physical page: [ 0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000] [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ================================================================== Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise mode. Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly") Reported-by: Chathura Rajapaksha Link: https://lore.kernel.org/all/CAD7mqryDQCYyJ1gAmtMm8SASMWAQ4i103ptTb0f6Oda=tPY2=A@mail.gmail.com/ Suggested-by: Dmitry Vyukov Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230308091639.602024-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit f3d0fbad6765da25de7ecf6481af9b6ddb0b3793 Author: Johan Hovold Date: Thu Mar 9 12:12:09 2023 +0100 firmware: qcom: scm: fix bogus irq error at probe A recent commit added support for an optional interrupt which is only available on some platforms. Stop spamming the logs with bogus error messages on platforms that do not use this new optional resource: qcom_scm firmware:scm: error -ENXIO: IRQ index 0 not found Fixes: 6bf325992236 ("firmware: qcom: scm: Add wait-queue handling logic") Cc: Guru Das Srinagesh Cc: Sibi Sankar Signed-off-by: Johan Hovold Tested-by: Steev Klimaszewski # Thinkpad X13s Acked-by: Guru Das Srinagesh Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230309111209.31606-1-johan+linaro@kernel.org commit ee1d5100c37e7a95af506c7addf018f652545ce6 Author: Manivannan Sadhasivam Date: Wed Mar 8 11:16:30 2023 +0530 arm64: dts: qcom: sm8550: Mark UFS controller as cache coherent The UFS controller on SM8550 supports cache coherency, hence add the "dma-coherent" property to mark it as such. Fixes: 35cf1aaab169 ("arm64: dts: qcom: sm8550: Add UFS host controller and phy nodes") Signed-off-by: Manivannan Sadhasivam Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230308054630.7202-1-manivannan.sadhasivam@linaro.org commit b891251b40d4dc4cfd28341f62f6784c02ad3a78 Author: Brian Masney Date: Tue Mar 7 18:23:40 2023 -0500 arm64: dts: qcom: sa8540p-ride: correct name of remoteproc_nsp0 firmware The cdsp.mbn firmware that's referenced in sa8540p-ride.dts is actually named cdsp0.mbn in the deliverables from Qualcomm. Let's go ahead and correct the name to match what's in Qualcomm's deliverable. Signed-off-by: Brian Masney Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230307232340.2370476-1-bmasney@redhat.com commit 42d0c4bdf753063b6eec55415003184d3ca24f6e Author: Seth Forshee Date: Thu Mar 9 14:39:09 2023 -0600 filelocks: use mount idmapping for setlease permission check A user should be allowed to take out a lease via an idmapped mount if the fsuid matches the mapped uid of the inode. generic_setlease() is checking the unmapped inode uid, causing these operations to be denied. Fix this by comparing against the mapped inode uid instead of the unmapped uid. Fixes: 9caccd41541a ("fs: introduce MOUNT_ATTR_IDMAP") Cc: stable@vger.kernel.org Signed-off-by: Seth Forshee (DigitalOcean) Signed-off-by: Christian Brauner (Microsoft) commit 8ba961d4339c5db0e69ff6627606fe1f34c838e5 Author: Manivannan Sadhasivam Date: Tue Mar 7 21:02:01 2023 +0530 arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent The UFS controller on SM8450 supports cache coherency, hence add the "dma-coherent" property to mark it as such. Fixes: 07fa917a335e ("arm64: dts: qcom: sm8450: add ufs nodes") Signed-off-by: Manivannan Sadhasivam Reviewed-by: Neil Armstrong Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230307153201.180626-2-manivannan.sadhasivam@linaro.org commit e607b3c1fa0e1579951acd00f9559a77f97d0927 Author: Manivannan Sadhasivam Date: Tue Mar 7 21:02:00 2023 +0530 arm64: dts: qcom: sm8350: Mark UFS controller as cache coherent The UFS controller on SM8350 supports cache coherency, hence add the "dma-coherent" property to mark it as such. Fixes: 59c7cf814783 ("arm64: dts: qcom: sm8350: Add UFS nodes") Signed-off-by: Manivannan Sadhasivam Reviewed-by: Neil Armstrong Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230307153201.180626-1-manivannan.sadhasivam@linaro.org commit 9e5f81f9a6e78ba411117146ecf324d0145ae89a Author: Geert Uytterhoeven Date: Thu Mar 9 08:45:46 2023 +0100 i2c: dev: Fix bus callback return values The i2cdev_{at,de}tach_adapter() callbacks are used for two purposes: 1. As notifier callbacks, when (un)registering I2C adapters created or destroyed after i2c_dev_init(), 2. As bus iterator callbacks, for registering already existing adapters from i2c_dev_init(), and for cleanup. Unfortunately both use cases expect different return values: the former expects NOTIFY_* return codes, while the latter expects zero or error codes, and aborts in case of error. Hence in case 2, as soon as i2cdev_{at,de}tach_adapter() returns (non-zero) NOTIFY_OK, the bus iterator aborts. This causes (a) only the first already existing adapter to be registered, leading to missing /dev/i2c-* entries, and (b) a failure to unregister all but the first I2C adapter during cleanup. Fix this by introducing separate callbacks for the bus iterator, wrapping the notifier functions, and always returning succes. Any errors inside these callback functions are unlikely to happen, and are fatal anyway. Fixes: cddf70d0bce71c2a ("i2c: dev: fix notifier return values") Signed-off-by: Geert Uytterhoeven Reviewed-by: Bartosz Golaszewski Signed-off-by: Wolfram Sang commit 834a9dc46db796f662615a18b8a38dde73f3b804 Author: Uwe Kleine-König Date: Sun Feb 26 23:26:54 2023 +0100 i2c: Convert drivers to new .probe() callback Now that .probe() was changed not to get the id parameter, drivers can be converted back to that with the eventual goal to drop .probe_new(). Implement that for the i2c drivers that are part of the i2c core. Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit 2f2afad9d35ff762028de7497dac60aa32be9f0f Author: Uwe Kleine-König Date: Sun Feb 26 23:26:53 2023 +0100 i2c: mux: Convert all drivers to new .probe() callback Now that .probe() was changed not to get the id parameter, drivers can be converted back to that with the eventual goal to drop .probe_new(). Implement that for the i2c mux drivers. Acked-by: Guenter Roeck Acked-by: Peter Rosin Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit a5982b3971007161b423b39aa843bdb6713a9d44 Author: Krzysztof Kozlowski Date: Thu Mar 2 16:47:24 2023 +0100 arm64: dts: qcom: sm8550: fix LPASS pinctrl slew base address The second LPASS pin controller IO address is supposed to be the MCC range which contains the slew rate registers. The Linux driver then accesses slew rate register with hard-coded offset (0xa000). However the DTS contained the address of slew rate register as the second IO address, thus any reads were effectively pass the memory space and lead to "Internal error: synchronous external aborts" when applying pin configuration. Fixes: 6de7f9c34358 ("arm64: dts: qcom: sm8550: add GPR and LPASS pin controller") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230302154724.856062-1-krzysztof.kozlowski@linaro.org commit 03c835f498b540087244a6757e87dfe7ef10999b Author: Uwe Kleine-König Date: Sun Feb 26 23:26:52 2023 +0100 i2c: Switch .probe() to not take an id parameter Commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type") introduced a new probe callback to convert i2c init routines to not take an i2c_device_id parameter. Now that all in-tree drivers are converted to the temporary .probe_new() callback, .probe() can be modified to match the desired prototype. Now that .probe() and .probe_new() have the same semantic, they can be defined as members of an anonymous union to save some memory and simplify the core code a bit. Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit 7eafbd40901c2b6f884c022c10bec5c8ec5c6a24 Author: Uwe Kleine-König Date: Sun Feb 26 23:26:51 2023 +0100 media: i2c: ov2685: convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Reviewed-by: Kieran Bingham Acked-by: Hans Verkuil Link: https://lore.kernel.org/lkml/20221121102838.16448-1-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit 79e070c5ee7a3faeb9ab8e1fa270b846a4fa2e56 Author: Uwe Kleine-König Date: Sun Feb 26 23:26:50 2023 +0100 media: i2c: ov5695: convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Reviewed-by: Kieran Bingham Acked-by: Hans Verkuil Link: https://lore.kernel.org/lkml/20221121102705.16092-1-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit e60289897e90801e951a3e172789967c9e2afb7e Author: Uwe Kleine-König Date: Sun Feb 26 23:26:49 2023 +0100 w1: ds2482: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Link: https://lore.kernel.org/lkml/20221118224540.619276-596-uwe@kleine-koenig.org Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit 2e498f35c385654396e94cf12e097522d3973d41 Author: Srinivas Kandagatla Date: Thu Mar 2 11:57:41 2023 +0000 arm64: dts: qcom: sc8280xp-x13s: fix va dmic dai links and routing VA dmics 0, 1, 2 micbias on X13s are connected to WCD MICBIAS1, WCD MICBIAS1 and WCD MICBIAS3 respectively. Reflect this in dt to get dmics working. Also fix dmics to go via VA Macro instead of TX macro to fix device switching. Fixes: 8c1ea87e80b4 ("arm64: dts: qcom: sc8280xp-x13s: Add soundcard support") Signed-off-by: Srinivas Kandagatla Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230302115741.7726-5-srinivas.kandagatla@linaro.org commit 4def7aa377ba1dbe66335ca3ebe3aa5a5bc3fe67 Author: Srinivas Kandagatla Date: Thu Mar 2 11:57:40 2023 +0000 arm64: dts: qcom: sc8280xp-x13s: fix dmic sample rate The version of dmic that is on X13s panel supports clock frequency of range 1 Mhz to 4.8 MHz for normal operation. So correct the existing node to reflect this. Fixes: 8c1ea87e80b4 ("arm64: dts: qcom: sc8280xp-x13s: Add soundcard support") Signed-off-by: Srinivas Kandagatla Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230302115741.7726-4-srinivas.kandagatla@linaro.org commit e43bd22cb377bf4c4e5b12daacaf02f5c24fbb16 Author: Srinivas Kandagatla Date: Thu Mar 2 11:57:39 2023 +0000 arm64: dts: qcom: sc8280xp: fix lpass tx macro clocks Tx macro soundwire clock is for some reason is incorrectly assigned to va macro, fix this and use tx macro clock instead. Fixes: 1749a8ae49a3 ("arm64: dts: qcom: sc8280xp: add SoundWire and LPASS") Signed-off-by: Srinivas Kandagatla Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230302115741.7726-3-srinivas.kandagatla@linaro.org commit 670b7d6569bf439c90d7aac48ec36ee3e3013754 Author: Srinivas Kandagatla Date: Thu Mar 2 11:57:38 2023 +0000 arm64: dts: qcom: sc8280xp: fix rx frame shapping info Some of the SoundWire frameshapping data seems incorrect, fix these values. Fixes: 1749a8ae49a3 ("arm64: dts: qcom: sc8280xp: add SoundWire and LPASS") Signed-off-by: Srinivas Kandagatla Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230302115741.7726-2-srinivas.kandagatla@linaro.org commit 01d93875dafdaaf90bfc782074cae5b4605f3907 Author: Uwe Kleine-König Date: Sun Feb 26 23:26:48 2023 +0100 serial: sc16is7xx: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/lkml/20221118224540.619276-572-uwe@kleine-koenig.org Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit 0b79d5d1e5982bc3b0da9cd3b40ce972a72f2541 Author: Uwe Kleine-König Date: Sun Feb 26 23:26:47 2023 +0100 mtd: maps: pismo: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Acked-by: Richard Weinberger Link: https://lore.kernel.org/lkml/20221118224540.619276-497-uwe@kleine-koenig.org Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit 55e7dddcaf4a55d2f097463cdf5709c3278c6fa9 Author: Uwe Kleine-König Date: Sun Feb 26 23:26:46 2023 +0100 misc: ad525x_dpot-i2c: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/lkml/20221118224540.619276-483-uwe@kleine-koenig.org Signed-off-by: Uwe Kleine-König Signed-off-by: Wolfram Sang commit 6df6fab9320bc9ebdf50136a01e7bf0ee5984c62 Author: Krzysztof Kozlowski Date: Wed Mar 8 13:31:29 2023 +0100 arm64: dts: qcom: sm8450: correct WSA2 assigned clocks The WSA2 assigned-clocks were copied from WSA, but the WSA2 uses its own. Fixes: 14341e76dbc7 ("arm64: dts: qcom: sm8450: add Soundwire and LPASS") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230308123129.232642-1-krzysztof.kozlowski@linaro.org commit ecd240875e877d78fd03efbc62292f550872df3f Author: Luca Weiss Date: Wed Mar 8 22:06:03 2023 +0100 ARM: dts: qcom: apq8026-lg-lenok: add missing reserved memory Turns out these two memory regions also need to be avoided, otherwise weird things will happen when Linux tries to use this memory. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230308-lenok-reserved-memory-v1-1-b8bf6ff01207@z3ntu.xyz commit 3a43e30b8e2cff245b7d3cb807fb0b4409452bda Merge: b2bda460b1b74 a722511b18268 Author: Dave Airlie Date: Fri Mar 10 05:52:09 2023 +1000 Merge tag 'drm-msm-fixes-2023-03-09' of https://gitlab.freedesktop.org/drm/msm into drm-fixes msm-fixes for v6.3-rc2 - Fix for possible invalid ptr free in submit ioctl syncobj cleanup path. - Synchronize GMU removal in driver teardown path - a5xx preemption fixes - Fix runpm imbalance at unbind - DPU hw catalog fixes: - set DPU_MDP_PERIPH_0_REMOVED for sc8280xp as this is another chipset where the PERIPH_0 block of registers is not there - fix the DPU features supported in QCM2290 by comparing it with the downstream device tree - fix the length of registers in the sc7180_ctl from 0xe4 to 0x1dc - fix the max mixer line width for sm6115 and qcm2290 chipsets in the DPU catalog - fix the scaler version on sm8550, sc8280xp, sm8450, sm8250, sm8350 and sm6115. This was incorrectly populated on the SW version of the scaler library and not the scaler HW version - Drop dim layer support for msm8998 as its not indicated to be supported in the downstream DTSI - fix the DPU_CLK_CTRL bits for msm 8998 sspp blocks - Use DPU_CLK_CTRL_DMA* prefix instead of DPU_CLK_CTRL_CURSOR* for all chipsets for the DMA sspp blocks - fix the ping-pong block base address for sc7280 in the DPU HW catalog - Fix stack corruption issue in the dpu_hw_ctl_setup_blendstage() function as it was causing a negative left shift by protecting against an invalid index - Clear the DSPP reservations in dpu_rm_release(). This was missed out and as as result the DSPP was not released from the resource manager global state. Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGvH+VH_Wx3mFMG51CMnoiU06CM-+-WMhM73M42Qx7Bp4A@mail.gmail.com commit b2bda460b1b744a3835ce9d291360b6185e7e305 Author: Dave Airlie Date: Fri Mar 10 05:24:43 2023 +1000 mailmap: add mailmap entries for Faith. Reviewed-by: Faith Ekstrand Signed-off-by: Dave Airlie commit 44889ba56cbb3d51154660ccd15818bc77276696 Merge: 2653e3fe33f41 67eeadf2f9532 Author: Linus Torvalds Date: Thu Mar 9 10:56:58 2023 -0800 Merge tag 'net-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter and bpf. Current release - regressions: - core: avoid skb end_offset change in __skb_unclone_keeptruesize() - sched: - act_connmark: handle errno on tcf_idr_check_alloc - flower: fix fl_change() error recovery path - ieee802154: prevent user from crashing the host Current release - new code bugs: - eth: bnxt_en: fix the double free during device removal - tools: ynl: - fix enum-as-flags in the generic CLI - fully inherit attrs in subsets - re-license uniformly under GPL-2.0 or BSD-3-clause Previous releases - regressions: - core: use indirect calls helpers for sk_exit_memory_pressure() - tls: - fix return value for async crypto - avoid hanging tasks on the tx_lock - eth: ice: copy last block omitted in ice_get_module_eeprom() Previous releases - always broken: - core: avoid double iput when sock_alloc_file fails - af_unix: fix struct pid leaks in OOB support - tls: - fix possible race condition - fix device-offloaded sendpage straddling records - bpf: - sockmap: fix an infinite loop error - test_run: fix &xdp_frame misplacement for LIVE_FRAMES - fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR - netfilter: tproxy: fix deadlock due to missing BH disable - phylib: get rid of unnecessary locking - eth: bgmac: fix *initial* chip reset to support BCM5358 - eth: nfp: fix csum for ipsec offload - eth: mtk_eth_soc: fix RX data corruption issue Misc: - usb: qmi_wwan: add telit 0x1080 composition" * tag 'net-6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits) tools: ynl: fix enum-as-flags in the generic CLI tools: ynl: move the enum classes to shared code net: avoid double iput when sock_alloc_file fails af_unix: fix struct pid leaks in OOB support eth: fealnx: bring back this old driver net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC net: microchip: sparx5: fix deletion of existing DSCP mappings octeontx2-af: Unlock contexts in the queue context cache in case of fault detection net/smc: fix fallback failed while sendmsg with fastopen ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause mailmap: update entries for Stephen Hemminger mailmap: add entry for Maxim Mikityanskiy nfc: change order inside nfc_se_io error path ethernet: ice: avoid gcc-9 integer overflow warning ice: don't ignore return codes in VSI related code ice: Fix DSCP PFC TLV creation net: usb: qmi_wwan: add Telit 0x1080 composition net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 netfilter: conntrack: adopt safer max chain length net: tls: fix device-offloaded sendpage straddling records ... commit 2653e3fe33f411227296552b2e5f9c2640924900 Merge: c70e9b8ea3936 8ae2f2b0a2841 Author: Linus Torvalds Date: Thu Mar 9 10:17:23 2023 -0800 Merge tag 'for-linus-2023030901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - fix potential out of bound write of zeroes in HID core with a specially crafted uhid device (Lee Jones) - fix potential use-after-free in work function in intel-ish-hid (Reka Norman) - selftests config fixes (Benjamin Tissoires) - few device small fixes and support * tag 'for-linus-2023030901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded selftest: hid: fix hid_bpf not set in config HID: uhid: Over-ride the default maximum data buffer value with our own HID: core: Provide new max_buffer_size attribute to over-ride the default commit c70e9b8ea3936a60e2a696dd0ed9bb57885f6bec Merge: 573b22ccb7ce9 e36a82bebbf7d Author: Linus Torvalds Date: Thu Mar 9 10:08:46 2023 -0800 Merge tag 'm68k-for-v6.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fixes from Geert Uytterhoeven: - Fix systems with memory at end of 32-bit address space - Fix initrd on systems where memory does not start at address zero - Fix 68030 handling of bus errors for addresses in exception tables * tag 'm68k-for-v6.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Only force 030 bus error if PC not in exception table m68k: mm: Move initrd phys_to_virt handling after paging_init() m68k: mm: Fix systems with memory at end of 32-bit address space commit 573b22ccb7ce9ab7f0539a2e11a9d3609a8783f5 Author: Al Viro Date: Mon Mar 6 01:20:30 2023 +0000 sh: sanitize the flags on sigreturn We fetch %SR value from sigframe; it might have been modified by signal handler, so we can't trust it with any bits that are not modifiable in user mode. Signed-off-by: Al Viro Cc: Rich Felker Signed-off-by: Linus Torvalds commit fa780334a8c392d959ae05eb19f2410b3a1e6cb0 Author: Jens Axboe Date: Thu Mar 9 09:51:13 2023 -0700 io_uring: silence variable ‘prev’ set but not used warning If io_uring.o is built with W=1, it triggers a warning: io_uring/io_uring.c: In function ‘__io_submit_flush_completions’: io_uring/io_uring.c:1502:40: warning: variable ‘prev’ set but not used [-Wunused-but-set-variable] 1502 | struct io_wq_work_node *node, *prev; | ^~~~ which is due to the wq_list_for_each() iterator always keeping a 'prev' variable. Most users need this to remove an entry from a list, for example, but __io_submit_flush_completions() never does that. Add a basic helper that doesn't track prev instead, and use that in that function. Reported-by: Vincenzo Palazzo Reviewed-by: Vincenzo Palazzo Signed-off-by: Jens Axboe commit 38ed310c22e7a0fc978b1f8292136a4a4a8b3051 Author: Roman Gushchin Date: Wed Mar 8 14:26:02 2023 -0800 firmware: xilinx: don't make a sleepable memory allocation from an atomic context The following issue was discovered using lockdep: [ 6.691371] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:209 [ 6.694602] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 1, name: swapper/0 [ 6.702431] 2 locks held by swapper/0/1: [ 6.706300] #0: ffffff8800f6f188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock+0x4c/0x90 [ 6.714900] #1: ffffffc009a2abb8 (enable_lock){....}-{2:2}, at: clk_enable_lock+0x4c/0x140 [ 6.723156] irq event stamp: 304030 [ 6.726596] hardirqs last enabled at (304029): [] _raw_spin_unlock_irqrestore+0xc0/0xd0 [ 6.736142] hardirqs last disabled at (304030): [] clk_enable_lock+0xfc/0x140 [ 6.744742] softirqs last enabled at (303958): [] _stext+0x4f0/0x894 [ 6.752655] softirqs last disabled at (303951): [] irq_exit+0x238/0x280 [ 6.760744] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G U 5.15.36 #2 [ 6.768048] Hardware name: xlnx,zynqmp (DT) [ 6.772179] Call trace: [ 6.774584] dump_backtrace+0x0/0x300 [ 6.778197] show_stack+0x18/0x30 [ 6.781465] dump_stack_lvl+0xb8/0xec [ 6.785077] dump_stack+0x1c/0x38 [ 6.788345] ___might_sleep+0x1a8/0x2a0 [ 6.792129] __might_sleep+0x6c/0xd0 [ 6.795655] kmem_cache_alloc_trace+0x270/0x3d0 [ 6.800127] do_feature_check_call+0x100/0x220 [ 6.804513] zynqmp_pm_invoke_fn+0x8c/0xb0 [ 6.808555] zynqmp_pm_clock_getstate+0x90/0xe0 [ 6.813027] zynqmp_pll_is_enabled+0x8c/0x120 [ 6.817327] zynqmp_pll_enable+0x38/0xc0 [ 6.821197] clk_core_enable+0x144/0x400 [ 6.825067] clk_core_enable+0xd4/0x400 [ 6.828851] clk_core_enable+0xd4/0x400 [ 6.832635] clk_core_enable+0xd4/0x400 [ 6.836419] clk_core_enable+0xd4/0x400 [ 6.840203] clk_core_enable+0xd4/0x400 [ 6.843987] clk_core_enable+0xd4/0x400 [ 6.847771] clk_core_enable+0xd4/0x400 [ 6.851555] clk_core_enable_lock+0x24/0x50 [ 6.855683] clk_enable+0x24/0x40 [ 6.858952] fclk_probe+0x84/0xf0 [ 6.862220] platform_probe+0x8c/0x110 [ 6.865918] really_probe+0x110/0x5f0 [ 6.869530] __driver_probe_device+0xcc/0x210 [ 6.873830] driver_probe_device+0x64/0x140 [ 6.877958] __driver_attach+0x114/0x1f0 [ 6.881828] bus_for_each_dev+0xe8/0x160 [ 6.885698] driver_attach+0x34/0x50 [ 6.889224] bus_add_driver+0x228/0x300 [ 6.893008] driver_register+0xc0/0x1e0 [ 6.896792] __platform_driver_register+0x44/0x60 [ 6.901436] fclk_driver_init+0x1c/0x28 [ 6.905220] do_one_initcall+0x104/0x590 [ 6.909091] kernel_init_freeable+0x254/0x2bc [ 6.913390] kernel_init+0x24/0x130 [ 6.916831] ret_from_fork+0x10/0x20 Fix it by passing the GFP_ATOMIC gfp flag for the corresponding memory allocation. Fixes: acfdd18591ea ("firmware: xilinx: Use hash-table for api feature check") Cc: stable Signed-off-by: Roman Gushchin Cc: Amit Sunil Dhamne Cc: Michal Simek Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/20230308222602.123866-1-roman.gushchin@linux.dev Signed-off-by: Greg Kroah-Hartman commit 18365ebf23f3e713e5dd8e295c9a639295250f3c Author: Samuel Thibault Date: Mon Mar 6 10:49:21 2023 +0100 tty: vt: protect KD_FONT_OP_GET_TALL from unbound access In ioctl(KD_FONT_OP_GET_TALL), userland tells through op->height which vpitch should be used to copy over the font. In con_font_get, we were not checking that it is within the maximum height value, and thus userland could make the vc->vc_sw->con_font_get(vc, &font, vpitch); call possibly overflow the allocated max_font_size bytes, and the copy_to_user(op->data, font.data, c) call possibly read out of that allocated buffer. By checking vpitch against max_font_height, the max_font_size buffer will always be large enough for the vc->vc_sw->con_font_get(vc, &font, vpitch) call (since we already prevent loading a font larger than that), and c = (font.width+7)/8 * vpitch * font.charcount will always remain below max_font_size. Fixes: 24d69384bcd3 ("VT: Add KD_FONT_OP_SET/GET_TALL operations") Reported-by: syzbot+3af17071816b61e807ed@syzkaller.appspotmail.com Signed-off-by: Samuel Thibault Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20230306094921.tik5ewne4ft6mfpo@begin Signed-off-by: Greg Kroah-Hartman commit b6a7bac184472b5b79286a71a61c2f16ea4e86ad Author: Johan Hovold Date: Tue Mar 7 17:44:05 2023 +0100 serial: qcom-geni: drop bogus uart_write_wakeup() Drop the bogus uart_write_wakeup() from when setting up a new DMA transfer, which does not free up any more space in the ring buffer. Any pending writers will be woken up when the transfer completes. Cc: stable Signed-off-by: Johan Hovold Reviewed-by: Douglas Anderson Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Reviewed-by: Andrew Halaney Tested-by: Andrew Halaney # sa8540p-ride Link: https://lore.kernel.org/r/20230307164405.14218-5-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 97820780b723197d1b472f2bd39fd8593b5d4edc Author: Johan Hovold Date: Tue Mar 7 17:44:04 2023 +0100 serial: qcom-geni: fix mapping of empty DMA buffer Make sure that there is data in the ring buffer before trying to set up a zero-length DMA transfer. This specifically fixes the following warning when unmapping the empty buffer on the sc8280xp-crd: WARNING: CPU: 0 PID: 138 at drivers/iommu/dma-iommu.c:1046 iommu_dma_unmap_page+0xbc/0xd8 ... Call trace: iommu_dma_unmap_page+0xbc/0xd8 dma_unmap_page_attrs+0x30/0x1c8 geni_se_tx_dma_unprep+0x28/0x38 qcom_geni_serial_isr+0x358/0x75c Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA") Cc: stable Cc: Bartosz Golaszewski Signed-off-by: Johan Hovold Reviewed-by: Douglas Anderson Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Reviewed-by: Andrew Halaney Tested-by: Andrew Halaney # sa8540p-ride Link: https://lore.kernel.org/r/20230307164405.14218-4-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 95fcfc08537763bff21ec8c450d3d3cb1a60ad09 Author: Johan Hovold Date: Tue Mar 7 17:44:03 2023 +0100 serial: qcom-geni: fix DMA mapping leak on shutdown Fix what appears to be a copy-paste error that can lead to a leaked DMA mapping on close() and failure to restart TX after the port is reopened. Note that rx_dma_addr is generally NULL when qcom_geni_serial_stop_tx_dma() is called as part of shutdown() (but tx_dma_addr need not be). Fixes: 2aaa43c70778 ("tty: serial: qcom-geni-serial: add support for serial engine DMA") Cc: stable Cc: Bartosz Golaszewski Signed-off-by: Johan Hovold Reviewed-by: Douglas Anderson Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Reviewed-by: Andrew Halaney Tested-by: Andrew Halaney # sa8540p-ride Link: https://lore.kernel.org/r/20230307164405.14218-3-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9aff74cc4e9eb841dde5fd009ed7ddca5db40e68 Author: Johan Hovold Date: Tue Mar 7 17:44:02 2023 +0100 serial: qcom-geni: fix console shutdown hang A recent commit added back the calls top stop tx and rx to shutdown() which had previously been removed by commit e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown") in order to be able to use kgdb after stopping the getty. Not only did this again break kgdb, but it also broke serial consoles more generally by hanging TX when stopping the getty during reboot. The underlying problem has been there since the driver was first merged and fixing it is going to be a bit involved so simply stop calling the broken stop functions during shutdown for consoles for now. Fixes: d8aca2f96813 ("tty: serial: qcom-geni-serial: stop operations in progress at shutdown") Cc: stable Cc: Bartosz Golaszewski Signed-off-by: Johan Hovold Reviewed-by: Douglas Anderson Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Reviewed-by: Andrew Halaney Tested-by: Andrew Halaney # sa8540p-ride Link: https://lore.kernel.org/r/20230307164405.14218-2-johan+linaro@kernel.org Signed-off-by: Greg Kroah-Hartman commit 03b3d6be73e81ddb7c2930d942cdd17f4cfd5ba5 Author: Jens Axboe Date: Wed Mar 8 09:26:13 2023 -0700 io_uring/uring_cmd: ensure that device supports IOPOLL It's possible for a file type to support uring commands, but not pollable ones. Hence before issuing one of those, we should check that it is supported and error out upfront if it isn't. Cc: stable@vger.kernel.org Fixes: 5756a3a7e713 ("io_uring: add iopoll infrastructure for io_uring_cmd") Link: https://github.com/axboe/liburing/issues/816 Reviewed-by: Kanchan Joshi Signed-off-by: Jens Axboe commit 1a5ecc73b2bfeffe036212d4a6bfacee053ab0a1 Author: Saravana Kannan Date: Wed Mar 1 18:35:09 2023 -0800 serdev: Set fwnode for serdev devices This allow fw_devlink to do dependency tracking for serdev devices. Reported-by: Florian Fainelli Link: https://lore.kernel.org/lkml/03b70a8a-0591-f28b-a567-9d2f736f17e5@gmail.com/ Cc: Stefan Wahren Signed-off-by: Saravana Kannan Tested-by: Stefan Wahren Tested-by: Florian Fainelli Link: https://lore.kernel.org/r/20230302023509.319903-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 1be6f2b15f902c02e055ae0b419ca789200473c9 Author: Alexander Sverdlin Date: Thu Mar 9 14:43:02 2023 +0100 tty: serial: fsl_lpuart: fix race on RX DMA shutdown From time to time DMA completion can come in the middle of DMA shutdown: : : lpuart32_shutdown() lpuart_dma_shutdown() del_timer_sync() lpuart_dma_rx_complete() lpuart_copy_rx_to_tty() mod_timer() lpuart_dma_rx_free() When the timer fires a bit later, sport->dma_rx_desc is NULL: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 pc : lpuart_copy_rx_to_tty+0xcc/0x5bc lr : lpuart_timer_func+0x1c/0x2c Call trace: lpuart_copy_rx_to_tty lpuart_timer_func call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq __irq_exit_rcu irq_exit handle_domain_irq gic_handle_irq call_on_irq_stack do_interrupt_handler ... To fix this fold del_timer_sync() into lpuart_dma_rx_free() after dmaengine_terminate_sync() to make sure timer will not be re-started in lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete(). Fixes: 4a8588a1cf86 ("serial: fsl_lpuart: delete timer on shutdown") Cc: stable Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20230309134302.74940-2-alexander.sverdlin@siemens.com Signed-off-by: Greg Kroah-Hartman commit 5d943b5d69c032de7ce9cd625ac083a5c277b9c5 Author: Kumaravel Thiagarajan Date: Sun Mar 5 20:21:24 2023 +0530 serial: 8250_pci1xxxx: Disable SERIAL_8250_PCI1XXXX config by default Commit 32bb477fa7bf ("serial: 8250_pci1xxxx: Add driver for quad-uart support") made the SERIAL_8250_PCI1XXXX driver enabled when SERIAL_8250 is enabled, disable it as this driver does not need to be enabled by default Fixes: 32bb477fa7bf ("serial: 8250_pci1xxxx: Add driver for quad-uart support") Reported-by: Linus Torvalds Link: https://lore.kernel.org/lkml/CAHk-=whhFCeeuo6vTEmNSx6S-KKkugxgzN_W5Z6v-9yH9gc3Zw@mail.gmail.com/ Signed-off-by: Kumaravel Thiagarajan Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230305145124.13444-1-kumaravel.thiagarajan@microchip.com Signed-off-by: Greg Kroah-Hartman commit 6e01f9a594ee0f69fb52cc8d11971612b4817f0b Author: Johan Hovold Date: Mon Feb 27 09:50:46 2023 +0100 serial: 8250_fsl: fix handle_irq locking The 8250 handle_irq callback is not just called from the interrupt handler but also from a timer callback when polling (e.g. for ports without an interrupt line). Consequently the callback must explicitly disable interrupts to avoid a potential deadlock with another interrupt in polled mode. Fix up the two paths in the freescale callback that failed to re-enable interrupts when polling. Fixes: 853a9ae29e97 ("serial: 8250: fix handle_irq locking") Cc: stable@vger.kernel.org # 5.13 Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/Y/xYzqp4ogmOF5t0@kili Signed-off-by: Johan Hovold Acked-by: Jiri Slaby Link: https://lore.kernel.org/r/20230227085046.24282-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 32e293be736b853f168cd065d9cbc1b0c69f545d Author: Biju Das Date: Mon Feb 27 11:41:46 2023 +0000 serial: 8250_em: Fix UART port type As per HW manual for EMEV2 "R19UH0040EJ0400 Rev.4.00", the UART IP found on EMMA mobile SoC is Register-compatible with the general-purpose 16750 UART chip. Fix UART port type as 16750 and enable 64-bytes fifo support. Fixes: 22886ee96895 ("serial8250-em: Emma Mobile UART driver V2") Cc: stable@vger.kernel.org Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230227114152.22265-2-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit f8086d1a65ac693e3fd863128352b4b11ee7324d Author: Randy Dunlap Date: Sat Feb 25 21:39:53 2023 -0800 serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it. Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues. Therefore, change the use of "depends on REGMAP" to "select REGMAP". Fixes: 8d310c9107a2 ("drivers/tty/serial/8250: Make Aspeed VUART SIRQ polarity configurable") Cc: stable Signed-off-by: Randy Dunlap Cc: Greg Kroah-Hartman Cc: Oskar Senft Cc: linux-serial@vger.kernel.org Link: https://lore.kernel.org/r/20230226053953.4681-9-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 2411fd94ceaa6e11326e95d6ebf876cbfed28d23 Author: Sherry Sun Date: Thu Feb 23 17:39:41 2023 +0800 tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted According to LPUART RM, Transmission Complete Flag becomes 0 if queuing a break character by writing 1 to CTRL[SBK], so here need to skip waiting for transmission complete when UARTCTRL_SBK is asserted, otherwise the kernel may stuck here. And actually set_termios() adds transmission completion waiting to avoid data loss or data breakage when changing the baud rate, but we don't need to worry about this when queuing break characters. Signed-off-by: Sherry Sun Cc: stable Link: https://lore.kernel.org/r/20230223093941.31790-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 2d638be71155b2e036aca1966b6129e2d661e91f Author: Tom Rix Date: Sun Feb 26 12:38:46 2023 -0500 Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency" This reverts commit 5779a072c248db7a40cfd0f5ea958097fd1d9a30. This results in a link error of ld: drivers/tty/serial/earlycon.o: in function `parse_options': drivers/tty/serial/earlycon.c:99: undefined reference to `uart_parse_earlycon' When the config is in this state CONFIG_SERIAL_CORE=m CONFIG_SERIAL_CORE_CONSOLE=y CONFIG_SERIAL_EARLYCON=y CONFIG_SERIAL_FSL_LPUART=m CONFIG_SERIAL_FSL_LPUART_CONSOLE=y Fixes: 5779a072c248 ("tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency") Cc: stable Signed-off-by: Tom Rix Reviewed-by: Randy Dunlap Acked-by: Jiri Slaby Link: https://lore.kernel.org/r/20230226173846.236691-1-trix@redhat.com Signed-off-by: Greg Kroah-Hartman commit 3993f4f456309580445bb515fbc609d995b6a3ae Author: Yue Hu Date: Mon Mar 6 15:55:27 2023 +0800 erofs: use wrapper i_blocksize() in erofs_file_read_iter() linux/fs.h has a wrapper for this operation. Signed-off-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230306075527.1338-1-zbestahu@gmail.com Signed-off-by: Gao Xiang commit 9ff471800b74f5f952c7e75a0355f1d30ee2b046 Author: Gao Xiang Date: Thu Mar 9 13:31:48 2023 +0800 erofs: get rid of a useless DBG_BUGON `err` could be -EINTR and it should not be the case. Actually such DBG_BUGON is useless. Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230309053148.9223-2-hsiangkao@linux.alibaba.com Signed-off-by: Gao Xiang commit 647dd2c3f0e16b71a1a77897d038164d48eea154 Author: Gao Xiang Date: Thu Mar 9 13:31:47 2023 +0800 erofs: Revert "erofs: fix kvcalloc() misuse with __GFP_NOFAIL" Let's revert commit 12724ba38992 ("erofs: fix kvcalloc() misuse with __GFP_NOFAIL") since kvmalloc() already supports __GFP_NOFAIL in commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc"). So the original fix was wrong. Actually there was some issue as [1] discussed, so before that mm fix is landed, the warn could still happen but applying this commit first will cause less. [1] https://lore.kernel.org/r/20230305053035.1911-1-hsiangkao@linux.alibaba.com Fixes: 12724ba38992 ("erofs: fix kvcalloc() misuse with __GFP_NOFAIL") Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230309053148.9223-1-hsiangkao@linux.alibaba.com Signed-off-by: Gao Xiang commit d9a02e016aaf5a57fb44e9a5e6da8ccd3b9e2e70 Author: Mike Snitzer Date: Wed Mar 8 14:39:54 2023 -0500 dm crypt: avoid accessing uninitialized tasklet When neither "no_read_workqueue" nor "no_write_workqueue" are enabled, tasklet_trylock() in crypt_dec_pending() may still return false due to an uninitialized state, and dm-crypt will unnecessarily do io completion in io_queue workqueue instead of current context. Fix this by adding an 'in_tasklet' flag to dm_crypt_io struct and initialize it to false in crypt_io_init(). Set this flag to true in kcryptd_queue_crypt() before calling tasklet_schedule(). If set crypt_dec_pending() will punt io completion to a workqueue. This also nicely avoids the tasklet_trylock/unlock hack when tasklets aren't in use. Fixes: 8e14f610159d ("dm crypt: do not call bio_endio() from the dm-crypt tasklet") Cc: stable@vger.kernel.org Reported-by: Hou Tao Suggested-by: Ignat Korchagin Reviewed-by: Ignat Korchagin Signed-off-by: Mike Snitzer commit 8f121dfb15f7b4ab345992ce96003eb63fd608f4 Author: Gao Xiang Date: Sun Mar 5 21:44:55 2023 +0800 erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms As the call trace shown, the root cause is kunmap incorrect pages: BUG: kernel NULL pointer dereference, address: 00000000 CPU: 1 PID: 40 Comm: kworker/u5:0 Not tainted 6.2.0-rc5 #4 Workqueue: erofs_worker z_erofs_decompressqueue_work EIP: z_erofs_lzma_decompress+0x34b/0x8ac z_erofs_decompress+0x12/0x14 z_erofs_decompress_queue+0x7e7/0xb1c z_erofs_decompressqueue_work+0x32/0x60 process_one_work+0x24b/0x4d8 ? process_one_work+0x1a4/0x4d8 worker_thread+0x14c/0x3fc kthread+0xe6/0x10c ? rescuer_thread+0x358/0x358 ? kthread_complete_and_exit+0x18/0x18 ret_from_fork+0x1c/0x28 ---[ end trace 0000000000000000 ]--- The bug is trivial and should be fixed now. It has no impact on !HIGHMEM platforms. Fixes: 622ceaddb764 ("erofs: lzma compression support") Cc: # 5.16+ Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230305134455.88236-1-hsiangkao@linux.alibaba.com commit a279adedbb5206ccadb6b2817838cbb1c834133d Author: Yangtao Li Date: Fri Mar 3 14:37:31 2023 +0800 erofs: mark z_erofs_lzma_init/erofs_pcpubuf_init w/ __init They are used during the erofs module init phase. Let's mark it as __init like any other function. Signed-off-by: Yangtao Li Reviewed-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230303063731.66760-1-frank.li@vivo.com Signed-off-by: Gao Xiang commit 82f5332d3b9872ab5b287e85c57b76d8bb640cd1 Author: Ziyang Huang Date: Tue Feb 21 18:30:04 2023 +0800 usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host" Some boards might use USB-A female connector for USB ports, however, the port could be connected to a dual-mode USB controller, making it also behaves as a peripheral device if male-to-male cable is connected. In this case, the dts looks like this: &usb0 { status = "okay"; dr_mode = "otg"; usb-role-switch; role-switch-default-mode = "host"; }; After boot, dwc2_ovr_init() sets GOTGCTL to GOTGCTL_AVALOVAL and call dwc2_force_mode() with parameter host=false, which causes inconsistent mode - The hardware is in peripheral mode while the kernel status is in host mode. What we can do now is to call dwc2_drd_role_sw_set() to switch to device mode, and everything should work just fine now, even switching back to none(default) mode afterwards. Fixes: e14acb876985 ("usb: dwc2: drd: add role-switch-default-node support") Cc: stable Signed-off-by: Ziyang Huang Tested-by: Fabrice Gasnier Acked-by: Minas Harutyunyan Reviewed-by: Amelie Delaunay Link: https://lore.kernel.org/r/SG2PR01MB204837BF68EDB0E343D2A375C9A59@SG2PR01MB2048.apcprd01.prod.exchangelabs.com Signed-off-by: Greg Kroah-Hartman commit 92771cdd90de64b15e65f3c88d6c6199bd5f33f5 Author: William Qiu Date: Tue Mar 7 10:46:46 2023 +0800 mmc: dw_mmc-starfive: Fix initialization of prev_err Fix a bug by making sure prev_err doesn't get used when being uninitialized. Signed-off-by: William Qiu Reported-by: Dan Carpenter Reviewed-by: Emil Renner Berthing Fixes: 9e622229bbf4 ("mmc: starfive: Add sdio/emmc driver support") Link: https://lore.kernel.org/r/20230307024646.10216-3-william.qiu@starfivetech.com Signed-off-by: Ulf Hansson commit 11440da77d6020831ee6f9ce4551b545dea789ee Author: Francesco Dolcini Date: Mon Mar 6 17:27:51 2023 +0100 mmc: sdhci_am654: lower power-on failed message severity Lower the power-on failed message severity from warn to info when the controller does not power-up. It's normal to have this situation when the SD card slot is empty, therefore we should not warn the user about it. Fixes: 7ca0f166f5b2 ("mmc: sdhci_am654: Add workaround for card detect debounce timer") Signed-off-by: Francesco Dolcini Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230306162751.163369-1-francesco@dolcini.it Signed-off-by: Ulf Hansson commit 094f391013ba9cc77b4b1ae1617f0a832e598d67 Author: Daniel Scally Date: Wed Mar 8 16:52:13 2023 +0000 docs: usb: Add documentation for the UVC Gadget The UVC Gadget function has become quite complex, but documentation for it is fairly sparse. Add some more detailed documentation to improve the situation. Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20230308165213.139315-1-dan.scally@ideasonboard.com Signed-off-by: Greg Kroah-Hartman commit abfc4fa28f0160df61c7149567da4f6494dfb488 Author: Xu Yang Date: Thu Feb 16 11:15:15 2023 +0800 usb: typec: tcpm: fix warning when handle discover_identity message Since both source and sink device can send discover_identity message in PD3, kernel may dump below warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 169 at drivers/usb/typec/tcpm/tcpm.c:1446 tcpm_queue_vdm+0xe0/0xf0 Modules linked in: CPU: 0 PID: 169 Comm: 1-0050 Not tainted 6.1.1-00038-g6a3c36cf1da2-dirty #567 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tcpm_queue_vdm+0xe0/0xf0 lr : tcpm_queue_vdm+0x2c/0xf0 sp : ffff80000c19bcd0 x29: ffff80000c19bcd0 x28: 0000000000000001 x27: ffff0000d11c8ab8 x26: ffff0000d11cc000 x25: 0000000000000000 x24: 00000000ff008081 x23: 0000000000000001 x22: 00000000ff00a081 x21: ffff80000c19bdbc x20: 0000000000000000 x19: ffff0000d11c8080 x18: ffffffffffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff0000d716f580 x14: 0000000000000001 x13: ffff0000d716f507 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000020 x9 : 00000000000ee098 x8 : 00000000ffffffff x7 : 000000000000001c x6 : ffff0000d716f580 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff80000c19bdbc x1 : 00000000ff00a081 x0 : 0000000000000004 Call trace: tcpm_queue_vdm+0xe0/0xf0 tcpm_pd_rx_handler+0x340/0x1ab0 kthread_worker_fn+0xcc/0x18c kthread+0x10c/0x110 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- Below sequences may trigger this warning: tcpm_send_discover_work(work) tcpm_send_vdm(port, USB_SID_PD, CMD_DISCOVER_IDENT, NULL, 0); tcpm_queue_vdm(port, header, data, count); port->vdm_state = VDM_STATE_READY; vdm_state_machine_work(work); <-- received discover_identity from partner vdm_run_state_machine(port); port->vdm_state = VDM_STATE_SEND_MESSAGE; mod_vdm_delayed_work(port, x); tcpm_pd_rx_handler(work); tcpm_pd_data_request(port, msg); tcpm_handle_vdm_request(port, msg->payload, cnt); tcpm_queue_vdm(port, response[0], &response[1], rlen - 1); --> WARN_ON(port->vdm_state > VDM_STATE_DONE); For this case, the state machine could still send out discover identity message later if we skip current discover_identity message. So we should handle the received message firstly and override the pending discover_identity message without warning in this case. Then, a delayed send_discover work will send discover_identity message again. Fixes: e00943e91678 ("usb: typec: tcpm: PD3.0 sinks can send Discover Identity even in device mode") cc: Signed-off-by: Xu Yang Reviewed-by: Guenter Roeck Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230216031515.4151117-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit a826492fc9dfe32afd70fff93955ae8174bbf14b Author: Xu Yang Date: Wed Feb 15 13:49:51 2023 +0800 usb: typec: tcpm: fix create duplicate source-capabilities file The kernel will dump in the below cases: sysfs: cannot create duplicate filename '/devices/virtual/usb_power_delivery/pd1/source-capabilities' 1. After soft reset has completed, an Explicit Contract negotiation occurs. The sink device will receive source capabilitys again. This will cause a duplicate source-capabilities file be created. 2. Power swap twice on a device that is initailly sink role. This will unregister existing capabilities when above cases occurs. Fixes: 8203d26905ee ("usb: typec: tcpm: Register USB Power Delivery Capabilities") cc: Signed-off-by: Xu Yang Reviewed-by: Heikki Krogerus Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230215054951.238394-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 6c67ed9ad9b83e453e808f9b31a931a20a25629b Author: Alvin Šipraga Date: Thu Mar 2 17:36:47 2023 +0100 usb: gadget: u_audio: don't let userspace block driver unbind In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free() via g_audio_cleanup() will disconnect the card and then wait for all resources to be released, which happens when the refcount falls to zero. Since userspace can keep the refcount incremented by not closing the relevant file descriptor, the call to unbind may block indefinitely. This can cause a deadlock during reboot, as evidenced by the following blocked task observed on my machine: task:reboot state:D stack:0 pid:2827 ppid:569 flags:0x0000000c Call trace: __switch_to+0xc8/0x140 __schedule+0x2f0/0x7c0 schedule+0x60/0xd0 schedule_timeout+0x180/0x1d4 wait_for_completion+0x78/0x180 snd_card_free+0x90/0xa0 g_audio_cleanup+0x2c/0x64 afunc_unbind+0x28/0x60 ... kernel_restart+0x4c/0xac __do_sys_reboot+0xcc/0x1ec __arm64_sys_reboot+0x28/0x30 invoke_syscall+0x4c/0x110 ... The issue can also be observed by opening the card with arecord and then stopping the process through the shell before unbinding: # arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo ^Z[1]+ Stopped arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null # echo gadget.0 > /sys/bus/gadget/drivers/configfs-gadget/unbind (observe that the unbind command never finishes) Fix the problem by using snd_card_free_when_closed() instead, which will still disconnect the card as desired, but defer the task of freeing the resources to the core once userspace closes its file descriptor. Fixes: 132fcb460839 ("usb: gadget: Add Audio Class 2.0 Driver") Cc: stable@vger.kernel.org Signed-off-by: Alvin Šipraga Reviewed-by: Ruslan Bilovol Reviewed-by: John Keeping Link: https://lore.kernel.org/r/20230302163648.3349669-1-alvin@pqrs.dk Signed-off-by: Greg Kroah-Hartman commit f7c13cb48e85538709850589b496c4ddb3d3898e Author: Alexander Stein Date: Thu Feb 23 08:39:20 2023 +0100 usb: misc: onboard-hub: add support for Microchip USB2517 USB 2.0 hub Add support for Microchip USB2517 USB 2.0 hub to the onboard usb hub driver. Adopt the generic usb-device compatible ("usbVID,PID"). This hub has the same reset timings as USB2514, so reuse that one. There is also an USB2517I which just has industrial temperature range. Signed-off-by: Alexander Stein Cc: stable Acked-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20230223073920.2912298-1-alexander.stein@ew.tq-group.com Signed-off-by: Greg Kroah-Hartman commit d8a2bb4eb75866275b5cf7de2e593ac3449643e2 Author: Wesley Cheng Date: Mon Mar 6 12:05:57 2023 -0800 usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC Previously, there was a 100uS delay inserted after issuing an end transfer command for specific controller revisions. This was due to the fact that there was a GUCTL2 bit field which enabled synchronous completion of the end transfer command once the CMDACT bit was cleared in the DEPCMD register. Since this bit does not exist for all controller revisions and the current implementation heavily relies on utizling the EndTransfer command completion interrupt, add the delay back in for uses where the interrupt on completion bit is not set, and increase the duration to 1ms for the controller to complete the command. An issue was seen where the USB request buffer was unmapped while the DWC3 controller was still accessing the TRB. However, it was confirmed that the end transfer command was successfully submitted. (no end transfer timeout) In situations, such as dwc3_gadget_soft_disconnect() and __dwc3_gadget_ep_disable(), the dwc3_remove_request() is utilized, which will issue the end transfer command, and follow up with dwc3_gadget_giveback(). At least for the USB ep disable path, it is required for any pending and started requests to be completed and returned to the function driver in the same context of the disable call. Without the GUCTL2 bit, it is not ensured that the end transfer is completed before the buffers are unmapped. Fixes: cf2f8b63f7f1 ("usb: dwc3: gadget: Remove END_TRANSFER delay") Cc: stable Signed-off-by: Wesley Cheng Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230306200557.29387-1-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman commit e041a2a550582106cba6a7c862c90dfc2ad14492 Author: Emil Abildgaard Svendsen Date: Thu Mar 9 06:54:41 2023 +0000 ASoC: hdmi-codec: only startup/shutdown on supported streams Currently only one stream is supported. This isn't usally a problem until you have a multi codec audio card. Because the audio card will run startup and shutdown on both capture and playback streams. So if your hdmi-codec only support either playback or capture. Then ALSA can't open for playback and capture. This patch will ignore if startup and shutdown are called with a non supported stream. Thus, allowing an audio card like this: +-+ cpu1 <--@-| |-> codec1 (HDMI-CODEC) | |<- codec2 (NOT HDMI-CODEC) +-+ Signed-off-by: Emil Svendsen Link: https://lore.kernel.org/r/20230309065432.4150700-2-emas@bang-olufsen.dk Signed-off-by: Mark Brown commit 02c1820345e795148e6b497ef85090915401698e Author: Vincenzo Palazzo Date: Thu Mar 2 16:07:06 2023 +0100 usb: dwc3: Fix a typo in field name Fix a typo inside the dwc3 struct docs. Fixes: 63d7f9810a38 ("usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug") Signed-off-by: Vincenzo Palazzo Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230302150706.229008-1-vincenzopalazzodev@gmail.com Signed-off-by: Greg Kroah-Hartman commit 02d210f434249a7edbc160969b75df030dc6934d Author: Hans de Goede Date: Wed Mar 8 16:42:44 2023 +0100 usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command completion timeout value") increased the timeout from 5 seconds to 60 seconds due to issues related to alternate mode discovery. After the alternate mode discovery switch to polled mode the timeout was reduced, but instead of being set back to 5 seconds it was reduced to 1 second. This is causing problems when using a Lenovo ThinkPad X1 yoga gen7 connected over Type-C to a LG 27UL850-W (charging DP over Type-C). When the monitor is already connected at boot the following error is logged: "PPM init failed (-110)", /sys/class/typec is empty and on unplugging the NULL pointer deref fixed earlier in this series happens. When the monitor is connected after boot the following error is logged instead: "GET_CONNECTOR_STATUS failed (-110)". Setting the timeout back to 5 seconds fixes both cases. Fixes: e08065069fc7 ("usb: typec: ucsi: acpi: Reduce the command completion timeout") Cc: stable@vger.kernel.org Reviewed-by: Heikki Krogerus Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230308154244.722337-4-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit 0482c34ec6f8557e06cd0f8e2d0e20e8ede6a22c Author: Hans de Goede Date: Wed Mar 8 16:42:43 2023 +0100 usb: ucsi: Fix ucsi->connector race ucsi_init() which runs from a workqueue sets ucsi->connector and on an error will clear it again. ucsi->connector gets dereferenced by ucsi_resume(), this checks for ucsi->connector being NULL in case ucsi_init() has not finished yet; or in case ucsi_init() has failed. ucsi_init() setting ucsi->connector and then clearing it again on an error creates a race where the check in ucsi_resume() may pass, only to have ucsi->connector free-ed underneath it when ucsi_init() hits an error. Fix this race by making ucsi_init() store the connector array in a local variable and only assign it to ucsi->connector on success. Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API") Cc: stable@vger.kernel.org Reviewed-by: Heikki Krogerus Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230308154244.722337-3-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit f87fb985452ab2083967103ac00bfd68fb182764 Author: Hans de Goede Date: Wed Mar 8 16:42:42 2023 +0100 usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() When ucsi_init() fails, ucsi->connector is NULL, yet in case of ucsi_acpi we may still get events which cause the ucs_acpi code to call ucsi_connector_change(), which then derefs the NULL ucsi->connector pointer. Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init() has succeeded, so that ucsi_connector_change() ignores the events because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask. Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217106 Cc: stable@vger.kernel.org Reviewed-by: Heikki Krogerus Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230308154244.722337-2-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit 67eeadf2f95326f6344adacb70c880bf2ccff57b Merge: 2d8cb0bfca6a0 8f5c5a790e302 Author: Paolo Abeni Date: Thu Mar 9 11:45:08 2023 +0100 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-03-07 (ice) This series contains updates to ice driver only. Dave removes masking from pfcena field as it was incorrectly preventing valid traffic classes from being enabled. Michal resolves various smatch issues such as not propagating error codes and returning 0 explicitly. Arnd Bergmann resolves gcc-9 warning for integer overflow. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ethernet: ice: avoid gcc-9 integer overflow warning ice: don't ignore return codes in VSI related code ice: Fix DSCP PFC TLV creation ==================== Link: https://lore.kernel.org/r/20230307220714.3997294-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit dc592190a5543c559010e09e8130a1af3f9068d3 Author: Jiapeng Chong Date: Wed Mar 8 15:13:16 2023 +0800 fs/locks: Remove redundant assignment to cmd Variable 'cmd' set but not used. fs/locks.c:2428:3: warning: Value stored to 'cmd' is never read. Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4439 Signed-off-by: Jiapeng Chong Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christian Brauner (Microsoft) commit c3a4aec055ec275c9f860e88d37e97248927d898 Author: Jiapeng Chong Date: Tue Mar 7 16:49:18 2023 +0800 splice: Remove redundant assignment to ret The variable ret belongs to redundant assignment and can be deleted. fs/splice.c:940:2: warning: Value stored to 'ret' is never read. Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4406 Signed-off-by: Jiapeng Chong Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christian Brauner (Microsoft) commit fdf6c2309f425509cddd002f278c650ad0b7e34b Author: Greg Kroah-Hartman Date: Wed Mar 8 14:19:34 2023 +0100 staging: r8188eu: delete driver Now that the same hardware that the r8188eu driver supported is supported by the real wireless driver rtl8xxxu, the r8188eu driver can be deleted. Also the rtl8xxxu driver supports way more devices, and is a fraction of the overall size, making this a much better overall solution. Thanks to the r8188eu developers and maintainers and reviewers over the years, your work allowed Linux users to use their hardware before the real driver was implemented properly. Reported-by: Hans de Goede Cc: Phillip Potter Cc: Pavel Skripkin Acked-by: Larry Finger Acked-by: Hans de Goede Acked-by: Martin Kaiser Tested-by: Philipp Hortmann # Edimax N150 Acked-by: Michael Straube Link: https://lore.kernel.org/r/20230308131934.380395-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 2d8cb0bfca6a05f1731d4570941e85d65c669386 Merge: 649c15c7691e9 c311aaa74ca18 Author: Jakub Kicinski Date: Wed Mar 8 23:28:23 2023 -0800 Merge branch 'tools-ynl-fix-enum-as-flags-in-the-generic-cli' Jakub Kicinski says: ==================== tools: ynl: fix enum-as-flags in the generic CLI The CLI needs to use proper classes when looking at Enum definitions rather than interpreting the YAML spec ad-hoc, because we have more than on format of the definition supported. ==================== Link: https://lore.kernel.org/r/20230308003923.445268-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c311aaa74ca18bd0781d1d3bebd08484799f840c Author: Jakub Kicinski Date: Tue Mar 7 16:39:23 2023 -0800 tools: ynl: fix enum-as-flags in the generic CLI Lorenzo points out that the generic CLI is broken for the netdev family. When I added the support for documentation of enums (and sparse enums) the client script was not updated. It expects the values in enum to be a list of names, now it can also be a dict (YAML object). Reported-by: Lorenzo Bianconi Fixes: e4b48ed460d3 ("tools: ynl: add a completely generic client") Signed-off-by: Jakub Kicinski commit 6517a60b0307abdcca80133c237551cc7cc8e6ae Author: Jakub Kicinski Date: Tue Mar 7 16:39:22 2023 -0800 tools: ynl: move the enum classes to shared code Move bulk of the EnumSet and EnumEntry code to shared code for reuse by cli. Signed-off-by: Jakub Kicinski commit 649c15c7691e9b13cbe9bf6c65c365350e056067 Author: Thadeu Lima de Souza Cascardo Date: Tue Mar 7 14:37:07 2023 -0300 net: avoid double iput when sock_alloc_file fails When sock_alloc_file fails to allocate a file, it will call sock_release. __sys_socket_file should then not call sock_release again, otherwise there will be a double free. [ 89.319884] ------------[ cut here ]------------ [ 89.320286] kernel BUG at fs/inode.c:1764! [ 89.320656] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 89.321051] CPU: 7 PID: 125 Comm: iou-sqp-124 Not tainted 6.2.0+ #361 [ 89.321535] RIP: 0010:iput+0x1ff/0x240 [ 89.321808] Code: d1 83 e1 03 48 83 f9 02 75 09 48 81 fa 00 10 00 00 77 05 83 e2 01 75 1f 4c 89 ef e8 fb d2 ba 00 e9 80 fe ff ff c3 cc cc cc cc <0f> 0b 0f 0b e9 d0 fe ff ff 0f 0b eb 8d 49 8d b4 24 08 01 00 00 48 [ 89.322760] RSP: 0018:ffffbdd60068bd50 EFLAGS: 00010202 [ 89.323036] RAX: 0000000000000000 RBX: ffff9d7ad3cacac0 RCX: 0000000000001107 [ 89.323412] RDX: 000000000003af00 RSI: 0000000000000000 RDI: ffff9d7ad3cacb40 [ 89.323785] RBP: ffffbdd60068bd68 R08: ffffffffffffffff R09: ffffffffab606438 [ 89.324157] R10: ffffffffacb3dfa0 R11: 6465686361657256 R12: ffff9d7ad3cacb40 [ 89.324529] R13: 0000000080000001 R14: 0000000080000001 R15: 0000000000000002 [ 89.324904] FS: 00007f7b28516740(0000) GS:ffff9d7aeb1c0000(0000) knlGS:0000000000000000 [ 89.325328] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 89.325629] CR2: 00007f0af52e96c0 CR3: 0000000002a02006 CR4: 0000000000770ee0 [ 89.326004] PKRU: 55555554 [ 89.326161] Call Trace: [ 89.326298] [ 89.326419] __sock_release+0xb5/0xc0 [ 89.326632] __sys_socket_file+0xb2/0xd0 [ 89.326844] io_socket+0x88/0x100 [ 89.327039] ? io_issue_sqe+0x6a/0x430 [ 89.327258] io_issue_sqe+0x67/0x430 [ 89.327450] io_submit_sqes+0x1fe/0x670 [ 89.327661] io_sq_thread+0x2e6/0x530 [ 89.327859] ? __pfx_autoremove_wake_function+0x10/0x10 [ 89.328145] ? __pfx_io_sq_thread+0x10/0x10 [ 89.328367] ret_from_fork+0x29/0x50 [ 89.328576] RIP: 0033:0x0 [ 89.328732] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 89.329073] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 89.329477] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7b28637a3d [ 89.329845] RDX: 00007fff4e4318a8 RSI: 00007fff4e4318b0 RDI: 0000000000000400 [ 89.330216] RBP: 00007fff4e431830 R08: 00007fff4e431711 R09: 00007fff4e4318b0 [ 89.330584] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff4e441b38 [ 89.330950] R13: 0000563835e3e725 R14: 0000563835e40d10 R15: 00007f7b28784040 [ 89.331318] [ 89.331441] Modules linked in: [ 89.331617] ---[ end trace 0000000000000000 ]--- Fixes: da214a475f8b ("net: add __sys_socket_file()") Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Jens Axboe Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230307173707.468744-1-cascardo@canonical.com Signed-off-by: Jakub Kicinski commit 2aab4b96900272885bc157f8b236abf1cdc02e08 Author: Eric Dumazet Date: Tue Mar 7 16:45:30 2023 +0000 af_unix: fix struct pid leaks in OOB support syzbot reported struct pid leak [1]. Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid. But skb->destructor is not set (either directly or by calling unix_scm_to_skb()) This means that subsequent kfree_skb() or consume_skb() would leak this reference. In this fix, I chose to fully support scm even for the OOB message. [1] BUG: memory leak unreferenced object 0xffff8881053e7f80 (size 128): comm "syz-executor242", pid 5066, jiffies 4294946079 (age 13.220s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] alloc_pid+0x6a/0x560 kernel/pid.c:180 [] copy_process+0x169f/0x26c0 kernel/fork.c:2285 [] kernel_clone+0xf7/0x610 kernel/fork.c:2684 [] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 314001f0bf92 ("af_unix: Add OOB support") Reported-by: syzbot+7699d9e5635c10253a27@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Cc: Rao Shoaib Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230307164530.771896-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8f14820801042c221bb9fe51643a2585cac5dec2 Author: Jakub Kicinski Date: Tue Mar 7 09:19:30 2023 -0800 eth: fealnx: bring back this old driver This reverts commit d5e2d038dbece821f1af57acbeded3aa9a1832c1. We have a report of this chip being used on a SURECOM EP-320X-S 100/10M Ethernet PCI Adapter which could still have been purchased in some parts of the world 3 years ago. Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=217151 Fixes: d5e2d038dbec ("eth: fealnx: delete the driver for Myson MTD-800") Link: https://lore.kernel.org/r/20230307171930.4008454-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c8b8a3c601f2cfad25ab5ce5b04df700048aef6e Author: Vladimir Oltean Date: Tue Mar 7 17:54:11 2023 +0200 net: dsa: mt7530: permit port 5 to work without port 6 on MT7621 SoC The MT7530 switch from the MT7621 SoC has 2 ports which can be set up as internal: port 5 and 6. Arınç reports that the GMAC1 attached to port 5 receives corrupted frames, unless port 6 (attached to GMAC0) has been brought up by the driver. This is true regardless of whether port 5 is used as a user port or as a CPU port (carrying DSA tags). Offline debugging (blind for me) which began in the linked thread showed experimentally that the configuration done by the driver for port 6 contains a step which is needed by port 5 as well - the write to CORE_GSWPLL_GRP2 (note that I've no idea as to what it does, apart from the comment "Set core clock into 500Mhz"). Prints put by Arınç show that the reset value of CORE_GSWPLL_GRP2 is RG_GSWPLL_POSDIV_500M(1) | RG_GSWPLL_FBKDIV_500M(40) (0x128), both on the MCM MT7530 from the MT7621 SoC, as well as on the standalone MT7530 from MT7623NI Bananapi BPI-R2. Apparently, port 5 on the standalone MT7530 can work under both values of the register, while on the MT7621 SoC it cannot. The call path that triggers the register write is: mt753x_phylink_mac_config() for port 6 -> mt753x_pad_setup() -> mt7530_pad_clk_setup() so this fully explains the behavior noticed by Arınç, that bringing port 6 up is necessary. The simplest fix for the problem is to extract the register writes which are needed for both port 5 and 6 into a common mt7530_pll_setup() function, which is called at mt7530_setup() time, immediately after switch reset. We can argue that this mirrors the code layout introduced in mt7531_setup() by commit 42bc4fafe359 ("net: mt7531: only do PLL once after the reset"), in that the PLL setup has the exact same positioning, and further work to consolidate the separate setup() functions is not hindered. Testing confirms that: - the slight reordering of writes to MT7530_P6ECR and to CORE_GSWPLL_GRP1 / CORE_GSWPLL_GRP2 introduced by this change does not appear to cause problems for the operation of port 6 on MT7621 and on MT7623 (where port 5 also always worked) - packets sent through port 5 are not corrupted anymore, regardless of whether port 6 is enabled by phylink or not (or even present in the device tree) My algorithm for determining the Fixes: tag is as follows. Testing shows that some logic from mt7530_pad_clk_setup() is needed even for port 5. Prior to commit ca366d6c889b ("net: dsa: mt7530: Convert to PHYLINK API"), a call did exist for all phy_is_pseudo_fixed_link() ports - so port 5 included. That commit replaced it with a temporary "Port 5 is not supported!" comment, and the following commit 38f790a80560 ("net: dsa: mt7530: Add support for port 5") replaced that comment with a configuration procedure in mt7530_setup_port5() which was insufficient for port 5 to work. I'm laying the blame on the patch that claimed support for port 5, although one would have also needed the change from commit c3b8e07909db ("net: dsa: mt7530: setup core clock even in TRGMII mode") for the write to be performed completely independently from port 6's configuration. Thanks go to Arınç for describing the problem, for debugging and for testing. Reported-by: Arınç ÜNAL Link: https://lore.kernel.org/netdev/f297c2c4-6e7c-57ac-2394-f6025d309b9d@arinc9.com/ Fixes: 38f790a80560 ("net: dsa: mt7530: Add support for port 5") Signed-off-by: Vladimir Oltean Tested-by: Arınç ÜNAL Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230307155411.868573-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 6a98c9cae232800c319ed69e1063480d31430887 Merge: 55ee6646b6ba8 63bceed808c5c Author: Linus Torvalds Date: Wed Mar 8 12:02:09 2023 -0800 Merge tag 'fs_for_v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf fixes from Jan Kara: "Fix bugs in UDF caused by the big pile of changes that went in during the merge window" * tag 'fs_for_v6.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Warn if block mapping is done for in-ICB files udf: Fix reading of in-ICB files udf: Fix lost writes in udf_adinicb_writepage() commit 55ee6646b6ba86574d1411af275c61a82fdfe10e Merge: 7fef099702527 1a0009abfa789 Author: Linus Torvalds Date: Wed Mar 8 11:56:45 2023 -0800 Merge tag 'platform-drivers-x86-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "A small set of assorted bug and build/warning fixes" * tag 'platform-drivers-x86-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform: mellanox: mlx-platform: Initialize shift variable to 0 platform/x86: int3472: Add GPIOs to Surface Go 3 Board data platform/x86: ISST: Fix kernel documentation warnings platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it platform: mellanox: select REGMAP instead of depending on it platform/x86/intel/tpmi: Fix double free reported by Smatch platform/x86: ISST: Increase range of valid mail box commands platform/x86: dell-ddv: Fix temperature scaling platform/x86: dell-ddv: Fix cache invalidation on resume platform/x86/amd: pmc: remove CONFIG_SUSPEND checks commit a722511b18268bd1f7084eee243af416b85f288f Author: Randy Dunlap Date: Sun Feb 19 17:04:28 2023 -0800 drm/msm: DEVFREQ_GOV_SIMPLE_ONDEMAND is no longer needed DRM_MSM no longer needs DEVFREQ_GOV_SIMPLE_ONDEMAND (since commit dbd7a2a941b8 ("PM / devfreq: Fix build issues with devfreq disabled") in linux-next), so remove that select from the DRM_MSM Kconfig file. Fixes: 6563f60f14cb ("drm/msm/gpu: Add devfreq tuning debugfs") Signed-off-by: Randy Dunlap Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Sean Paul Cc: David Airlie Cc: Daniel Vetter Cc: linux-arm-msm@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: freedreno@lists.freedesktop.org Reviewed-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/523353/ Link: https://lore.kernel.org/r/20230220010428.16910-1-rdunlap@infradead.org [rob: tweak commit message to make checkpatch.pl happy] Signed-off-by: Rob Clark commit 7fef099702527c3b2c5234a2ea6a24411485a13a Author: Linus Torvalds Date: Tue Mar 7 13:06:29 2023 -0800 x86/resctl: fix scheduler confusion with 'current' The implementation of 'current' on x86 is very intentionally special: it is a very common thing to look up, and it uses 'this_cpu_read_stable()' to get the current thread pointer efficiently from per-cpu storage. And the keyword in there is 'stable': the current thread pointer never changes as far as a single thread is concerned. Even if when a thread is preempted, or moved to another CPU, or even across an explicit call 'schedule()' that thread will still have the same value for 'current'. It is, after all, the kernel base pointer to thread-local storage. That's why it's stable to begin with, but it's also why it's important enough that we have that special 'this_cpu_read_stable()' access for it. So this is all done very intentionally to allow the compiler to treat 'current' as a value that never visibly changes, so that the compiler can do CSE and combine multiple different 'current' accesses into one. However, there is obviously one very special situation when the currently running thread does actually change: inside the scheduler itself. So the scheduler code paths are special, and do not have a 'current' thread at all. Instead there are _two_ threads: the previous and the next thread - typically called 'prev' and 'next' (or prev_p/next_p) internally. So this is all actually quite straightforward and simple, and not all that complicated. Except for when you then have special code that is run in scheduler context, that code then has to be aware that 'current' isn't really a valid thing. Did you mean 'prev'? Did you mean 'next'? In fact, even if then look at the code, and you use 'current' after the new value has been assigned to the percpu variable, we have explicitly told the compiler that 'current' is magical and always stable. So the compiler is quite free to use an older (or newer) value of 'current', and the actual assignment to the percpu storage is not relevant even if it might look that way. Which is exactly what happened in the resctl code, that blithely used 'current' in '__resctrl_sched_in()' when it really wanted the new process state (as implied by the name: we're scheduling 'into' that new resctl state). And clang would end up just using the old thread pointer value at least in some configurations. This could have happened with gcc too, and purely depends on random compiler details. Clang just seems to have been more aggressive about moving the read of the per-cpu current_task pointer around. The fix is trivial: just make the resctl code adhere to the scheduler rules of using the prev/next thread pointer explicitly, instead of using 'current' in a situation where it just wasn't valid. That same code is then also used outside of the scheduler context (when a thread resctl state is explicitly changed), and then we will just pass in 'current' as that pointer, of course. There is no ambiguity in that case. The fix may be trivial, but noticing and figuring out what went wrong was not. The credit for that goes to Stephane Eranian. Reported-by: Stephane Eranian Link: https://lore.kernel.org/lkml/20230303231133.1486085-1-eranian@google.com/ Link: https://lore.kernel.org/lkml/alpine.LFD.2.01.0908011214330.3304@localhost.localdomain/ Reviewed-by: Nick Desaulniers Tested-by: Tony Luck Tested-by: Stephane Eranian Tested-by: Babu Moger Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit d17789edd6a8270c38459e592ee536a84c6202db Author: Hans de Goede Date: Mon Mar 6 16:35:12 2023 +0100 staging: rtl8723bs: Pass correct parameters to cfg80211_get_bss() To last 2 parameters to cfg80211_get_bss() should be of the enum ieee80211_bss_type resp. enum ieee80211_privacy types, which WLAN_CAPABILITY_ESS very much is not. Fix both cfg80211_get_bss() calls in ioctl_cfg80211.c to pass the right parameters. Note that the second call was already somewhat fixed by commenting out WLAN_CAPABILITY_ESS and passing in 0 instead. This was still not entirely correct though since that would limit returned BSS-es to ESS type BSS-es with privacy on. Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230306153512.162104-2-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit 05cbcc415c9b8c8bc4f9a09f8e03610a89042f03 Author: Hans de Goede Date: Mon Mar 6 16:35:11 2023 +0100 staging: rtl8723bs: Fix key-store index handling There are 2 issues with the key-store index handling 1. The non WEP key stores can store keys with indexes 0 - BIP_MAX_KEYID, this means that they should be an array with BIP_MAX_KEYID + 1 entries. But some of the arrays where just BIP_MAX_KEYID entries big. While one other array was hardcoded to a size of 6 entries, instead of using the BIP_MAX_KEYID define. 2. The rtw_cfg80211_set_encryption() and wpa_set_encryption() functions index check where checking that the passed in key-index would fit inside both the WEP key store (which only has 4 entries) as well as in the non WEP key stores. This breaks any attempts to set non WEP keys with index 4 or 5. Issue 2. specifically breaks wifi connection with some access points which advertise PMF support. Without this fix connecting to these access points fails with the following wpa_supplicant messages: nl80211: kernel reports: key addition failed wlan0: WPA: Failed to configure IGTK to the driver wlan0: RSN: Failed to configure IGTK wlan0: CTRL-EVENT-DISCONNECTED bssid=... reason=1 locally_generated=1 Fix 1. by using the right size for the key-stores. After this 2. can safely be fixed by checking the right max-index value depending on the used algorithm, fixing wifi not working with some PMF capable APs. Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230306153512.162104-1-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman commit fe413a074a93d56f89e322c786aad8639afe76b4 Author: Philipp Hortmann Date: Wed Mar 1 22:54:41 2023 +0100 staging: rtl8192e: Remove call_usermodehelper starting RadioPower.sh Remove call_usermodehelper starting /etc/acpi/events/RadioPower.sh that is not available. This script is not part of the kernel and it is not officially available on the www. The result is that this lines are just dead code. Signed-off-by: Philipp Hortmann Cc: stable Link: https://lore.kernel.org/r/20230301215441.GA14049@matrix-ESPRIMO-P710 Signed-off-by: Greg Kroah-Hartman commit a98fc23cc2c1e4382a79ff137ca1a93d6a73b451 Author: Philipp Hortmann Date: Tue Feb 28 21:28:57 2023 +0100 staging: rtl8192e: Remove function ..dm_check_ac_dc_power calling a script Remove function _rtl92e_dm_check_ac_dc_power calling a script /etc/acpi/wireless-rtl-ac-dc-power.sh that is not available. This script is not part of the kernel and it is not available on the www. The result is that this function is just dead code. Signed-off-by: Philipp Hortmann Cc: stable Link: https://lore.kernel.org/r/20230228202857.GA16442@matrix-ESPRIMO-P710 Signed-off-by: Greg Kroah-Hartman commit b0563468eeac88ebc70559d52a0b66efc37e4e9d Author: Andrew Cooper Date: Tue Mar 7 17:46:43 2023 +0000 x86/CPU/AMD: Disable XSAVES on AMD family 0x17 AMD Erratum 1386 is summarised as: XSAVES Instruction May Fail to Save XMM Registers to the Provided State Save Area This piece of accidental chronomancy causes the %xmm registers to occasionally reset back to an older value. Ignore the XSAVES feature on all AMD Zen1/2 hardware. The XSAVEC instruction (which works fine) is equivalent on affected parts. [ bp: Typos, move it into the F17h-specific function. ] Reported-by: Tavis Ormandy Signed-off-by: Andrew Cooper Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/20230307174643.1240184-1-andrew.cooper3@citrix.com commit 01e68ce08a30db3d842ce7a55f7f6e0474a55f9a Author: Jens Axboe Date: Wed Mar 8 07:18:51 2023 -0700 io_uring/io-wq: stop setting PF_NO_SETAFFINITY on io-wq workers Every now and then reports come in that are puzzled on why changing affinity on the io-wq workers fails with EINVAL. This happens because they set PF_NO_SETAFFINITY as part of their creation, as io-wq organizes workers into groups based on what CPU they are running on. However, this is purely an optimization and not a functional requirement. We can allow setting affinity, and just lazily update our worker to wqe mappings. If a given io-wq thread times out, it normally exits if there's no more work to do. The exception is if it's the last worker available. For the timeout case, check the affinity of the worker against group mask and exit even if it's the last worker. New workers should be created with the right mask and in the right location. Reported-by:Daniel Dao Link: https://lore.kernel.org/io-uring/CA+wXwBQwgxB3_UphSny-yAP5b26meeOu1W4TwYVcD_+5gOhvPw@mail.gmail.com/ Signed-off-by: Jens Axboe commit d617808e3b8324eacebabefec49dc75536ee39cc Author: Christophe JAILLET Date: Fri Jul 8 21:30:01 2022 +0200 firmware: arm_scmi: Use the bitmap API to allocate bitmaps Use devm_bitmap_zalloc() instead of hand-writing them. It is less verbose and it improves the semantic. Signed-off-by: Christophe JAILLET Reviewed-by: Cristian Marussi Tested-by: Cristian Marussi Link: https://lore.kernel.org/r/c073b1607ada34d5bde6ce1009179cf15bbf0da3.1657308593.git.christophe.jaillet@wanadoo.fr Signed-off-by: Sudeep Holla commit 2ab4f4018cb6b8010ca5002c3bdc37783b5d28c2 Author: Cristian Marussi Date: Tue Mar 7 16:23:24 2023 +0000 firmware: arm_scmi: Fix device node validation for mailbox transport When mailboxes are used as a transport it is possible to setup the SCMI transport layer, depending on the underlying channels configuration, to use one or two mailboxes, associated, respectively, to one or two, distinct, shared memory areas: any other combination should be treated as invalid. Add more strict checking of SCMI mailbox transport device node descriptors. Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") Cc: # 4.19 Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20230307162324.891866-1-cristian.marussi@arm.com Signed-off-by: Sudeep Holla commit 5b8e5319affc977d24b8ce7edd295907e969e217 Author: Lukas Bulwahn Date: Wed Mar 8 15:36:40 2023 +0100 MAINTAINERS: repair a malformed T: entry in IDMAPPED MOUNTS The T: entries shall be composed of a SCM tree type (git, hg, quilt, stgit or topgit) and location. Add the SCM tree type to the T: entry and reorder the file entries in alphabetical order. Fixes: ddc84c90538e ("MAINTAINERS: update idmapping tree") Signed-off-by: Lukas Bulwahn Signed-off-by: Christian Brauner (Microsoft) commit e2f2a39452c43b64ea3191642a2661cb8d03827a Author: Yu Kuai Date: Wed Mar 8 10:32:08 2023 +0800 block, bfq: fix uaf for 'stable_merge_bfqq' Before commit fd571df0ac5b ("block, bfq: turn bfqq_data into an array in bfq_io_cq"), process reference is read before bfq_put_stable_ref(), and it's safe if bfq_put_stable_ref() put the last reference, because process reference will be 0 and 'stable_merge_bfqq' won't be accessed in this case. However, the commit changed the order and will cause uaf for 'stable_merge_bfqq'. In order to emphasize that bfq_put_stable_ref() can drop the last reference, fix the problem by moving bfq_put_stable_ref() to the end of bfq_setup_stable_merge(). Fixes: fd571df0ac5b ("block, bfq: turn bfqq_data into an array in bfq_io_cq") Reported-and-tested-by: Shinichiro Kawasaki Link: https://lore.kernel.org/linux-block/20230307071448.rzihxbm4jhbf5krj@shindev/ Signed-off-by: Yu Kuai Reviewed-by: Jan Kara Signed-off-by: Jens Axboe commit af0f46e5b9a462aaa1d76e82781a5316f03828eb Author: Guenter Roeck Date: Tue Mar 7 07:51:11 2023 -0800 ASoC: da7219: Initialize jack_det_mutex The following traceback is reported if mutex debugging is enabled. DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 0 PID: 17 at kernel/locking/mutex.c:950 __mutex_lock_common+0x31c/0x11d4 Modules linked in: CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 5.10.172-lockdep-21846-g849884cfca5a #1 fd2de466502012eb58bc8beb467f07d0b925611f Hardware name: MediaTek kakadu rev0/rev1 board (DT) Workqueue: events da7219_aad_jack_det_work pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--) pc : __mutex_lock_common+0x31c/0x11d4 lr : __mutex_lock_common+0x31c/0x11d4 sp : ffffff80c0317ae0 x29: ffffff80c0317b50 x28: ffffff80c0317b20 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000100000000 x23: ffffffd0121d296c x22: dfffffd000000000 x21: 0000000000000000 x20: 0000000000000000 x19: ffffff80c73d7190 x18: 1ffffff018050f52 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 83f0d991da544b00 x8 : 83f0d991da544b00 x7 : 0000000000000000 x6 : 0000000000000001 x5 : ffffff80c03176a0 x4 : 0000000000000000 x3 : ffffffd01067fd78 x2 : 0000000100000000 x1 : ffffff80c030ba80 x0 : 0000000000000028 Call trace: __mutex_lock_common+0x31c/0x11d4 mutex_lock_nested+0x98/0xac da7219_aad_jack_det_work+0x54/0xf0 process_one_work+0x6cc/0x19dc worker_thread+0x458/0xddc kthread+0x2fc/0x370 ret_from_fork+0x10/0x30 irq event stamp: 579 hardirqs last enabled at (579): [] exit_to_kernel_mode+0x108/0x138 hardirqs last disabled at (577): [] __do_softirq+0x53c/0x125c softirqs last enabled at (578): [] __irq_exit_rcu+0x264/0x4f4 softirqs last disabled at (573): [] __irq_exit_rcu+0x264/0x4f4 ---[ end trace 26da674636181c40 ]--- Initialize the mutex to fix the problem. Cc: David Rau Fixes: 7fde88eda855 ("ASoC: da7219: Improve the IRQ process to increase the stability") Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230307155111.1985522-1-linux@roeck-us.net Signed-off-by: Mark Brown commit 9ca6705d9d609441d34f8b853e1e4a6369b3b171 Author: Benjamin Coddington Date: Fri Mar 3 16:08:32 2023 -0500 SUNRPC: Fix a server shutdown leak Fix a race where kthread_stop() may prevent the threadfn from ever getting called. If that happens the svc_rqst will not be cleaned up. Fixes: ed6473ddc704 ("NFSv4: Fix callback server shutdown") Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit cdd28833100c18a469c85a1cc3de9f6bbbe6caa0 Author: Daniel Machon Date: Tue Mar 7 12:21:03 2023 +0100 net: microchip: sparx5: fix deletion of existing DSCP mappings Fix deletion of existing DSCP mappings in the APP table. Adding and deleting DSCP entries are replicated per-port, since the mapping table is global for all ports in the chip. Whenever a mapping for a DSCP value already exists, the old mapping is deleted first. However, it is only deleted for the specified port. Fix this by calling sparx5_dcb_ieee_delapp() instead of dcb_ieee_delapp() as it ought to be. Reproduce: // Map and remap DSCP value 63 $ dcb app add dev eth0 dscp-prio 63:1 $ dcb app add dev eth0 dscp-prio 63:2 $ dcb app show dev eth0 dscp-prio dscp-prio 63:2 $ dcb app show dev eth1 dscp-prio dscp-prio 63:1 63:2 <-- 63:1 should not be there Fixes: 8dcf69a64118 ("net: microchip: sparx5: add support for offloading dscp table") Signed-off-by: Daniel Machon Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit ea9dd2e5c6d12c8b65ce7514c8359a70eeaa0e70 Author: Suman Ghosh Date: Tue Mar 7 16:19:08 2023 +0530 octeontx2-af: Unlock contexts in the queue context cache in case of fault detection NDC caches contexts of frequently used queue's (Rx and Tx queues) contexts. Due to a HW errata when NDC detects fault/poision while accessing contexts it could go into an illegal state where a cache line could get locked forever. To makesure all cache lines in NDC are available for optimum performance upon fault/lockerror/posion errors scan through all cache lines in NDC and clear the lock bit. Fixes: 4a3581cd5995 ("octeontx2-af: NPA AQ instruction enqueue support") Signed-off-by: Suman Ghosh Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit ce7ca794712f186da99719e8b4e97bd5ddbb04c3 Author: D. Wythe Date: Tue Mar 7 11:23:46 2023 +0800 net/smc: fix fallback failed while sendmsg with fastopen Before determining whether the msg has unsupported options, it has been prematurely terminated by the wrong status check. For the application, the general usages of MSG_FASTOPEN likes fd = socket(...) /* rather than connect */ sendto(fd, data, len, MSG_FASTOPEN) Hence, We need to check the flag before state check, because the sock state here is always SMC_INIT when applications tries MSG_FASTOPEN. Once we found unsupported options, fallback it to TCP. Fixes: ee9dfbef02d1 ("net/smc: handle sockopts forcing fallback") Signed-off-by: D. Wythe Signed-off-by: Simon Horman v2 -> v1: Optimize code style Reviewed-by: Tony Lu Signed-off-by: David S. Miller commit 515bddf0ec4155cbd666d72daf5bd68c8b7cd987 Author: Tobias Klauser Date: Wed Mar 8 11:53:20 2023 +0100 selftests/clone3: test clone3 with CLONE_NEWTIME Verify that clone3 can be called successfully with CLONE_NEWTIME in flags. Cc: Andrey Vagin Cc: Christian Brauner Cc: Shuah Khan Signed-off-by: Tobias Klauser Signed-off-by: Christian Brauner (Microsoft) commit a402f1e35313fc7ce2ca60f543c4402c2c7c3544 Author: Tobias Klauser Date: Wed Mar 8 11:51:26 2023 +0100 fork: allow CLONE_NEWTIME in clone3 flags Currently, calling clone3() with CLONE_NEWTIME in clone_args->flags fails with -EINVAL. This is because CLONE_NEWTIME intersects with CSIGNAL. However, CSIGNAL was deprecated when clone3 was introduced in commit 7f192e3cd316 ("fork: add clone3"), allowing re-use of that part of clone flags. Fix this by explicitly allowing CLONE_NEWTIME in clone3_args_valid. This is also in line with the respective check in check_unshare_flags which allow CLONE_NEWTIME for unshare(). Fixes: 769071ac9f20 ("ns: Introduce Time Namespace") Cc: Andrey Vagin Cc: Christian Brauner Cc: stable@vger.kernel.org Signed-off-by: Tobias Klauser Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner (Microsoft) commit 493924519b1fe3faab13ee621a43b0d0939abab1 Author: Jeremy Sowden Date: Tue Mar 7 23:22:59 2023 +0000 netfilter: nft_redir: correct value of inet type `.maxattrs` `nft_redir_inet_type.maxattrs` was being set, presumably because of a cut-and-paste error, to `NFTA_MASQ_MAX`, instead of `NFTA_REDIR_MAX`. Fixes: 63ce3940f3ab ("netfilter: nft_redir: add inet support") Signed-off-by: Jeremy Sowden Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 1f617b6b4c7a3d5ea7a56abb83a4c27733b60c2f Author: Jeremy Sowden Date: Tue Mar 7 23:22:58 2023 +0000 netfilter: nft_redir: correct length for loading protocol registers The values in the protocol registers are two bytes wide. However, when parsing the register loads, the code currently uses the larger 16-byte size of a `union nf_inet_addr`. Change it to use the (correct) size of a `union nf_conntrack_man_proto` instead. Fixes: d07db9884a5f ("netfilter: nf_tables: introduce nft_validate_register_load()") Signed-off-by: Jeremy Sowden Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit ec2c5917eb858428b2083d1c74f445aabbe8316b Author: Jeremy Sowden Date: Tue Mar 7 23:22:57 2023 +0000 netfilter: nft_masq: correct length for loading protocol registers The values in the protocol registers are two bytes wide. However, when parsing the register loads, the code currently uses the larger 16-byte size of a `union nf_inet_addr`. Change it to use the (correct) size of a `union nf_conntrack_man_proto` instead. Fixes: 8a6bf5da1aef ("netfilter: nft_masq: support port range") Signed-off-by: Jeremy Sowden Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 068d82e75d537b444303b8c449a11e51ea659565 Author: Jeremy Sowden Date: Tue Mar 7 23:22:56 2023 +0000 netfilter: nft_nat: correct length for loading protocol registers The values in the protocol registers are two bytes wide. However, when parsing the register loads, the code currently uses the larger 16-byte size of a `union nf_inet_addr`. Change it to use the (correct) size of a `union nf_conntrack_man_proto` instead. Fixes: d07db9884a5f ("netfilter: nf_tables: introduce nft_validate_register_load()") Signed-off-by: Jeremy Sowden Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 03e1d60e177eedbd302b77af4ea5e21b5a7ade31 Author: David Disseldorp Date: Tue Mar 7 16:21:06 2023 +0100 watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths The watch_queue_set_size() allocation error paths return the ret value set via the prior pipe_resize_ring() call, which will always be zero. As a result, IOC_WATCH_QUEUE_SET_SIZE callers such as "keyctl watch" fail to detect kernel wqueue->notes allocation failures and proceed to KEYCTL_WATCH_KEY, with any notifications subsequently lost. Fixes: c73be61cede58 ("pipe: Add general notification queue support") Signed-off-by: David Disseldorp Signed-off-by: Christian Brauner (Microsoft) commit ff447886e675979d66b2bc01810035d3baea1b3a Author: Bjorn Helgaas Date: Tue Mar 7 15:40:54 2023 -0600 ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU() CONTROLLER_IN_GPU() is clearly intended to match only Intel devices, but previously it checked only the PCI Device ID, not the Vendor ID, so it could match devices from other vendors that happened to use the same Device ID. Update CONTROLLER_IN_GPU() so it matches only Intel devices. Fixes: 535115b5ff51 ("ALSA: hda - Abort the probe without i915 binding for HSW/B") Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20230307214054.886721-1-helgaas@kernel.org Signed-off-by: Takashi Iwai commit a86e79e3015f5dd8e1b01ccfa49bd5c6e41047a1 Author: Hamidreza H. Fard Date: Tue Mar 7 16:37:41 2023 +0000 ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro Samsung Galaxy Book2 Pro (13" 2022 NP930XED-KA1DE) with codec SSID 144d:c868 requires the same workaround for enabling the speaker amp like other Samsung models with ALC298 code. Signed-off-by: Hamidreza H. Fard Cc: Link: https://lore.kernel.org/r/20230307163741.3878-1-nitocris@posteo.net Signed-off-by: Takashi Iwai commit 7bb62340951a9af20235a3bde8c98e2e292915df Author: Jeremy Szu Date: Tue Mar 7 21:53:16 2023 +0800 ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform There is a HP platform needs ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED quirk to make mic-mute/audio-mute/speaker working. Signed-off-by: Jeremy Szu Cc: Link: https://lore.kernel.org/r/20230307135317.37621-1-jeremy.szu@canonical.com Signed-off-by: Takashi Iwai commit bbdf904b13a62bb8b1272d92a7dde082dff86fbb Author: Bard Liao Date: Mon Mar 6 15:41:01 2023 +0800 ALSA: hda: intel-dsp-config: add MTL PCI id Use SOF as default audio driver. Signed-off-by: Bard Liao Reviewed-by: Gongjun Song Reviewed-by: Kai Vehmanen Cc: Link: https://lore.kernel.org/r/20230306074101.3906707-1-yung-chuan.liao@linux.intel.com Signed-off-by: Takashi Iwai commit 3c92792da8506a295afb6d032b4476e46f979725 Author: Jan Kara Date: Wed Mar 1 15:10:04 2023 +0100 ext4: Fix deadlock during directory rename As lockdep properly warns, we should not be locking i_rwsem while having transactions started as the proper lock ordering used by all directory handling operations is i_rwsem -> transaction start. Fix the lock ordering by moving the locking of the directory earlier in ext4_rename(). Reported-by: syzbot+9d16c39efb5fade84574@syzkaller.appspotmail.com Fixes: 0813299c586b ("ext4: Fix possible corruption when moving a directory") Link: https://syzkaller.appspot.com/bug?extid=9d16c39efb5fade84574 Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230301141004.15087-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit ce756daa36e1ba271bb3334267295e447aa57a5c Author: Tomas Henzl Date: Fri Mar 3 00:43:36 2023 +0100 scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() Add a missing resource clean up in .remove. Fixes: e22bae30667a ("scsi: mpi3mr: Add expander devices to STL") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230302234336.25456-7-thenzl@redhat.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit c798304470cab88723d895726d17fcb96472e0e9 Author: Tomas Henzl Date: Fri Mar 3 00:43:35 2023 +0100 scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() Don't allocate memory again when IOC is being reinitialized. Fixes: fe6db6151565 ("scsi: mpi3mr: Handle offline FW activation in graceful manner") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230302234336.25456-6-thenzl@redhat.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit d4caa1a4255cc44be56bcab3db2c97c632e6cc10 Author: Tomas Henzl Date: Fri Mar 3 00:43:34 2023 +0100 scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() Free mrioc->sas_hba.phy at .remove. Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230302234336.25456-5-thenzl@redhat.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit d0f3c3728da8af76dfe435f7f0cfa2b9d9e43ef0 Author: Tomas Henzl Date: Fri Mar 3 00:43:33 2023 +0100 scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() Free mpi3mr_hba_port at .remove. Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230302234336.25456-4-thenzl@redhat.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit 7d2b02172b6a2ae6aecd7ef6480b9c4bf3dc59f4 Author: Tomas Henzl Date: Fri Mar 3 00:43:32 2023 +0100 scsi: mpi3mr: Fix config page DMA memory leak A fix for: DMA-API: pci 0000:83:00.0: device driver has pending DMA allocations while released from device [count=1] Fixes: 32d457d5a2af ("scsi: mpi3mr: Add framework to issue config requests") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230302234336.25456-3-thenzl@redhat.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit f305a7b6ca21a665e8d0cf70b5936991a298c93c Author: Tomas Henzl Date: Fri Mar 3 00:43:31 2023 +0100 scsi: mpi3mr: Fix throttle_groups memory leak Add a missing kfree(). Fixes: f10af057325c ("scsi: mpi3mr: Resource Based Metering") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20230302234336.25456-2-thenzl@redhat.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit d3c57724f1569311e4b81e98fad0931028b9bdcd Author: Wenchao Hao Date: Sat Feb 25 18:01:36 2023 +0800 scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit c3d79fda250ac5df73d089f08311eb87138b04f3 Author: Ilpo Järvinen Date: Wed Feb 8 10:08:46 2023 +0200 fpga: m10bmc-sec: Fix rsu_send_data() to return FW_UPLOAD_ERR_HW_ERROR rsu_send_data() should return FW_UPLOAD_ERR_* error codes instead of normal -Exxxx codes. Convert <0 return from ->rsu_status() to FW_UPLOAD_ERR_HW_ERROR. Fixes: 001a734a55d0 ("fpga: m10bmc-sec: Make rsu status type specific") Signed-off-by: Ilpo Järvinen Reviewed-by: Russ Weight Cc: Acked-by: Xu Yilun Link: https://lore.kernel.org/r/20230208080846.10795-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Xu Yilun commit 7fc1f5c28ae4c615ccc5346f39a7bf4c4e0900ac Author: Tudor Ambarus Date: Wed Mar 1 13:38:42 2023 +0000 ext4: Fix comment about the 64BIT feature 64BIT is part of the incompatible feature set, update the comment accordingly. Signed-off-by: Tudor Ambarus Reviewed-by: Darrick J. Wong Link: https://lore.kernel.org/r/20230301133842.671821-1-tudor.ambarus@linaro.org Signed-off-by: Theodore Ts'o commit b7eef407e5271f5135ce97bfd6e2e5009922331e Author: Wu Bo Date: Wed Feb 22 09:35:24 2023 +0800 docs: ext4: modify the group desc size to 64 Since the default ext4 group desc size is 64 now (assuming that the 64-bit feature is enbled). And the size mentioned in this doc is 64 too. Change it to 64. Signed-off-by: Wu Bo Acked-by: Darrick J. Wong Link: https://lore.kernel.org/r/20230222013525.14748-1-bo.wu@vivo.com Signed-off-by: Theodore Ts'o commit c993799baf9c5861f8df91beb80e1611b12efcbd Author: Darrick J. Wong Date: Thu Feb 16 10:55:48 2023 -0800 ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, }, ... }; ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd); Produces this crash if the underlying filesystem is a 1k-block ext4 filesystem: kernel BUG at fs/ext4/ext4.h:3331! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G W O 6.2.0-rc8-achx Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4] RSP: 0018:ffffc90007c03998 EFLAGS: 00010246 RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000 RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11 RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400 R10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001 R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398 FS: 00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0 Call Trace: ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80] __x64_sys_ioctl+0x82/0xa0 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fdf20558aff RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff RDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003 RBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010 R13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000 For GETFSMAP calls, the caller selects a physical block device by writing its block number into fsmap_head.fmh_keys[01].fmr_device. To query mappings for a subrange of the device, the starting byte of the range is written to fsmap_head.fmh_keys[0].fmr_physical and the last byte of the range goes in fsmap_head.fmh_keys[1].fmr_physical. IOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you'd set the inputs as follows: fmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3}, fmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14}, Which would return you whatever is mapped in the 12 bytes starting at physical offset 3. The crash is due to insufficient range validation of keys[1] in ext4_getfsmap_datadev. On 1k-block filesystems, block 0 is not part of the filesystem, which means that s_first_data_block is nonzero. ext4_get_group_no_and_offset subtracts this quantity from the blocknr argument before cracking it into a group number and a block number within a group. IOWs, block group 0 spans blocks 1-8192 (1-based) instead of 0-8191 (0-based) like what happens with larger blocksizes. The net result of this encoding is that blocknr < s_first_data_block is not a valid input to this function. The end_fsb variable is set from the keys that are copied from userspace, which means that in the above example, its value is zero. That leads to an underflow here: blocknr = blocknr - le32_to_cpu(es->s_first_data_block); The division then operates on -1: offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) >> EXT4_SB(sb)->s_cluster_bits; Leaving an impossibly large group number (2^32-1) in blocknr. ext4_getfsmap_check_keys checked that keys[0].fmr_physical and keys[1].fmr_physical are in increasing order, but ext4_getfsmap_datadev adjusts keys[0].fmr_physical to be at least s_first_data_block. This implies that we have to check it again after the adjustment, which is the piece that I forgot. Reported-by: syzbot+6be2b977c89f79b6b153@syzkaller.appspotmail.com Fixes: 4a4956249dac ("ext4: fix off-by-one fsmap error on 1k block filesystems") Link: https://syzkaller.appspot.com/bug?id=79d5768e9bfe362911ac1a5057a36fc6b5c30002 Cc: stable@vger.kernel.org Signed-off-by: Darrick J. Wong Link: https://lore.kernel.org/r/Y+58NPTH7VNGgzdd@magnolia Signed-off-by: Theodore Ts'o commit c9f62c8b2dbf7240536c0cc9a4529397bb8bf38e Author: Eric Whitney Date: Fri Feb 10 12:32:44 2023 -0500 ext4: fix RENAME_WHITEOUT handling for inline directories A significant number of xfstests can cause ext4 to log one or more warning messages when they are run on a test file system where the inline_data feature has been enabled. An example: "EXT4-fs warning (device vdc): ext4_dirblock_csum_set:425: inode #16385: comm fsstress: No space for directory leaf checksum. Please run e2fsck -D." The xfstests include: ext4/057, 058, and 307; generic/013, 051, 068, 070, 076, 078, 083, 232, 269, 270, 390, 461, 475, 476, 482, 579, 585, 589, 626, 631, and 650. In this situation, the warning message indicates a bug in the code that performs the RENAME_WHITEOUT operation on a directory entry that has been stored inline. It doesn't detect that the directory is stored inline, and incorrectly attempts to compute a dirent block checksum on the whiteout inode when creating it. This attempt fails as a result of the integrity checking in get_dirent_tail (usually due to a failure to match the EXT4_FT_DIR_CSUM magic cookie), and the warning message is then emitted. Fix this by simply collecting the inlined data state at the time the search for the source directory entry is performed. Existing code handles the rest, and this is sufficient to eliminate all spurious warning messages produced by the tests above. Go one step further and do the same in the code that resets the source directory entry in the event of failure. The inlined state should be present in the "old" struct, but given the possibility of a race there's no harm in taking a conservative approach and getting that information again since the directory entry is being reread anyway. Fixes: b7ff91fd030d ("ext4: find old entry again if failed to rename whiteout") Cc: stable@kernel.org Signed-off-by: Eric Whitney Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230210173244.679890-1-enwlinux@gmail.com Signed-off-by: Theodore Ts'o commit 60db00e0a1490adcdc8b80887f7caf954d8bcd3e Author: Thomas Weißschuh Date: Thu Feb 9 03:18:35 2023 +0000 ext4: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230209-kobj_type-ext4-v1-1-6865fb05c1f8@weissschuh.net Signed-off-by: Theodore Ts'o commit ffec85d53d0f39ee4680a2cf0795255e000e1feb Author: Eric Biggers Date: Thu Feb 2 16:55:03 2023 -0800 ext4: fix cgroup writeback accounting with fs-layer encryption When writing a page from an encrypted file that is using filesystem-layer encryption (not inline encryption), ext4 encrypts the pagecache page into a bounce page, then writes the bounce page. It also passes the bounce page to wbc_account_cgroup_owner(). That's incorrect, because the bounce page is a newly allocated temporary page that doesn't have the memory cgroup of the original pagecache page. This makes wbc_account_cgroup_owner() not account the I/O to the owner of the pagecache page as it should. Fix this by always passing the pagecache page to wbc_account_cgroup_owner(). Fixes: 001e4a8775f6 ("ext4: implement cgroup writeback support") Cc: stable@vger.kernel.org Reported-by: Matthew Wilcox (Oracle) Signed-off-by: Eric Biggers Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20230203005503.141557-1-ebiggers@kernel.org Signed-off-by: Theodore Ts'o commit dd52a61da0dd8bab8b90e808f0e5ad507b61ad6d Author: SeongJae Park Date: Sat Mar 4 19:39:49 2023 +0000 mm/damon/paddr: fix folio_nr_pages() after folio_put() in damon_pa_mark_accessed_or_deactivate() damon_pa_mark_accessed_or_deactivate() is accessing a folio via folio_nr_pages() after folio_put() for the folio has invoked. Fix it. Link: https://lkml.kernel.org/r/20230304193949.296391-3-sj@kernel.org Fixes: f70da5ee8fe1 ("mm/damon: convert damon_pa_mark_accessed_or_deactivate() to use folios") Signed-off-by: SeongJae Park Reviewed-by: Kefeng Wang Reviewed-by: Matthew Wilcox (Oracle) Cc: Vishal Moola (Oracle) Signed-off-by: Andrew Morton commit 751688b8be9049f558f86982966ecaa61a9cbedf Author: SeongJae Park Date: Sat Mar 4 19:39:48 2023 +0000 mm/damon/paddr: fix folio_size() call after folio_put() in damon_pa_young() Patch series "mm/damon/paddr: Fix folio-use-after-put bugs". There are two folio accesses after folio_put() in mm/damon/paddr.c file. Fix those. This patch (of 2): damon_pa_young() is accessing a folio via folio_size() after folio_put() for the folio has invoked. Fix it. Link: https://lkml.kernel.org/r/20230304193949.296391-1-sj@kernel.org Link: https://lkml.kernel.org/r/20230304193949.296391-2-sj@kernel.org Fixes: 397b0c3a584b ("mm/damon/paddr: remove folio_sz field from damon_pa_access_chk_result") Signed-off-by: SeongJae Park Reviewed-by: Kefeng Wang Reviewed-by: Matthew Wilcox (Oracle) Cc: Vishal Moola (Oracle) Cc: [6.2.x] Signed-off-by: Andrew Morton commit 90410bcf873cf05f54a32183afff0161f44f9715 Author: Jan Kara via Ocfs2-devel Date: Thu Mar 2 16:38:43 2023 +0100 ocfs2: fix data corruption after failed write When buffered write fails to copy data into underlying page cache page, ocfs2_write_end_nolock() just zeroes out and dirties the page. This can leave dirty page beyond EOF and if page writeback tries to write this page before write succeeds and expands i_size, page gets into inconsistent state where page dirty bit is clear but buffer dirty bits stay set resulting in page data never getting written and so data copied to the page is lost. Fix the problem by invalidating page beyond EOF after failed write. Link: https://lkml.kernel.org/r/20230302153843.18499-1-jack@suse.cz Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") Signed-off-by: Jan Kara Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 2ef7dbb269902bde34c82f027806992195d1d1ee Author: Huang Ying Date: Fri Mar 3 11:01:55 2023 +0800 migrate_pages: try migrate in batch asynchronously firstly When we have locked more than one folios, we cannot wait the lock or bit (e.g., page lock, buffer head lock, writeback bit) synchronously. Otherwise deadlock may be triggered. This make it hard to batch the synchronous migration directly. This patch re-enables batching synchronous migration via trying to migrate in batch asynchronously firstly. And any folios that are failed to be migrated asynchronously will be migrated synchronously one by one. Test shows that this can restore the TLB flushing batching performance for synchronous migration effectively. Link: https://lkml.kernel.org/r/20230303030155.160983-4-ying.huang@intel.com Fixes: 5dfab109d519 ("migrate_pages: batch _unmap and _move") Signed-off-by: "Huang, Ying" Tested-by: Hugh Dickins Reviewed-by: Baolin Wang Cc: "Xu, Pengfei" Cc: Christoph Hellwig Cc: Stefan Roesch Cc: Tejun Heo Cc: Xin Hao Cc: Zi Yan Cc: Yang Shi Cc: Matthew Wilcox Cc: Mike Kravetz Signed-off-by: Andrew Morton commit a21d2133215b58fbf254ea2bb77eb3143ffedf60 Author: Huang Ying Date: Fri Mar 3 11:01:54 2023 +0800 migrate_pages: move split folios processing out of migrate_pages_batch() To simplify the code logic and reduce the line number. Link: https://lkml.kernel.org/r/20230303030155.160983-3-ying.huang@intel.com Fixes: 5dfab109d519 ("migrate_pages: batch _unmap and _move") Signed-off-by: "Huang, Ying" Reviewed-by: Baolin Wang Cc: Hugh Dickins Cc: "Xu, Pengfei" Cc: Christoph Hellwig Cc: Stefan Roesch Cc: Tejun Heo Cc: Xin Hao Cc: Zi Yan Cc: Yang Shi Cc: Matthew Wilcox Cc: Mike Kravetz Signed-off-by: Andrew Morton commit fb3592c41a4427601f9643b2a84e55bb99f5cd7c Author: Huang Ying Date: Fri Mar 3 11:01:53 2023 +0800 migrate_pages: fix deadlock in batched migration Patch series "migrate_pages: fix deadlock in batched synchronous migration", v2. Two deadlock bugs were reported for the migrate_pages() batching series. Thanks Hugh and Pengfei. Analysis shows that if we have locked some other folios except the one we are migrating, it's not safe in general to wait synchronously, for example, to wait the writeback to complete or wait to lock the buffer head. So 1/3 fixes the deadlock in a simple way, where the batching support for the synchronous migration is disabled. The change is straightforward and easy to be understood. While 3/3 re-introduce the batching for synchronous migration via trying to migrate asynchronously in batch optimistically, then fall back to migrate synchronously one by one for fail-to-migrate folios. Test shows that this can restore the TLB flushing batching performance for synchronous migration effectively. This patch (of 3): Two deadlock bugs were reported for the migrate_pages() batching series. Thanks Hugh and Pengfei! For example, in the following deadlock trace snippet, INFO: task kworker/u4:0:9 blocked for more than 147 seconds. Not tainted 6.2.0-rc4-kvm+ #1314 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:0 state:D stack:0 pid:9 ppid:2 flags:0x00004000 Workqueue: loop4 loop_rootcg_workfn Call Trace: __schedule+0x43b/0xd00 schedule+0x6a/0xf0 io_schedule+0x4a/0x80 folio_wait_bit_common+0x1b5/0x4e0 ? __pfx_wake_page_function+0x10/0x10 __filemap_get_folio+0x73d/0x770 shmem_get_folio_gfp+0x1fd/0xc80 shmem_write_begin+0x91/0x220 generic_perform_write+0x10e/0x2e0 __generic_file_write_iter+0x17e/0x290 ? generic_write_checks+0x12b/0x1a0 generic_file_write_iter+0x97/0x180 ? __sanitizer_cov_trace_const_cmp4+0x1a/0x20 do_iter_readv_writev+0x13c/0x210 ? __sanitizer_cov_trace_const_cmp4+0x1a/0x20 do_iter_write+0xf6/0x330 vfs_iter_write+0x46/0x70 loop_process_work+0x723/0xfe0 loop_rootcg_workfn+0x28/0x40 process_one_work+0x3cc/0x8d0 worker_thread+0x66/0x630 ? __pfx_worker_thread+0x10/0x10 kthread+0x153/0x190 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x50 INFO: task repro:1023 blocked for more than 147 seconds. Not tainted 6.2.0-rc4-kvm+ #1314 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:repro state:D stack:0 pid:1023 ppid:360 flags:0x00004004 Call Trace: __schedule+0x43b/0xd00 schedule+0x6a/0xf0 io_schedule+0x4a/0x80 folio_wait_bit_common+0x1b5/0x4e0 ? compaction_alloc+0x77/0x1150 ? __pfx_wake_page_function+0x10/0x10 folio_wait_bit+0x30/0x40 folio_wait_writeback+0x2e/0x1e0 migrate_pages_batch+0x555/0x1ac0 ? __pfx_compaction_alloc+0x10/0x10 ? __pfx_compaction_free+0x10/0x10 ? __this_cpu_preempt_check+0x17/0x20 ? lock_is_held_type+0xe6/0x140 migrate_pages+0x100e/0x1180 ? __pfx_compaction_free+0x10/0x10 ? __pfx_compaction_alloc+0x10/0x10 compact_zone+0xe10/0x1b50 ? lock_is_held_type+0xe6/0x140 ? check_preemption_disabled+0x80/0xf0 compact_node+0xa3/0x100 ? __sanitizer_cov_trace_const_cmp8+0x1c/0x30 ? _find_first_bit+0x7b/0x90 sysctl_compaction_handler+0x5d/0xb0 proc_sys_call_handler+0x29d/0x420 proc_sys_write+0x2b/0x40 vfs_write+0x3a3/0x780 ksys_write+0xb7/0x180 __x64_sys_write+0x26/0x30 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f3a2471f59d RSP: 002b:00007ffe567f7288 EFLAGS: 00000217 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3a2471f59d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 00007ffe567f72a0 R08: 0000000000000010 R09: 0000000000000010 R10: 0000000000000010 R11: 0000000000000217 R12: 00000000004012e0 R13: 00007ffe567f73e0 R14: 0000000000000000 R15: 0000000000000000 The page migration task has held the lock of the shmem folio A, and is waiting the writeback of the folio B of the file system on the loop block device to complete. While the loop worker task which writes back the folio B is waiting to lock the shmem folio A, because the folio A backs the folio B in the loop device. Thus deadlock is triggered. In general, if we have locked some other folios except the one we are migrating, it's not safe to wait synchronously, for example, to wait the writeback to complete or wait to lock the buffer head. To fix the deadlock, in this patch, we avoid to batch the page migration except for MIGRATE_ASYNC mode. In MIGRATE_ASYNC mode, synchronous waiting is avoided. The fix can be improved further. We will do that as soon as possible. Link: https://lkml.kernel.org/r/20230303030155.160983-1-ying.huang@intel.com Link: https://lore.kernel.org/linux-mm/87a6c8c-c5c1-67dc-1e32-eb30831d6e3d@google.com/ Link: https://lore.kernel.org/linux-mm/874jrg7kke.fsf@yhuang6-desk2.ccr.corp.intel.com/ Link: https://lore.kernel.org/linux-mm/20230227110614.dngdub2j3exr6dfp@quack3/ Link: https://lkml.kernel.org/r/20230303030155.160983-2-ying.huang@intel.com Fixes: 5dfab109d519 ("migrate_pages: batch _unmap and _move") Signed-off-by: "Huang, Ying" Reported-by: Hugh Dickins Reported-by: "Xu, Pengfei" Cc: Jan Kara Cc: Baolin Wang Cc: Christoph Hellwig Cc: Stefan Roesch Cc: Tejun Heo Cc: Xin Hao Cc: Zi Yan Cc: Yang Shi Cc: Matthew Wilcox Cc: Mike Kravetz Signed-off-by: Andrew Morton commit 89a004508081e1d1a498f10ea6d4f7f97a820438 Author: Alexandre Ghiti Date: Wed Mar 1 10:01:32 2023 +0100 .mailmap: add Alexandre Ghiti personal email address I'm no longer employed by Canonical which results in email bouncing so add an entry to my personal email address. Link: https://lkml.kernel.org/r/20230301090132.280475-1-alexghiti@rivosinc.com Signed-off-by: Alexandre Ghiti Reported-by: Conor Dooley Signed-off-by: Andrew Morton commit 071ca76d2c1dddc6bf2f4917a016207e00bcc8e3 Author: Konrad Dybcio Date: Wed Mar 1 12:00:12 2023 +0100 mailmap: correct Dikshita Agarwal's Qualcomm email address I recently sent a patch to map Dikshita's old CAF address to his current one @ Qualcomm. It turned out however, that he has two of them, with the @quicinc.com one meant for upstream contributions. Fix it. Link: https://lkml.kernel.org/r/20230301110012.1290379-1-konrad.dybcio@linaro.org Signed-off-by: Konrad Dybcio Cc: Dikshita Agarwal Cc: Andy Gross Cc: Arnd Bergmann Cc: Baolin Wang Cc: Bjorn Andersson Cc: Colin Ian King Cc: Kirill Tkhai Cc: Marijn Suijten Cc: Qais Yousef Cc: Vasily Averin Signed-off-by: Andrew Morton commit af665b40dfa2b49f1e3e11ecd1096506ef40348d Author: Jarkko Sakkinen Date: Thu Mar 2 01:54:42 2023 +0200 mailmap: updates for Jarkko Sakkinen Update to my current employer: https://research.tuni.fi/nisec/ Link: https://lkml.kernel.org/r/20230301235443.6663-1-jarkko@kernel.org Signed-off-by: Jarkko Sakkinen Cc: Arnd Bergmann Cc: Baolin Wang Cc: Ben Widawsky Cc: Bjorn Andersson Cc: Colin Ian King Cc: Kirill Tkhai Cc: Qais Yousef Cc: Vasily Averin Signed-off-by: Andrew Morton commit 42b2af2c9b7eede8ef21d0943f84d135e21a32a3 Author: David Hildenbrand Date: Thu Mar 2 18:54:23 2023 +0100 mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage Currently, we'd lose the userfaultfd-wp marker when PTE-mapping a huge zeropage, resulting in the next write faults in the PMD range not triggering uffd-wp events. Various actions (partial MADV_DONTNEED, partial mremap, partial munmap, partial mprotect) could trigger this. However, most importantly, un-protecting a single sub-page from the userfaultfd-wp handler when processing a uffd-wp event will PTE-map the shared huge zeropage and lose the uffd-wp bit for the remainder of the PMD. Let's properly propagate the uffd-wp bit to the PMDs. #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include static size_t pagesize; static int uffd; static volatile bool uffd_triggered; #define barrier() __asm__ __volatile__("": : :"memory") static void uffd_wp_range(char *start, size_t size, bool wp) { struct uffdio_writeprotect uffd_writeprotect; uffd_writeprotect.range.start = (unsigned long) start; uffd_writeprotect.range.len = size; if (wp) { uffd_writeprotect.mode = UFFDIO_WRITEPROTECT_MODE_WP; } else { uffd_writeprotect.mode = 0; } if (ioctl(uffd, UFFDIO_WRITEPROTECT, &uffd_writeprotect)) { fprintf(stderr, "UFFDIO_WRITEPROTECT failed: %d\n", errno); exit(1); } } static void *uffd_thread_fn(void *arg) { static struct uffd_msg msg; ssize_t nread; while (1) { struct pollfd pollfd; int nready; pollfd.fd = uffd; pollfd.events = POLLIN; nready = poll(&pollfd, 1, -1); if (nready == -1) { fprintf(stderr, "poll() failed: %d\n", errno); exit(1); } nread = read(uffd, &msg, sizeof(msg)); if (nread <= 0) continue; if (msg.event != UFFD_EVENT_PAGEFAULT || !(msg.arg.pagefault.flags & UFFD_PAGEFAULT_FLAG_WP)) { printf("FAIL: wrong uffd-wp event fired\n"); exit(1); } /* un-protect the single page. */ uffd_triggered = true; uffd_wp_range((char *)(uintptr_t)msg.arg.pagefault.address, pagesize, false); } return arg; } static int setup_uffd(char *map, size_t size) { struct uffdio_api uffdio_api; struct uffdio_register uffdio_register; pthread_t thread; uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK | UFFD_USER_MODE_ONLY); if (uffd < 0) { fprintf(stderr, "syscall() failed: %d\n", errno); return -errno; } uffdio_api.api = UFFD_API; uffdio_api.features = UFFD_FEATURE_PAGEFAULT_FLAG_WP; if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) { fprintf(stderr, "UFFDIO_API failed: %d\n", errno); return -errno; } if (!(uffdio_api.features & UFFD_FEATURE_PAGEFAULT_FLAG_WP)) { fprintf(stderr, "UFFD_FEATURE_WRITEPROTECT missing\n"); return -ENOSYS; } uffdio_register.range.start = (unsigned long) map; uffdio_register.range.len = size; uffdio_register.mode = UFFDIO_REGISTER_MODE_WP; if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) < 0) { fprintf(stderr, "UFFDIO_REGISTER failed: %d\n", errno); return -errno; } pthread_create(&thread, NULL, uffd_thread_fn, NULL); return 0; } int main(void) { const size_t size = 4 * 1024 * 1024ull; char *map, *cur; pagesize = getpagesize(); map = mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0); if (map == MAP_FAILED) { fprintf(stderr, "mmap() failed\n"); return -errno; } if (madvise(map, size, MADV_HUGEPAGE)) { fprintf(stderr, "MADV_HUGEPAGE failed\n"); return -errno; } if (setup_uffd(map, size)) return 1; /* Read the whole range, populating zeropages. */ madvise(map, size, MADV_POPULATE_READ); /* Write-protect the whole range. */ uffd_wp_range(map, size, true); /* Make sure uffd-wp triggers on each page. */ for (cur = map; cur < map + size; cur += pagesize) { uffd_triggered = false; barrier(); /* Trigger a write fault. */ *cur = 1; barrier(); if (!uffd_triggered) { printf("FAIL: uffd-wp did not trigger\n"); return 1; } } printf("PASS: uffd-wp triggered\n"); return 0; } Link: https://lkml.kernel.org/r/20230302175423.589164-1-david@redhat.com Fixes: e06f1e1dd499 ("userfaultfd: wp: enabled write protection in userfaultfd API") Signed-off-by: David Hildenbrand Acked-by: Peter Xu Cc: Mike Rapoport Cc: Andrea Arcangeli Cc: Jerome Glisse Cc: Shaohua Li Cc: Signed-off-by: Andrew Morton commit 63cf584203f3367c8b073d417c8e5cbbfc450506 Author: James Houghton Date: Thu Mar 2 22:24:04 2023 +0000 mm: teach mincore_hugetlb about pte markers By checking huge_pte_none(), we incorrectly classify PTE markers as "present". Instead, check huge_pte_none_mostly(), classifying PTE markers the same as if the PTE were completely blank. PTE markers, unlike other kinds of swap entries, don't reference any physical page and don't indicate that a physical page was mapped previously. As such, treat them as non-present for the sake of mincore(). Link: https://lkml.kernel.org/r/20230302222404.175303-1-jthoughton@google.com Fixes: 5c041f5d1f23 ("mm: teach core mm about pte markers") Signed-off-by: James Houghton Acked-by: Peter Xu Acked-by: David Hildenbrand Cc: Axel Rasmussen Cc: James Houghton Cc: Signed-off-by: Andrew Morton commit 675dfe1223a69e270b3d52cb0211c8a501455cec Author: Filipe Manana Date: Mon Mar 6 10:13:34 2023 +0000 btrfs: fix block group item corruption after inserting new block group We can often end up inserting a block group item, for a new block group, with a wrong value for the used bytes field. This happens if for the new allocated block group, in the same transaction that created the block group, we have tasks allocating extents from it as well as tasks removing extents from it. For example: 1) Task A creates a metadata block group X; 2) Two extents are allocated from block group X, so its "used" field is updated to 32K, and its "commit_used" field remains as 0; 3) Transaction commit starts, by some task B, and it enters btrfs_start_dirty_block_groups(). There it tries to update the block group item for block group X, which currently has its "used" field with a value of 32K. But that fails since the block group item was not yet inserted, and so on failure update_block_group_item() sets the "commit_used" field of the block group back to 0; 4) The block group item is inserted by task A, when for example btrfs_create_pending_block_groups() is called when releasing its transaction handle. This results in insert_block_group_item() inserting the block group item in the extent tree (or block group tree), with a "used" field having a value of 32K, but without updating the "commit_used" field in the block group, which remains with value of 0; 5) The two extents are freed from block X, so its "used" field changes from 32K to 0; 6) The transaction commit by task B continues, it enters btrfs_write_dirty_block_groups() which calls update_block_group_item() for block group X, and there it decides to skip the block group item update, because "used" has a value of 0 and "commit_used" has a value of 0 too. As a result, we end up with a block item having a 32K "used" field but no extents allocated from it. When this issue happens, a btrfs check reports an error like this: [1/7] checking root items [2/7] checking extents block group [1104150528 1073741824] used 39796736 but extent items used 0 ERROR: errors found in extent allocation tree or chunk allocation (...) Fix this by making insert_block_group_item() update the block group's "commit_used" field. Fixes: 7248e0cebbef ("btrfs: skip update of block group item if used bytes are the same") CC: stable@vger.kernel.org # 6.2+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e33062213ff2f9151e0d125e1c00f524c2b7acfe Author: Sagi Grimberg Date: Fri Mar 3 10:43:23 2023 +0200 docs: sysfs-block: document hidden sysfs entry /sys/block//hidden is undocumented. Document it. Signed-off-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20230303084323.228098-1-sagi@grimberg.me Signed-off-by: Jens Axboe commit 37d9df224d1eec1b434fe9ffa40104c756478c29 Author: Jakub Kicinski Date: Mon Mar 6 12:04:57 2023 -0800 ynl: re-license uniformly under GPL-2.0 OR BSD-3-Clause I was intending to make all the Netlink Spec code BSD-3-Clause to ease the adoption but it appears that: - I fumbled the uAPI and used "GPL WITH uAPI note" there - it gives people pause as they expect GPL in the kernel As suggested by Chuck re-license under dual. This gives us benefit of full BSD freedom while fulfilling the broad "kernel is under GPL" expectations. Link: https://lore.kernel.org/all/20230304120108.05dd44c5@kernel.org/ Link: https://lore.kernel.org/r/20230306200457.3903854-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b1649b0fe98c2c7eed156c957f6f524d5660d859 Author: Stephen Hemminger Date: Mon Mar 6 11:44:05 2023 -0800 mailmap: update entries for Stephen Hemminger Map all my old email addresses to current address. Signed-off-by: Stephen Hemminger Link: https://lore.kernel.org/r/20230306194405.108236-1-stephen@networkplumber.org Signed-off-by: Jakub Kicinski commit e7b15acdc10f74872fdae1482b3f837818362085 Author: Jakub Kicinski Date: Mon Mar 6 11:20:18 2023 -0800 mailmap: add entry for Maxim Mikityanskiy Map Maxim's old corporate addresses to his personal one. Link: https://lore.kernel.org/r/20230306192018.3894988-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7d834b4d1ab66c48e8c0810fdeadaabb80fa2c81 Author: Fedor Pchelkin Date: Tue Mar 7 00:26:50 2023 +0300 nfc: change order inside nfc_se_io error path cb_context should be freed on the error path in nfc_se_io as stated by commit 25ff6f8a5a3b ("nfc: fix memory leak of se_io context in nfc_genl_se_io"). Make the error path in nfc_se_io unwind everything in reverse order, i.e. free the cb_context after unlocking the device. Suggested-by: Krzysztof Kozlowski Signed-off-by: Fedor Pchelkin Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230306212650.230322-1-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit 8f5c5a790e3025d6eca96bf7ee5e3873dc92373f Author: Arnd Bergmann Date: Tue Feb 14 16:25:36 2023 +0100 ethernet: ice: avoid gcc-9 integer overflow warning With older compilers like gcc-9, the calculation of the vlan priority field causes a false-positive warning from the byteswap: In file included from drivers/net/ethernet/intel/ice/ice_tc_lib.c:4: drivers/net/ethernet/intel/ice/ice_tc_lib.c: In function 'ice_parse_cls_flower': include/uapi/linux/swab.h:15:15: error: integer overflow in expression '(int)(short unsigned int)((int)match.key->..vlan_priority << 13) & 57344 & 255' of type 'int' results in '0' [-Werror=overflow] 15 | (((__u16)(x) & (__u16)0x00ffU) << 8) | \ | ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~ include/uapi/linux/swab.h:106:2: note: in expansion of macro '___constant_swab16' 106 | ___constant_swab16(x) : \ | ^~~~~~~~~~~~~~~~~~ include/uapi/linux/byteorder/little_endian.h:42:43: note: in expansion of macro '__swab16' 42 | #define __cpu_to_be16(x) ((__force __be16)__swab16((x))) | ^~~~~~~~ include/linux/byteorder/generic.h:96:21: note: in expansion of macro '__cpu_to_be16' 96 | #define cpu_to_be16 __cpu_to_be16 | ^~~~~~~~~~~~~ drivers/net/ethernet/intel/ice/ice_tc_lib.c:1458:5: note: in expansion of macro 'cpu_to_be16' 1458 | cpu_to_be16((match.key->vlan_priority << | ^~~~~~~~~~~ After a change to be16_encode_bits(), the code becomes more readable to both people and compilers, which avoids the warning. Fixes: 34800178b302 ("ice: Add support for VLAN priority filters in switchdev") Suggested-by: Alexander Lobakin Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Lobakin Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen commit c4a9c8e78aad0fd9b79c9b1e83bab3288a15ce3c Author: Michal Swiatkowski Date: Mon Feb 13 12:27:33 2023 +0100 ice: don't ignore return codes in VSI related code There were few smatch warnings reported by Dan: - ice_vsi_cfg_xdp_txqs can return 0 instead of ret, which is cleaner - return values in ice_vsi_cfg_def were ignored - in ice_vsi_rebuild return value was ignored in case rebuild failed, it was a never reached code, however, rewrite it for clarity. - ice_vsi_cfg_tc can return 0 instead of ret Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Reported-by: Dan Carpenter Signed-off-by: Michal Swiatkowski Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fef3f92e8a4214652d8f33f50330dc5a92efbf11 Author: Dave Ertman Date: Fri Jan 27 14:24:10 2023 +0100 ice: Fix DSCP PFC TLV creation When creating the TLV to send to the FW for configuring DSCP mode PFC,the PFCENABLE field was being masked with a 4 bit mask (0xF), but this is an 8 bit bitmask for enabled classes for PFC. This means that traffic classes 4-7 could not be enabled for PFC. Remove the mask completely, as it is not necessary, as we are assigning 8 bits to an 8 bit field. Fixes: 2a87bd73e50d ("ice: Add DSCP support") Signed-off-by: Dave Ertman Signed-off-by: Karen Ostrowska Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 2d99a7ec25cf456cd3680eb314d6454138e5aa64 Author: Swapnil Patel Date: Wed Mar 1 14:33:33 2023 -0500 drm/amd/display: Update clock table to include highest clock setting [Why] Currently, the clk manager matches SocVoltage with voltage from fused settings (dfPstate clock table). And then corresponding clocks are selected. However in certain situations, this leads to clk manager not including at least one entry with highest supported clock setting. [How] Update the clk manager to include at least one entry with highest supported clock setting. Reviewed-by: Pavle Kotarac Acked-by: Qingqing Zhuo Signed-off-by: Swapnil Patel Signed-off-by: Alex Deucher commit c53899138c99236482a3c25d674f44723336afa3 Author: Candice Li Date: Mon Jan 16 16:23:21 2023 +0800 drm/amd/pm: Enable ecc_info table support for smu v13_0_10 Support EccInfoTable which includes umc ras error count and error address. Signed-off-by: Candice Li Reviewed-by: Evan Quan Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit 06630fb9fcd761254a8d8b53dd6f859b3ecf3707 Author: Candice Li Date: Fri Feb 24 17:26:33 2023 +0800 drm/amdgpu: Support umc node harvest config on umc v8_10 Don't need to query error count and error address on harvest umc nodes. v2: Fix code bug, use active_mask instead of harvsest_config and remove unnecessary argument in LOOP macro. v3: Leave adev->gmc.num_umc unchanged. Signed-off-by: Candice Li Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 7d386975f6a495902e679a3a250a7456d7e54765 Author: Harry Wentland Date: Fri Jan 13 11:24:09 2023 -0500 drm/connector: print max_requested_bpc in state debugfs This is useful to understand the bpc defaults and support of a driver. Signed-off-by: Harry Wentland Cc: Pekka Paalanen Cc: Sebastian Wick Cc: Vitaly.Prosyak@amd.com Cc: Uma Shankar Cc: Ville Syrjälä Cc: Joshua Ashton Cc: Jani Nikula Cc: dri-devel@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Reviewed-By: Joshua Ashton Link: https://patchwork.freedesktop.org/patch/msgid/20230113162428.33874-3-harry.wentland@amd.com Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit e5eef23e267c72521d81f23f7f82d1f523d4a253 Author: Harry Wentland Date: Fri Jan 13 11:24:08 2023 -0500 drm/display: Don't block HDR_OUTPUT_METADATA on unknown EOTF The EDID of an HDR display defines EOTFs that are supported by the display and can be set in the HDR metadata infoframe. Userspace is expected to read the EDID and set an appropriate HDR_OUTPUT_METADATA. In drm_parse_hdr_metadata_block the kernel reads the supported EOTFs from the EDID and stores them in the drm_connector->hdr_sink_metadata. While doing so it also filters the EOTFs to the EOTFs the kernel knows about. When an HDR_OUTPUT_METADATA is set it then checks to make sure the EOTF is a supported EOTF. In cases where the kernel doesn't know about a new EOTF this check will fail, even if the EDID advertises support. Since it is expected that userspace reads the EDID to understand what the display supports it doesn't make sense for DRM to block an HDR_OUTPUT_METADATA if it contains an EOTF the kernel doesn't understand. This comes with the added benefit of future-proofing metadata support. If the spec defines a new EOTF there is no need to update DRM and an compositor can immediately make use of it. Bug: https://gitlab.freedesktop.org/wayland/weston/-/issues/609 v2: Distinguish EOTFs defind in kernel and ones defined in EDID in the commit description (Pekka) v3: Rebase; drm_hdmi_infoframe_set_hdr_metadata moved to drm_hdmi_helper.c Signed-off-by: Harry Wentland Cc: Pekka Paalanen Cc: Sebastian Wick Cc: Vitaly.Prosyak@amd.com Cc: Uma Shankar Cc: Ville Syrjälä Cc: Joshua Ashton Cc: Jani Nikula Cc: dri-devel@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Acked-by: Pekka Paalanen Reviewed-By: Joshua Ashton Link: https://patchwork.freedesktop.org/patch/msgid/20230113162428.33874-2-harry.wentland@amd.com Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit bf89b7ee52af5a5944fa3539e86089f72475055b Author: Conor Dooley Date: Thu Mar 2 17:41:55 2023 +0000 RISC-V: fix taking the text_mutex twice during sifive errata patching Chris pointed out that some bonehead, *cough* me *cough*, added two mutex_locks() to the SiFive errata patching. The second was meant to have been a mutex_unlock(). This results in errors such as Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 Oops [#1] Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-rc1-starlight-00079-g9493e6f3ce02 #229 Hardware name: BeagleV Starlight Beta (DT) epc : __schedule+0x42/0x500 ra : schedule+0x46/0xce epc : ffffffff8065957c ra : ffffffff80659a80 sp : ffffffff81203c80 gp : ffffffff812d50a0 tp : ffffffff8120db40 t0 : ffffffff81203d68 t1 : 0000000000000001 t2 : 4c45203a76637369 s0 : ffffffff81203cf0 s1 : ffffffff8120db40 a0 : 0000000000000000 a1 : ffffffff81213958 a2 : ffffffff81213958 a3 : 0000000000000000 a4 : 0000000000000000 a5 : ffffffff80a1bd00 a6 : 0000000000000000 a7 : 0000000052464e43 s2 : ffffffff8120db41 s3 : ffffffff80a1ad00 s4 : 0000000000000000 s5 : 0000000000000002 s6 : ffffffff81213938 s7 : 0000000000000000 s8 : 0000000000000000 s9 : 0000000000000001 s10: ffffffff812d7204 s11: ffffffff80d3c920 t3 : 0000000000000001 t4 : ffffffff812e6dd7 t5 : ffffffff812e6dd8 t6 : ffffffff81203bb8 status: 0000000200000100 badaddr: 0000000000000030 cause: 000000000000000d [] schedule+0x46/0xce [] schedule_preempt_disabled+0x16/0x28 [] __mutex_lock.constprop.0+0x3fe/0x652 [] __mutex_lock_slowpath+0xe/0x16 [] mutex_lock+0x42/0x4c [] sifive_errata_patch_func+0xf6/0x18c [] _apply_alternatives+0x74/0x76 [] apply_boot_alternatives+0x3c/0xfa [] setup_arch+0x60c/0x640 [] start_kernel+0x8e/0x99c ---[ end trace 0000000000000000 ]--- Reported-by: Chris Hofstaedtler Fixes: 9493e6f3ce02 ("RISC-V: take text_mutex during alternative patching") Signed-off-by: Conor Dooley Tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230302174154.970746-1-conor@kernel.org [Palmer: pick up Geert's bug report from the thread] Signed-off-by: Palmer Dabbelt commit bc463201f60803fa6bf2741d59441031cd0910e4 Author: Johan Hovold Date: Mon Mar 6 08:56:34 2023 +0100 interconnect: qcom: rpm: fix probe child-node error handling Make sure to clean up and release resources properly also in case probe fails when populating child devices. Fixes: e39bf2972c6e ("interconnect: icc-rpm: Support child NoC device probe") Cc: stable@vger.kernel.org # 5.17 Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-7-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 174941ed28a3573db075da46d95b4dcf9d4c49c2 Author: Johan Hovold Date: Mon Mar 6 08:56:33 2023 +0100 interconnect: qcom: osm-l3: fix registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail: of_icc_xlate_onecell: invalid index 0 cpu cpu0: error -EINVAL: error finding src node cpu cpu0: dev_pm_opp_of_find_icc_paths: Unable to get path0: -22 qcom-cpufreq-hw: probe of 18591000.cpufreq failed with error -22 Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: 5bc9900addaf ("interconnect: qcom: Add OSM L3 interconnect provider support") Cc: stable@vger.kernel.org # 5.7 Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230306075651.2449-6-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 9fbd35520f1f7f3cbe1873939a27ad9b009f21f9 Author: Johan Hovold Date: Mon Mar 6 08:56:32 2023 +0100 interconnect: imx: fix registration race The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail. Switch to using the new API where the provider is not registered until after it has been fully initialised. Fixes: f0d8048525d7 ("interconnect: Add imx core driver") Cc: stable@vger.kernel.org # 5.8 Cc: Alexandre Bailon Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Tested-by: Luca Ceresoli # i.MX8MP MSC SM2-MB-EP1 Board Link: https://lore.kernel.org/r/20230306075651.2449-5-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit eb59eca0d8ac15f8c1b7f1cd35999455a90292c0 Author: Johan Hovold Date: Mon Mar 6 08:56:31 2023 +0100 interconnect: fix provider registration API The current interconnect provider interface is inherently racy as providers are expected to be added before being fully initialised. Specifically, nodes are currently not added and the provider data is not initialised until after registering the provider which can cause racing DT lookups to fail. Add a new provider API which will be used to fix up the interconnect drivers. The old API is reimplemented using the new interface and will be removed once all drivers have been fixed. Fixes: 11f1ceca7031 ("interconnect: Add generic on-chip interconnect API") Fixes: 87e3031b6fbd ("interconnect: Allow endpoints translation via DT") Cc: stable@vger.kernel.org # 5.1 Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Tested-by: Luca Ceresoli # i.MX8MP MSC SM2-MB-EP1 Board Link: https://lore.kernel.org/r/20230306075651.2449-4-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit e0e7089bf9a87bc5e3997422e4e24563424f9018 Author: Johan Hovold Date: Mon Mar 6 08:56:30 2023 +0100 interconnect: fix icc_provider_del() error handling The interconnect framework currently expects that providers are only removed when there are no users and after all nodes have been removed. There is currently nothing that guarantees this to be the case and the framework does not do any reference counting, but refusing to remove the provider is never correct as that would leave a dangling pointer to a resource that is about to be released in the global provider list (e.g. accessible through debugfs). Replace the current sanity checks with WARN_ON() so that the provider is always removed. Fixes: 11f1ceca7031 ("interconnect: Add generic on-chip interconnect API") Cc: stable@vger.kernel.org # 5.1: 680f8666baf6: interconnect: Make icc_provider_del() return void Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Tested-by: Luca Ceresoli # i.MX8MP MSC SM2-MB-EP1 Board Link: https://lore.kernel.org/r/20230306075651.2449-3-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit a5904f415e1af72fa8fe6665aa4f554dc2099a95 Author: Johan Hovold Date: Mon Mar 6 08:56:29 2023 +0100 interconnect: fix mem leak when freeing nodes The node link array is allocated when adding links to a node but is not deallocated when nodes are destroyed. Fixes: 11f1ceca7031 ("interconnect: Add generic on-chip interconnect API") Cc: stable@vger.kernel.org # 5.1 Reviewed-by: Konrad Dybcio Signed-off-by: Johan Hovold Tested-by: Luca Ceresoli # i.MX8MP MSC SM2-MB-EP1 Board Link: https://lore.kernel.org/r/20230306075651.2449-2-johan+linaro@kernel.org Signed-off-by: Georgi Djakov commit 63355b9884b3d1677de6bd1517cd2b8a9bf53978 Author: Linus Torvalds Date: Tue Mar 7 12:16:18 2023 -0800 cpumask: be more careful with 'cpumask_setall()' Commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask optimizations") changed cpumask_setall() to use "bitmap_set()" instead of "bitmap_fill()", because bitmap_fill() would explicitly set all the bits of a constant sized small bitmap, and that's exactly what we don't want: we want to only set bits up to 'nr_cpu_ids', which is what "bitmap_set()" does. However, Yury correctly points out that while "bitmap_set()" does indeed only set bits up to the required bitmap size, it doesn't _clear_ bits above that size, so the upper bits would still not have well-defined values. Now, none of this should really matter, since any bits set past 'nr_cpu_ids' should always be ignored in the first place. Yes, the bit scanning functions might return them as a result, but since users should always consider the ">= nr_cpu_ids" condition to mean "no more bits", that shouldn't have any actual effect (see previous commit 8ca09d5fa354 "cpumask: fix incorrect cpumask scanning result checks"). But let's just do it right, the way the code was _intended_ to work. We have had enough lazy code that works but bites us in the *rse later (again, see previous commit) that there's no reason to not just do this properly. It turns out that "bitmap_fill()" gets this all right for the complex case, and really only fails for the inlined optimized case that just fills the whole word. And while we could just fix bitmap_fill() to use the proper last word mask, there's two issues with that: - the cpumask case wants to do the _optimization_ based on "NR_CPUS is a small constant", but then wants to do the actual bit _fill_ based on "nr_cpu_ids" that isn't necessarily that same constant - we have lots of non-cpumask users of bitmap_fill(), and while they hopefully don't care, and probably would want the proper semantics anyway ("only set bits up to the limit"), I do not want the cpumask changes to impact other parts So this ends up just doing the single-word optimization by hand in the cpumask code. If our cpumask is fundamentally limited to a single word, just do the proper "fill in that word" exactly. And if it's the more complex multi-word case, then the generic bitmap_fill() will DTRT. This is all an example of how our bitmap function optimizations really are somewhat broken. They conflate the "this is size of the bitmap" optimizations with the actual bit(s) we want to set. In many cases we really want to have the two be separate things: sometimes we base our optimizations on the size of the whole bitmap ("I know this whole bitmap fits in a single word, so I'll just use single-word accesses"), and sometimes we base them on the bit we are looking at ("this is just acting on bits that are in the first word, so I'll use single-word accesses"). Notice how the end result of the two optimizations are the same, but the way we get to them are quite different. And all our cpumask optimization games are really about that fundamental distinction, and we'd often really want to pass in both the "this is the bit I'm working on" (which _can_ be a small constant but might be variable), and "I know it's in this range even if it's variable" (based on CONFIG_NR_CPUS). So this cpumask_setall() implementation just makes that explicit. It checks the "I statically know the size is small" using the known static size of the cpumask (which is what that 'small_cpumask_bits' is all about), but then sets the actual bits using the exact number of cpus we have (ie 'nr_cpumask_bits') Of course, in a perfect world, the compiler would have done all the range analysis (possibly with help from us just telling it that "this value is always in this range"), and would do all of this for us. But that is not the world we live in. While we dream of that perfect world, this does that manual logic to make it all work out. And this was a very long explanation for a small code change that shouldn't even matter. Reported-by: Yury Norov Link: https://lore.kernel.org/lkml/ZAV9nGG9e1%2FrV+L%2F@yury-laptop/ Signed-off-by: Linus Torvalds commit 87eae260995577d203a70d72d46976521a5687e1 Author: Mike Rapoport (IBM) Date: Fri Feb 24 12:03:06 2023 +0200 docs/mm: hugetlbfs_reserv: fix a reference to a file that doesn't exist kbuild reports: >> Warning: Documentation/mm/hugetlbfs_reserv.rst references a file that doesn't exist: Documentation/mm/hugetlbpage.rst >> Warning: Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst references a file that doesn't exist: Documentation/mm/hugetlbpage.rst Fix the filename to be 'Documentation/admin-guide/mm/hugetlbpage.rst'. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302231854.sKlCmx9K-lkp@intel.com/ Fixes: ee86588960e2 ("docs/mm: remove useless markup") Signed-off-by: Mike Rapoport (IBM) Link: https://lore.kernel.org/r/20230224100306.2287696-2-rppt@kernel.org Signed-off-by: Jonathan Corbet commit 3b80a03d455143cc9135dac86722bbdd079daff3 Author: Mike Rapoport (IBM) Date: Fri Feb 24 12:03:05 2023 +0200 docs/mm: Physical Memory: fix a reference to a file that doesn't exist kbuild reports: >> Warning: Documentation/mm/physical_memory.rst references a file that doesn't exist: Documentation/admin-guide/mm/memory_hotplug.rst Fix the filename to be 'Documentation/admin-guide/mm/memory-hotplug.rst'. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302231311.567PAoS2-lkp@intel.com/ Fixes: 353c7dd636ed ("docs/mm: Physical Memory: remove useless markup") Signed-off-by: Mike Rapoport (IBM) Link: https://lore.kernel.org/r/20230224100306.2287696-1-rppt@kernel.org Signed-off-by: Jonathan Corbet commit a7ee5b426fb66f5eab1790339f1c722060d3d6fc Merge: e45cd86c3a78b 376f79bbf521f Author: Mark Brown Date: Tue Mar 7 17:28:39 2023 +0000 SoC: SOF: Intel: FIx device descriptions (missing Merge series from Peter Ujfalusi : We have recently noticed that the ops_free callback was missed for the device descriptions on Intel platforms. commit 9a9a8fe26751334b7739193a94eba741073b8a55 Author: Thomas Hellström Date: Tue Mar 7 15:46:15 2023 +0100 drm/ttm: Fix a NULL pointer dereference The LRU mechanism may look up a resource in the process of being removed from an object. The locking rules here are a bit unclear but it looks currently like res->bo assignment is protected by the LRU lock, whereas bo->resource is protected by the object lock, while *clearing* of bo->resource is also protected by the LRU lock. This means that if we check that bo->resource points to the LRU resource under the LRU lock we should be safe. So perform that check before deciding to swap out a bo. That avoids dereferencing a NULL bo->resource in ttm_bo_swapout(). Fixes: 6a9b02899402 ("drm/ttm: move the LRU into resource handling v4") Cc: Christian König Cc: Daniel Vetter Cc: Christian Koenig Cc: Huang Rui Cc: Alex Deucher Cc: Felix Kuehling Cc: Philip Yang Cc: Qiang Yu Cc: Matthew Auld Cc: Nirmoy Das Cc: Tvrtko Ursulin Cc: "Thomas Hellström" Cc: Anshuman Gupta Cc: Arunpravin Paneer Selvam Cc: dri-devel@lists.freedesktop.org Cc: # v5.19+ Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20230307144621.10748-2-thomas.hellstrom@linux.intel.com commit a414684e3b735a4114c19295a07e8cb2eb889dae Author: Uwe Kleine-König Date: Tue Feb 28 14:46:57 2023 +0100 docs: rebasing-and-merging: Drop wrong statement about git The "^0" syntax is no longer needed to fast-forward to a mainline commit; take that out and add --ff-only to force an error if fast-forward is not possible. Signed-off-by: Uwe Kleine-König [jc: rewrote changelog] Link: https://lore.kernel.org/r/20230228134657.1797871-1-u.kleine-koenig@pengutronix.de Signed-off-by: Jonathan Corbet commit 0b02076f995332fe1e457da29dd61c3b66c862f7 Author: Miguel Ojeda Date: Mon Mar 6 20:17:12 2023 +0100 docs: programming-language: add Rust programming language section Following the C text in the file, add a mention about the Rust programming language, the currently supported compiler and the edition used (similar to the "dialect" mention for C). Similarly, add a mention about the unstable features used (similar to the "extensions" mentions for C). In addition, add some links to complement the information. Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/r/20230306191712.230658-2-ojeda@kernel.org Signed-off-by: Jonathan Corbet commit 38484a1d0c50596c8080a00c269466f60fa4a051 Author: Miguel Ojeda Date: Mon Mar 6 20:17:11 2023 +0100 docs: programming-language: remove mention of the Intel compiler The Intel compiler support has been removed in commit 95207db8166a ("Remove Intel compiler support"). Thus remove its mention in the Documentation too. Signed-off-by: Miguel Ojeda Reviewed-by: Vincenzo Palazzo Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20230306191712.230658-1-ojeda@kernel.org Signed-off-by: Jonathan Corbet commit 74596085796fae0cfce3e42ee46bf4f8acbdac55 Author: Glenn Washburn Date: Mon Feb 27 12:40:42 2023 -0600 docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate The details for struct dentry_operations member d_weak_revalidate is missing a "d_" prefix. Fixes: af96c1e304f7 ("docs: filesystems: vfs: Convert vfs.txt to RST") Signed-off-by: Glenn Washburn Reviewed-by: Matthew Wilcox (Oracle) Link: https://lore.kernel.org/r/20230227184042.2375235-1-development@efficientek.com Signed-off-by: Jonathan Corbet commit 5d89176af1ae201c01c10a89b68b27cfc683b76c Author: Song Shuai Date: Mon Feb 27 18:59:41 2023 +0800 sched/doc: supplement CPU capacity with RISC-V This commit 7d2078310cbf ("dt-bindings: arm: move cpu-capacity to a shared loation") updates some references about capacity-dmips-mhz property in this document. The list of architectures using capacity-dmips-mhz omits RISC-V, so supplements it here. Signed-off-by: Song Shuai Reviewed-by: Palmer Dabbelt # English Acked-by: Palmer Dabbelt Reviewed-by: Alex Shi Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230227105941.2749193-1-suagrfillet@gmail.com Signed-off-by: Jonathan Corbet commit 78aedee18a86abb0bb8e31d994467c46656e9b5d Author: Dan Johansen Date: Sun Mar 5 11:47:31 2023 +0100 arm64: dts: rockchip: Lower SD card speed on rk3399 Pinebook Pro MicroSD card slot in the Pinebook Pro is located on a separate daughterboard that's connected to the mainboard using a rather long flat cable. The resulting signal degradation causes many perfectly fine microSD cards not to work in the Pinebook Pro, which is a common source of frustration among the owners. Changing the mode and lowering the speed reportedly fixes this issue and makes many microSD cards work as expected. Co-developed-by: Dragan Simic Signed-off-by: Dragan Simic Tested-by: JR Gonzalez Signed-off-by: Dan Johansen Link: https://lore.kernel.org/r/20230305104730.15849-1-strit@manjaro.org Signed-off-by: Heiko Stuebner commit 5912b647bd0732ae8c78a6e5b259c82efd177d93 Author: Dan Johansen Date: Sat Mar 4 17:41:35 2023 +0100 arm64: dts: rockchip: Lower sd speed on rk3566-soquartz Just like the Quartz64 Model B the previously stated speed of sdr-104 in soquartz is too high for the hardware to reliably communicate with some fast SD cards. Especially on some carrierboards. Lower this to sd-uhs-sdr50 to fix this. Fixes: 5859b5a9c3ac ("arm64: dts: rockchip: add SoQuartz CM4IO dts") Signed-off-by: Dan Johansen Acked-by: Peter Geis Link: https://lore.kernel.org/r/20230304164135.28430-1-strit@manjaro.org Signed-off-by: Heiko Stuebner commit c22f2ff8724b49dce2ae797e9fbf4bc0fa91112f Author: Johan Hovold Date: Mon Mar 6 11:32:42 2023 +0100 drm/sun4i: fix missing component unbind on bind errors Make sure to unbind all subcomponents when binding the aggregate device fails. Fixes: 9026e0d122ac ("drm: Add Allwinner A10 Display Engine support") Cc: stable@vger.kernel.org # 4.7 Cc: Maxime Ripard Signed-off-by: Johan Hovold Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230306103242.4775-1-johan+linaro@kernel.org commit fd9a2e1d513823e840960cb3bc26d8b7749d4ac2 Author: Chuck Lever Date: Mon Mar 6 10:43:47 2023 -0500 NFSD: Protect against filesystem freezing Flole observes this WARNING on occasion: [1210423.486503] WARNING: CPU: 8 PID: 1524732 at fs/ext4/ext4_jbd2.c:75 ext4_journal_check_start+0x68/0xb0 Reported-by: Suggested-by: Jan Kara Link: https://bugzilla.kernel.org/show_bug.cgi?id=217123 Fixes: 73da852e3831 ("nfsd: use vfs_iter_read/write") Reviewed-by: Jeff Layton Reviewed-by: Jan Kara Signed-off-by: Chuck Lever commit 382e363d5bed0cec5807b35761d14e55955eee63 Author: Enrico Sau Date: Mon Mar 6 13:05:28 2023 +0100 net: usb: qmi_wwan: add Telit 0x1080 composition Add the following Telit FE990 composition: 0x1080: tty, adb, rmnet, tty, tty, tty, tty Signed-off-by: Enrico Sau Link: https://lore.kernel.org/r/20230306120528.198842-1-enrico.sau@gmail.com Signed-off-by: Paolo Abeni commit 418383e6ed6b4624a54ec05c535f13d184fbf33b Author: Enrico Sau Date: Mon Mar 6 12:59:33 2023 +0100 net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FE990 0x1081 composition in order to avoid bind error. Signed-off-by: Enrico Sau Link: https://lore.kernel.org/r/20230306115933.198259-1-enrico.sau@gmail.com Signed-off-by: Paolo Abeni commit 428913bce1e67ccb4dae317fd0332545bf8c9233 Author: Yu Kuai Date: Tue Mar 7 18:55:52 2023 +0800 block: fix wrong mode for blkdev_put() from disk_scan_partitions() If disk_scan_partitions() is called with 'FMODE_EXCL', blkdev_get_by_dev() will be called without 'FMODE_EXCL', however, follow blkdev_put() is still called with 'FMODE_EXCL', which will cause 'bd_holders' counter to leak. Fix the problem by using the right mode for blkdev_put(). Reported-by: syzbot+2bcc0d79e548c4f62a59@syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/f9649d501bc8c3444769418f6c26263555d9d3be.camel@linux.ibm.com/T/ Tested-by: Julian Ruess Fixes: e5cfefa97bcc ("block: fix scan partition for exclusively open device again") Signed-off-by: Yu Kuai Reviewed-by: Jan Kara Signed-off-by: Jens Axboe commit e45cd86c3a78bfb9875a5eb8ab5dab459b59bbe2 Author: Rander Wang Date: Tue Mar 7 13:06:56 2023 +0200 ASoC: SOF: IPC4: update gain ipc msg definition to align with fw Recent firmware changes modified the curve duration from 32 to 64 bits, which breaks volume ramps. A simple solution would be to change the definition, but unfortunately the ASoC topology framework only supports up to 32 bit tokens. This patch suggests breaking the 64 bit value in low and high parts, with only the low-part extracted from topology and high-part only zeroes. Since the curve duration is represented in hundred of nanoseconds, we can still represent a 400s ramp, which is just fine. The defacto ABI change has no effect on existing users since the IPC4 firmware has not been released just yet. Link: https://github.com/thesofproject/linux/issues/4026 Signed-off-by: Rander Wang Reviewed-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307110656.1816-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c7e328f1cbf22efe23bc3cd7dd6bb14efccc28d0 Author: Pierre-Louis Bossart Date: Tue Mar 7 13:46:59 2023 +0200 ASoC: SOF: sof-audio: don't squelch errors in WIDGET_SETUP phase When an IPC error happens while setting-up a widget during the FE hw_params phase, the existing logic will unwind all previous configurations but will overwrite the return status. The ALSA/ASoC logic will then proceed with the prepare and trigger phases, even though the firmware resources are not available. Fix by returning the initial error code and ignoring the code returned in the UNPREPARE phase. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Chao Song Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307114659.4614-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 8bac40b8ed17ab1be9133e9620f65fae80262b7e Author: Pierre-Louis Bossart Date: Tue Mar 7 11:54:12 2023 +0200 ASoC: SOF: Intel: hda-ctrl: re-add sleep after entering and exiting reset This reverts commit a09d82ce0a867 ("ASoC: SOF: Intel: hda-ctrl: remove useless sleep") It was a mistake to remove those delays, in light of comments in the HDaudio spec captured in snd_hdac_bus_reset_link() that the codec needs time for its initialization and PLL lock. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Rander Wang Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307095412.3416-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 52a55779ed14792a150421339664193d6eb8e036 Author: Rander Wang Date: Tue Mar 7 11:54:52 2023 +0200 ASoC: SOF: Intel: hda-dsp: harden D0i3 programming sequence Add delay between set and wait command according to hardware programming sequence. Also add debug log to detect error. Signed-off-by: Rander Wang Reviewed-by: Péter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307095453.3719-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit c99e48f4ce9b986ab7992ec7283a06dae875f668 Author: Jaska Uimonen Date: Tue Mar 7 13:07:30 2023 +0200 ASoC: SOF: ipc4-topology: set dmic dai index from copier Dmic dai index was set incorrectly to bits 5-7, when it is actually using just the lowest 3. Fix the macro for setting the bits. Fixes: aa84ffb72158 ("ASoC: SOF: ipc4-topology: Add support for SSP/DMIC DAI's") Signed-off-by: Jaska Uimonen Reviewed-by: Adrian Bonislawski Reviewed-by: Péter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307110730.1995-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit b66bfc3a9810caed5d55dd8907110bdc8028b06b Author: Ranjani Sridharan Date: Tue Mar 7 13:46:39 2023 +0200 ASoC: SOF: sof-audio: Fix broken early bclk feature for SSP With the removal of widget setup during BE hw_params, the DAI config IPC is never sent with the SOF_DAI_CONFIG_FLAGS_HW_PARAMS. This means that the early bit clock feature required for certain codecs will be broken. Fix this by saving the config flags sent during BE DAI hw_params and reusing it when the DAI_CONFIG IPC is sent after the DAI widget is set up. Also, free the DAI config before the widget is freed. The DAI_CONFIG IPC sent during the sof_widget_free() does not have the DAI index information. So, save the dai_index in the config during hw_params and reuse it during hw_free. For IPC4, do not clear the node ID during hw_free. It will be needed for freeing the group_ida during unprepare. Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307114639.4553-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ca09e2a351fbc7836ba9418304ff0c3e72addfe0 Author: Pierre-Louis Bossart Date: Tue Mar 7 11:53:41 2023 +0200 ASoC: SOF: Intel: pci-tng: revert invalid bar size setting The logic for the ioremap is to find the resource index 3 (IRAM) and infer the BAR address by subtracting the IRAM offset. The BAR size defined in hardware specifications is 2MB. The commit 5947b2726beb6 ("ASoC: SOF: Intel: Check the bar size before remapping") tried to find the BAR size by querying the resource length instead of a pre-canned value, but by requesting the size for index 3 it only gets the size of the IRAM. That's obviously wrong and prevents the probe from proceeding. This commit attempted to fix an issue in a fuzzing/simulated environment but created another on actual devices, so the best course of action is to revert that change. Reported-by: Ferry Toth Tested-by: Ferry Toth (Intel Edison-Arduino) Link: https://github.com/thesofproject/linux/issues/3901 Signed-off-by: Pierre-Louis Bossart Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307095341.3222-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 6ba8ddf86a3ada463e9952a19b069f978a70a748 Author: Ranjani Sridharan Date: Tue Mar 7 13:48:15 2023 +0200 ASoC: SOF: topology: Fix error handling in sof_widget_ready() Fix the error paths in sof_widget_ready() to free all allocated memory and prevent memory leaks. Signed-off-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307114815.4909-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 858a438a6cf919e5727d2a0f5f3f0e68b2d5354e Author: Pierre-Louis Bossart Date: Tue Mar 7 12:07:33 2023 +0200 ASoC: Intel: soc-acpi: fix copy-paste issue in topology names For some reason the convention for topology names was not followed and the name inspired by another unrelated hardware configuration. As a result, the kernel will request a non-existent topology file. Link: https://github.com/thesofproject/sof/pull/6878 Fixes: 2ec8b081d59f ("ASoC: Intel: soc-acpi: Add entry for sof_es8336 in ADL match table") Cc: stable@vger.kernel.org Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307100733.15025-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 9e269e3aa9006440de639597079ee7140ef5b5f3 Author: Seppo Ingalsuo Date: Tue Mar 7 13:07:51 2023 +0200 ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit This patch fixes the sample rate print unit from KHz to Hz. E.g. 48000KHz becomes 48000Hz. Signed-off-by: Seppo Ingalsuo Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307110751.2053-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 989a3e4479177d0f4afab8be1960731bc0ffbbd0 Author: Peter Ujfalusi Date: Tue Mar 7 13:49:17 2023 +0200 ASoC: SOF: ipc3: Check for upper size limit for the received message The sof_ipc3_rx_msg() checks for minimum size of a new rx message but it is missing the check for upper limit. Corrupted or compromised firmware might be able to take advantage of this to cause out of bounds reads outside of the message area. Reported-by: Curtis Malainey Signed-off-by: Peter Ujfalusi Reviewed-by: Pierre-Louis Bossart Reviewed-by: Curtis Malainey Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307114917.5124-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 376f79bbf521fc37b871b536276319951b5bef3a Author: Ranjani Sridharan Date: Tue Mar 7 11:39:14 2023 +0200 ASOC: SOF: Intel: pci-tgl: Fix device description Add the missing ops_free callback. Fixes: 63d375b9f2a9 ("ASoC: SOF: Intel: pci-tgl: use RPL specific firmware definitions") Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307093914.25409-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 1f320bdb29b644a2c9fb301a6fb2d6170e6417e9 Author: Ranjani Sridharan Date: Tue Mar 7 11:39:13 2023 +0200 ASoC: SOF: Intel: SKL: Fix device description Add missing ops_free callback for SKL/KBL platforms. Fixes: 52d7939d10f2 ("ASoC: SOF: Intel: add ops for SKL/KBL") Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307093914.25409-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 9eb2b4cac223095d2079a6d52b8bbddc6e064288 Author: Ranjani Sridharan Date: Tue Mar 7 11:39:12 2023 +0200 ASoC: SOF: Intel: HDA: Fix device description Add the missing ops_free callback for APL/CNL/CML/JSL/TGL/EHL platforms. Fixes: 1da51943725f ("ASoC: SOF: Intel: hda: init NHLT for IPC4") Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307093914.25409-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit a659e35ca0af2765f567bdfdccfa247eff0cdab8 Author: Ranjani Sridharan Date: Tue Mar 7 11:39:11 2023 +0200 ASoC: SOF: Intel: MTL: Fix the device description Add the missing ops_free callback. Fixes: 064520e8aeaa ("ASoC: SOF: Intel: Add support for MeteorLake (MTL)") Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230307093914.25409-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 1a1e7540cf501dd5c8b57a577a155cdd13c7e202 Author: Hans de Goede Date: Wed Mar 1 11:04:36 2023 +0100 ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 The Lenovo Yoga Book X90 is a x86 tablet which ships with Android x86 as factory OS. The Android x86 kernel fork ignores I2C devices described in the DSDT, except for the PMIC and Audio codecs. As usual the Lenovo Yoga Book X90's DSDT contains a bunch of extra I2C devices which are not actually there, causing various resource conflicts. Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Lenovo Yoga Book X90 to the acpi_quirk_skip_dmi_ids table to woraround this. The DSDT also contains broken ACPI GPIO event handlers, disable those too. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit a5cb0695c5f0ac2ab0cedf2c1c0d75826cb73448 Author: Hans de Goede Date: Wed Mar 1 11:04:35 2023 +0100 ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750 The Acer Iconia One 7 B1-750 is a x86 tablet which ships with Android x86 as factory OS. The Android x86 kernel fork ignores I2C devices described in the DSDT, except for the PMIC and Audio codecs. As usual the Acer Iconia One 7 B1-750's DSDT contains a bunch of extra I2C devices which are not actually there, causing various resource conflicts. Add an ACPI_QUIRK_SKIP_I2C_CLIENTS quirk for the Acer Iconia One 7 B1-750 to the acpi_quirk_skip_dmi_ids table to woraround this. The DSDT also contains broken ACPI GPIO event handlers, disable those too. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 5adc409340b1fc82bc1175e602d14ac82ac685e3 Author: Hans de Goede Date: Wed Mar 1 11:04:34 2023 +0100 ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper x86 ACPI boards which ship with only Android as their factory image usually have pretty broken ACPI tables, relying on everything being hardcoded in the factory kernel image and often disabling parts of the ACPI enumeration kernel code to avoid the broken tables causing issues. Part of this broken ACPI code is that sometimes these boards have _AEI ACPI GPIO event handlers which are broken. So far this has been dealt with in the platform/x86/x86-android-tablets.c module, which contains various workarounds for these devices, by it calling acpi_gpiochip_free_interrupts() on gpiochip-s with troublesome handlers to disable the handlers. But in some cases this is too late, if the handlers are of the edge type then gpiolib-acpi.c's code will already have run them at boot. This can cause issues such as GPIOs ending up as owned by "ACPI:OpRegion", making them unavailable for drivers which actually need them. Boards with these broken ACPI tables are already listed in drivers/acpi/x86/utils.c for e.g. acpi_quirk_skip_i2c_client_enumeration(). Extend the quirks mechanism for a new acpi_quirk_skip_gpio_event_handlers() helper, this re-uses the DMI-ids rather then having to duplicate the same DMI table in gpiolib-acpi.c . Also add the new ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS quirk to existing boards with troublesome ACPI gpio event handlers, so that the current acpi_gpiochip_free_interrupts() hack can be removed from x86-android-tablets.c . Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 89b0411481967a2e8c91190a211a359966cfcf4b Author: Chia-Lin Kao (AceLan) Date: Thu Mar 2 17:33:00 2023 +0800 ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 Sometimes the system boots up with a acpi_video0 backlight interface which doesn't work. So add Dell Vostro 15 3535 into the video_detect_dmi_table to set it to native explicitly. Signed-off-by: Chia-Lin Kao (AceLan) Signed-off-by: Rafael J. Wysocki commit c29b97725c91add5021a3257c14ad1ed32eedf76 Author: Andy Shevchenko Date: Thu Mar 2 18:12:12 2023 +0200 ACPI: docs: enumeration: Correct reference to the I²C device data type I²C peripheral devices that are connected to the controller are represented in the Linux kernel as objects of the struct i2c_client. Fix this in the documentation. Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 6b0313c2fa3d2cf991c9ffef6fae6e7ef592ce6d Author: Shawn Guo Date: Sat Mar 4 15:41:07 2023 +0800 cpuidle: psci: Iterate backwards over list in psci_pd_remove() In case that psci_pd_init_topology() fails for some reason, psci_pd_remove() will be responsible for deleting provider and removing genpd from psci_pd_providers list. There will be a failure when removing the cluster PD, because the cpu (child) PDs haven't been removed. [ 0.050232] CPUidle PSCI: init PM domain cpu0 [ 0.050278] CPUidle PSCI: init PM domain cpu1 [ 0.050329] CPUidle PSCI: init PM domain cpu2 [ 0.050370] CPUidle PSCI: init PM domain cpu3 [ 0.050422] CPUidle PSCI: init PM domain cpu-cluster0 [ 0.050475] PM: genpd_remove: unable to remove cpu-cluster0 [ 0.051412] PM: genpd_remove: removed cpu3 [ 0.051449] PM: genpd_remove: removed cpu2 [ 0.051499] PM: genpd_remove: removed cpu1 [ 0.051546] PM: genpd_remove: removed cpu0 Fix the problem by iterating the provider list reversely, so that parent PD gets removed after child's PDs like below. [ 0.029052] CPUidle PSCI: init PM domain cpu0 [ 0.029076] CPUidle PSCI: init PM domain cpu1 [ 0.029103] CPUidle PSCI: init PM domain cpu2 [ 0.029124] CPUidle PSCI: init PM domain cpu3 [ 0.029151] CPUidle PSCI: init PM domain cpu-cluster0 [ 0.029647] PM: genpd_remove: removed cpu0 [ 0.029666] PM: genpd_remove: removed cpu1 [ 0.029690] PM: genpd_remove: removed cpu2 [ 0.029714] PM: genpd_remove: removed cpu3 [ 0.029738] PM: genpd_remove: removed cpu-cluster0 Fixes: a65a397f2451 ("cpuidle: psci: Add support for PM domains by using genpd") Reviewed-by: Sudeep Holla Reviewed-by: Ulf Hansson Signed-off-by: Shawn Guo Cc: 5.10+ # 5.10+ Signed-off-by: Rafael J. Wysocki commit 775c73df905e4950ca11caabd592fd4b08aa93e2 Merge: 757b56a6c7bba c77737b736ceb Author: Paolo Abeni Date: Tue Mar 7 13:52:03 2023 +0100 Merge branch 'main' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Restore ctnetlink zero mark in events and dump, from Ivan Delalande. 2) Fix deadlock due to missing disabled bh in tproxy, from Florian Westphal. 3) Safer maximum chain load in conntrack, from Eric Dumazet. * 'main' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: conntrack: adopt safer max chain length netfilter: tproxy: fix deadlock due to missing BH disable netfilter: ctnetlink: revert to dumping mark regardless of event type ==================== Link: https://lore.kernel.org/r/20230307100424.2037-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 1a0009abfa7893b9cfcd3884658af1cbee6b26ce Author: Hans de Goede Date: Tue Mar 7 11:58:42 2023 +0100 platform: mellanox: mlx-platform: Initialize shift variable to 0 Initialize shift variable in mlxplat_mlxcpld_verify_bus_topology() to 0 to avoid the following compile error: drivers/platform/x86/mlx-platform.c:6013 mlxplat_mlxcpld_verify_bus_topology() error: uninitialized symbol 'shift'. Fixes: 50b823fdd357 ("platform: mellanox: mlx-platform: Move bus shift assignment out of the loop") Cc: Vadim Pasternak Cc: Michael Shych Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230307105842.286118-1-hdegoede@redhat.com commit e8059d393158e927e36898aca89986a52025b9f3 Author: Daniel Scally Date: Thu Mar 2 10:26:11 2023 +0000 platform/x86: int3472: Add GPIOs to Surface Go 3 Board data Add the INT347E GPIO lookup table to the board data for the Surface Go 3. This is necessary to allow the ov7251 IR camera to probe properly on that platform. Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20230302102611.314341-1-dan.scally@ideasonboard.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 94e9cbda06a317f886f63fab511dedf441c81c54 Author: Srinivas Pandruvada Date: Fri Feb 10 22:32:46 2023 -0800 platform/x86: ISST: Fix kernel documentation warnings Fix warning displayed for "make W=1" for kernel documentation. Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20230211063257.311746-2-srinivas.pandruvada@linux.intel.com Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 7e7e1541c91615e9950d0b96bcd1806d297e970e Author: Randy Dunlap Date: Sat Feb 25 21:39:51 2023 -0800 platform: x86: MLX_PLATFORM: select REGMAP instead of depending on it REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it. Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues. Therefore, change the use of "depends on REGMAP" to "select REGMAP". Fixes: ef0f62264b2a ("platform/x86: mlx-platform: Add physical bus number auto detection") Signed-off-by: Randy Dunlap Cc: Vadim Pasternak Cc: Darren Hart Cc: Hans de Goede Cc: Mark Gross Cc: platform-driver-x86@vger.kernel.org Link: https://lore.kernel.org/r/20230226053953.4681-7-rdunlap@infradead.org Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 03f5eb300ad1241f854269a3e521b119189a4493 Author: Randy Dunlap Date: Sat Feb 25 21:39:50 2023 -0800 platform: mellanox: select REGMAP instead of depending on it REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it. Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues. Therefore, change the use of "depends on REGMAP" to "select REGMAP". For NVSW_SN2201, select REGMAP_I2C instead of depending on it. Fixes: c6acad68eb2d ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface") Fixes: 5ec4a8ace06c ("platform/mellanox: Introduce support for Mellanox register access driver") Fixes: 62f9529b8d5c ("platform/mellanox: mlxreg-lc: Add initial support for Nvidia line card devices") Fixes: 662f24826f95 ("platform/mellanox: Add support for new SN2201 system") Signed-off-by: Randy Dunlap Cc: Darren Hart Cc: Hans de Goede Cc: Michael Shych Cc: Mark Gross Cc: Vadim Pasternak Cc: platform-driver-x86@vger.kernel.org Link: https://lore.kernel.org/r/20230226053953.4681-6-rdunlap@infradead.org Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 6a192c0cbf38a6ba10847590d680975086844dbb Author: Srinivas Pandruvada Date: Mon Feb 27 06:06:14 2023 -0800 platform/x86/intel/tpmi: Fix double free reported by Smatch Fix warning: drivers/platform/x86/intel/tpmi.c:253 tpmi_create_device() warn: 'feature_vsec_dev' was already freed. If there is some error, feature_vsec_dev memory is freed as part of resource managed call intel_vsec_add_aux(). So, additional kfree() call is not required. Reordered res allocation and feature_vsec_dev, so that on error only res is freed. Reported-by: Dan Carpenter Link: https://lore.kernel.org/platform-driver-x86/Y%2FxYR7WGiPayZu%2FR@kili/T/#u Fixes: 47731fd2865f ("platform/x86/intel: Intel TPMI enumeration driver") Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20230227140614.2913474-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 95ecf90158522269749f1b7ce98b1eed66ca087b Author: Srinivas Pandruvada Date: Sun Feb 26 21:35:04 2023 -0800 platform/x86: ISST: Increase range of valid mail box commands A new command CONFIG_TDP_GET_RATIO_INFO is added, with sub command type of 0x0C. The previous range of valid sub commands was from 0x00 to 0x0B. Change the valid range from 0x00 to 0x0C. Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20230227053504.2734214-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 0331b1b0ba65376ecf1c69414aa7696fef0930cb Author: Armin Wolf Date: Sat Feb 18 12:53:18 2023 +0100 platform/x86: dell-ddv: Fix temperature scaling After using the built-in UEFI hardware diagnostics to compare the measured battery temperature, i noticed that the temperature is actually expressed in tenth degree kelvin, similar to the SBS-Data standard. For example, a value of 2992 is displayed as 26 degrees celsius. Fix the scaling so that the correct values are being displayed. Tested on a Dell Inspiron 3505. Fixes: a77272c16041 ("platform/x86: dell: Add new dell-wmi-ddv driver") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230218115318.20662-2-W_Armin@gmx.de Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 001f61c4688f1dad18cfaa35ae364b35fb3cd66c Author: Armin Wolf Date: Sat Feb 18 12:53:17 2023 +0100 platform/x86: dell-ddv: Fix cache invalidation on resume If one or both sensor buffers could not be initialized, either due to missing hardware support or due to some error during probing, the resume handler will encounter undefined behaviour when attempting to lock buffers then protected by an uninitialized or destroyed mutex. Fix this by introducing a "active" flag which is set during probe, and only invalidate buffers which where flaged as "active". Tested on a Dell Inspiron 3505. Fixes: 3b7eeff93d29 ("platform/x86: dell-ddv: Add hwmon support") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230218115318.20662-1-W_Armin@gmx.de Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 24efcdf03d85bb73df0ba99f69c8d238e7ada0e5 Author: Arnd Bergmann Date: Tue Feb 14 16:25:07 2023 +0100 platform/x86/amd: pmc: remove CONFIG_SUSPEND checks The amd_pmc_write_stb() function was previously hidden in an ifdef to avoid a warning when CONFIG_SUSPEND is disabled, but now there is an additional caller: drivers/platform/x86/amd/pmc.c: In function 'amd_pmc_stb_debugfs_open_v2': drivers/platform/x86/amd/pmc.c:256:8: error: implicit declaration of function 'amd_pmc_write_stb'; did you mean 'amd_pmc_read_stb'? [-Werror=implicit-function-declaration] 256 | ret = amd_pmc_write_stb(dev, AMD_PMC_STB_DUMMY_PC); | ^~~~~~~~~~~~~~~~~ | amd_pmc_read_stb There is now an easier way to handle this using DEFINE_SIMPLE_DEV_PM_OPS() to replace all the #ifdefs, letting gcc drop any of the unused functions silently. Fixes: b0d4bb973539 ("platform/x86/amd: pmc: Write dummy postcode into the STB DRAM") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230214152512.806188-1-arnd@kernel.org Signed-off-by: Hans de Goede Reviewed-by: Hans de Goede commit 02c84f91adb9a64b75ec97d772675c02a3e65ed7 Author: Jianqun Xu Date: Wed Feb 8 17:14:11 2023 +0800 ARM: dts: rockchip: fix a typo error for rk3288 spdif node Fix the address in the spdif node name. Fixes: 874e568e500a ("ARM: dts: rockchip: Add SPDIF transceiver for RK3288") Signed-off-by: Jianqun Xu Reviewed-by: Sjoerd Simons Link: https://lore.kernel.org/r/20230208091411.1603142-1-jay.xu@rock-chips.com Signed-off-by: Heiko Stuebner commit 0643bedf921efd88df73847fb0bb31f9f8692ce0 Author: Rob Herring Date: Tue Feb 7 17:47:49 2023 -0600 arm64: dts: rockchip: Fix rk3399 GICv3 ITS node name The GICv3 ITS is an MSI controller, therefore its node name should be 'msi-controller'. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230207234750.202154-1-robh@kernel.org Signed-off-by: Heiko Stuebner commit c77737b736ceb50fdf150434347dbd81ec76dbb1 Author: Eric Dumazet Date: Tue Mar 7 05:22:54 2023 +0000 netfilter: conntrack: adopt safer max chain length Customers using GKE 1.25 and 1.26 are facing conntrack issues root caused to commit c9c3b6811f74 ("netfilter: conntrack: make max chain length random"). Even if we assume Uniform Hashing, a bucket often reachs 8 chained items while the load factor of the hash table is smaller than 0.5 With a limit of 16, we reach load factors of 3. With a limit of 32, we reach load factors of 11. With a limit of 40, we reach load factors of 15. With a limit of 50, we reach load factors of 24. This patch changes MIN_CHAINLEN to 50, to minimize risks. Ideally, we could in the future add a cushion based on expected load factor (2 * nf_conntrack_max / nf_conntrack_buckets), because some setups might expect unusual values. Fixes: c9c3b6811f74 ("netfilter: conntrack: make max chain length random") Signed-off-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso commit 849ad04cf562ac63b0371a825eed473d84de9c6d Author: Al Viro Date: Tue Mar 7 01:50:53 2023 -0500 new helper: put_and_unmap_page() kunmap_local() + put_page(), as done by e.g. ext2 directory handling. Signed-off-by: Al Viro commit 757b56a6c7bbaed0d005b60b3996ee5a04cf2d8d Merge: e539a105f947b 32dfc59e43019 Author: Jakub Kicinski Date: Mon Mar 6 20:28:00 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-03-06 We've added 8 non-merge commits during the last 7 day(s) which contain a total of 9 files changed, 64 insertions(+), 18 deletions(-). The main changes are: 1) Fix BTF resolver for DATASEC sections when a VAR points at a modifier, that is, keep resolving such instances instead of bailing out, from Lorenz Bauer. 2) Fix BPF test framework with regards to xdp_frame info misplacement in the "live packet" code, from Alexander Lobakin. 3) Fix an infinite loop in BPF sockmap code for TCP/UDP/AF_UNIX, from Liu Jian. 4) Fix a build error for riscv BPF JIT under PERF_EVENTS=n, from Randy Dunlap. 5) Several BPF doc fixes with either broken links or external instead of internal doc links, from Bagas Sanjaya. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: check that modifier resolves after pointer btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES bpf, doc: Link to submitting-patches.rst for general patch submission info bpf, doc: Do not link to docs.kernel.org for kselftest link bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() riscv, bpf: Fix patch_text implicit declaration bpf, docs: Fix link to BTF doc ==================== Link: https://lore.kernel.org/r/20230306215944.11981-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 8a63441e83724fee1ef3fd37b237d40d90780766 Author: Krishna chaitanya chundru Date: Tue Feb 28 17:19:12 2023 +0530 arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent If the controller is not marked as cache coherent, then kernel will try to ensure coherency during dma-ops and that may cause data corruption. So, mark the PCIe node as dma-coherent as the devices on PCIe bus are cache coherent. Cc: stable@vger.kernel.org Fixes: 92e0ee9f83b3 ("arm64: dts: qcom: sc7280: Add PCIe and PHY related node") Signed-off-by: Krishna chaitanya chundru Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1677584952-17496-1-git-send-email-quic_krichai@quicinc.com commit eaba416688f4f074ea3bf2ef975c9e2dbb06712b Author: Yang Xiwen Date: Wed Mar 1 16:53:50 2023 +0800 arm64: dts: qcom: msm8916-ufi: Fix sim card selection pinctrl The previous commit mistakenly introduced sim_ctrl_default as pinctrl, this is incorrect, the interface for sim card selection varies between different devices and should not be placed in the dtsi. This commit selects external SIM card slot for ufi001c as default. uf896 selects the correct SIM card slot automatically, thus does not need this pinctrl node. Fixes: faf69431464b ("arm64: dts: qcom: msm8916-thwc: Add initial device trees") Signed-off-by: Yang Xiwen Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/tencent_7036BCA256055D05F8C49D86DF7F0E2D1A05@qq.com commit 749d56bd5cf311dd9b50cfc092d7a39309454077 Author: Luca Weiss Date: Sun Mar 5 11:32:34 2023 +0100 soc: qcom: rmtfs: handle optional qcom,vmid correctly Older platforms don't have qcom,vmid set, handle -EINVAL return value correctly. And since num_vmids is passed to of_property_read_u32_array later we should make sure it has a sane value before continuing. Fixes: e656cd0bcf3d ("soc: qcom: rmtfs: Optionally map RMTFS to more VMs") Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230305-rmtfs-vmid-fix-v1-2-6a7206081602@z3ntu.xyz commit 947007419b60d5e06aa54b0f411c123db7f45a44 Author: Luca Weiss Date: Sun Mar 5 11:32:33 2023 +0100 soc: qcom: rmtfs: fix error handling reading qcom,vmid of_property_count_u32_elems returns a negative integer when an error happens , but since the value was assigned to an unsigned integer, the check never worked correctly. Also print the correct variable in the error print, ret isn't used here. Fixes: e656cd0bcf3d ("soc: qcom: rmtfs: Optionally map RMTFS to more VMs") Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230305-rmtfs-vmid-fix-v1-1-6a7206081602@z3ntu.xyz commit 77bf4b3ed42e31d29b255fcd6530fb7a1e217e89 Author: Abel Vesa Date: Mon Mar 6 15:55:27 2023 +0200 soc: qcom: llcc: Fix slice configuration values for SC8280XP The slice IDs for CVPFW, CPUSS1 and CPUWHT currently overflow the 32bit LLCC config registers, which means it is writing beyond the upper limit of the ATTR0_CFGn and ATTR1_CFGn range of registers. But the most obvious impact is the fact that the mentioned slices do not get configured at all, which will result in reduced performance. Fix that by using the slice ID values taken from the latest LLCC SC table. Fixes: ec69dfbdc426 ("soc: qcom: llcc: Add sc8180x and sc8280xp configurations") Cc: stable@vger.kernel.org # 5.19+ Signed-off-by: Abel Vesa Tested-by: Juerg Haefliger Reviewed-by: Sai Prakash Ranjan Acked-by: Konrad Dybcio Reviewed-by: Johan Hovold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230306135527.509796-1-abel.vesa@linaro.org commit ced0f245ed951e2b8bd68f79c15238d7dd253662 Author: Arnd Bergmann Date: Mon Mar 6 11:14:50 2023 +0100 kallsyms: add kallsyms_seqs_of_names to list of special symbols My randconfig build setup ran into another kallsyms warning: Inconsistent kallsyms data Try make KALLSYMS_EXTRA_PASS=1 as a workaround After adding some debugging code to kallsyms.c, I saw that the recently added kallsyms_seqs_of_names symbol can sometimes cause the second stage table to be slightly longer than the first stage, which makes the build inconsistent. Add it to the exception table that contains all other kallsyms-generated symbols. Fixes: 60443c88f3a8 ("kallsyms: Improve the performance of kallsyms_lookup_name()") Signed-off-by: Arnd Bergmann Reviewed-by: Zhen Lei Signed-off-by: Masahiro Yamada commit c64c67c0748be5afb769a4eedbeb3ce6de36958f Author: Al Viro Date: Mon Mar 6 19:58:56 2023 -0500 alpha: fix lazy-FPU mis(merged/applied/whatnot) Looks like a braino that used to be fixed in e.g. #next.alpha had gotten into alpha.git cherry-picked version of that patch. Sure, alpha has no preempt, but preempt_enable() in place of preempt_disable() is actively confusing the readers... Other than that, the cherry-picked variant matches what I have. Signed-off-by: Al Viro commit 2da789cda462bda93679f53ee38f9aa2309d47e8 Author: Guillaume Tucker Date: Sat Feb 4 14:34:54 2023 +0100 selftests: amd-pstate: fix TEST_FILES Bring back the Python scripts that were initially added with TEST_GEN_FILES but now with TEST_FILES to avoid having them deleted when doing a clean. Also fix the way the architecture is being determined as they should also be installed when ARCH=x86_64 is provided explicitly. Then also append extra files to TEST_FILES and TEST_PROGS with += so they don't get discarded. Fixes: ba2d788aa873 ("selftests: amd-pstate: Trigger tbench benchmark and test cpus") Fixes: a49fb7218ed8 ("selftests: amd-pstate: Don't delete source files via Makefile") Signed-off-by: Guillaume Tucker Acked-by: Huang Rui Signed-off-by: Shuah Khan commit e18048da9bc3f87acef4eb67a11b4fc55fe15424 Author: Palmer Dabbelt Date: Thu Feb 23 14:46:05 2023 -0800 RISC-V: Stop emitting attributes The RISC-V ELF attributes don't contain any useful information. New toolchains ignore them, but they frequently trip up various older/mixed toolchains. So just turn them off. Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230223224605.6995-1-palmer@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 6906598f1ce93761716d780b6e3f171e13f0f4ce Author: Jonathan Neuschäfer Date: Sun Jan 29 14:14:36 2023 +0100 zstd: Fix definition of assert() assert(x) should emit a warning if x is false. WARN_ON(x) emits a warning if x is true. Thus, assert(x) should be defined as WARN_ON(!x) rather than WARN_ON(x). Signed-off-by: Jonathan Neuschäfer Signed-off-by: Nick Terrell commit 038505c41f0aad26ef101f4f7f6e111531c3914f Author: Nick Terrell Date: Wed Feb 15 15:19:17 2023 -0800 lib: zstd: Backport fix for in-place decompression Backport the relevant part of upstream commit 5b266196 [0]. This fixes in-place decompression for x86-64 kernel decompression. It uses a bound of 131072 + (uncompressed_size >> 8), which can be violated after upstream commit 6a7ede3d [1], as zstd can use part of the output buffer as temporary storage, and without this patch needs a bound of ~262144. The fix is for zstd to detect that the input and output buffers overlap, so that zstd knows it can't use the overlapping portion of the output buffer as tempoary storage. If the margin is not large enough, this will ensure that zstd will fail the decompression, rather than overwriting part of the input data, and causing corruption. This fix has been landed upstream and is in release v1.5.4. That commit also adds unit and fuzz tests to verify that the margin we use is respected, and correct. That means that the fix is well tested upstream. I have not been able to reproduce the potential bug in x86-64 kernel decompression locally, nor have I recieved reports of failures to decompress the kernel. It is possible that compression saves enough space to make it very hard for the issue to appear. I've boot tested the zstd compressed kernel on x86-64 and i386 with this patch, which uses in-place decompression, and sanity tested zstd compression in btrfs / squashfs to make sure that we don't see any issues, but other uses of zstd shouldn't be affected, because they don't use in-place decompression. Thanks to Vasily Gorbik for debugging a related issue on s390, which was triggered by the same commit, but was a bug in how __decompress() was called [2]. And to Sasha Levin for the CC alerting me of the issue. [0] https://github.com/facebook/zstd/commit/5b266196a41e6a15e21bd4f0eeab43b938db1d90 [1] https://github.com/facebook/zstd/commit/6a7ede3dfccbf3e0a5928b4224a039c260dcff72 [2] https://lore.kernel.org/r/patch-1.thread-41c676.git-41c676c2d153.your-ad-here.call-01675030179-ext-9637@work.hours CC: Vasily Gorbik CC: Heiko Carstens CC: Sasha Levin CC: Yann Collet Signed-off-by: Nick Terrell commit 780f6a9afe8b0e303406a39f6968cf1daa6c3d51 Author: Kees Cook Date: Wed Jan 4 13:20:52 2023 -0800 lib: zstd: Fix -Wstringop-overflow warning Fix the following -Wstringop-overflow warning when building with GCC 11+: lib/zstd/decompress/huf_decompress.c: In function ‘HUF_readDTableX2_wksp’: lib/zstd/decompress/huf_decompress.c:700:5: warning: ‘HUF_fillDTableX2.constprop’ accessing 624 bytes in a region of size 52 [-Wstringop-overflow=] 700 | HUF_fillDTableX2(dt, maxTableLog, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 701 | wksp->sortedSymbol, sizeOfSort, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 702 | wksp->rankStart0, wksp->rankVal, maxW, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 703 | tableLog+1, | ~~~~~~~~~~~ 704 | wksp->calleeWksp, sizeof(wksp->calleeWksp) / sizeof(U32)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/zstd/decompress/huf_decompress.c:700:5: note: referencing argument 6 of type ‘U32 (*)[13]’ {aka ‘unsigned int (*)[13]’} lib/zstd/decompress/huf_decompress.c:571:13: note: in a call to function ‘HUF_fillDTableX2.constprop’ 571 | static void HUF_fillDTableX2(HUF_DEltX2* DTable, const U32 targetLog, | ^~~~~~~~~~~~~~~~ by using pointer notation instead of array notation. This is one of the last remaining warnings to be fixed before globally enabling -Wstringop-overflow. Co-developed-by: Gustavo A. R. Silva Signed-off-by: Gustavo A. R. Silva Cc: Nick Terrell Signed-off-by: Kees Cook Signed-off-by: Nick Terrell commit 288b3271d920c9ba949c3bab0f749f4cecc70e09 Author: Shin'ichiro Kawasaki Date: Mon Mar 6 15:30:24 2023 +0900 scsi: sd: Fix wrong zone_write_granularity value during revalidate When the sd driver revalidates host-managed SMR disks, it calls disk_set_zoned() which changes the zone_write_granularity attribute value to the logical block size regardless of the device type. After that, the sd driver overwrites the value in sd_zbc_read_zone() with the physical block size, since ZBC/ZAC requires this for host-managed disks. Between the calls to disk_set_zoned() and sd_zbc_read_zone(), there exists a window where the attribute shows the logical block size as the zone_write_granularity value, which is wrong for host-managed disks. The duration of the window is from 20ms to 200ms, depending on report zone command execution time. To avoid the wrong zone_write_granularity value between disk_set_zoned() and sd_zbc_read_zone(), modify the value not in sd_zbc_read_zone() but just after disk_set_zoned() call. Fixes: a805a4fa4fa3 ("block: introduce zone_write_granularity limit") Signed-off-by: Shin'ichiro Kawasaki Link: https://lore.kernel.org/r/20230306063024.3376959-1-shinichiro.kawasaki@wdc.com Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e Author: Michael Kelley Date: Mon Feb 27 08:48:34 2023 -0800 scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a virtual disk. The VHD/VHDX file format is a sparse format where real disk space on the host is assigned in chunks that the VHD/VHDX file format calls the BlockSize. This BlockSize is not to be confused with the 512-byte (or 4096-byte) sector size of the underlying storage device. The default block size for a new VHD/VHDX file is 32 Mbytes. When a guest VM touches any disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates 32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly, if a discard operation is done that covers an entire 32 Mbyte chunk, Hyper-V will free the real disk space for that portion of the VHD/VHDX. This BlockSize is surfaced in Linux as the "discard_granularity" in /sys/block/sd/queue, which makes sense. Hyper-V also has differencing disks that can overlay a VHD/VHDX file to capture changes to the VHD/VHDX while preserving the original VHD/VHDX. One example of this differencing functionality is for VM snapshots. When a snapshot is created, a differencing disk is created. If the snapshot is rolled back, Hyper-V can just delete the differencing disk, and the VM will see the original disk contents at the time the snapshot was taken. Differencing disks are used in other scenarios as well. The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes. The smaller default is used because changes to differencing disks are typically scattered all over, and Hyper-V doesn't want to allocate 32 Mbytes of real disk space for a stray write here or there. The smaller BlockSize provides more efficient use of real disk space. When a differencing disk is added to a VHD/VHDX, Hyper-V reports UNIT_ATTENTION with a sense code indicating "Operating parameters have changed", because the value of discard_granularity should be changed to 2 Mbytes. When the differencing disk is removed, discard_granularity should be changed back to 32 Mbytes. However, current code simply reports a message from scsi_report_sense() and the value of /sys/block/sd/queue/discard_granularity is not updated. The message isn't very actionable by a sysadmin. Fix this by having the storvsc driver check for the sense code indicating that the underly VHD/VHDX block size has changed, and do a rescan of the device to pick up the new discard_granularity. With this change the entire transition to/from differencing disks is handled automatically and transparently, with no confusing messages being output. Link: https://lore.kernel.org/r/1677516514-86060-1-git-send-email-mikelley@microsoft.com Signed-off-by: Michael Kelley Signed-off-by: Martin K. Petersen commit a2033f9f9d785972513bca207ed4a48bffc75f8f Author: Chandrakanth Patil Date: Thu Mar 2 16:23:42 2023 +0530 scsi: megaraid_sas: Driver version update to 07.725.01.00-rc1 Update driver version. Signed-off-by: Chandrakanth Patil Link: https://lore.kernel.org/r/20230302105342.34933-4-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 9bcb1d5a3d10f4d15da2174f8eaec942602f681f Author: Chandrakanth Patil Date: Thu Mar 2 16:23:41 2023 +0530 scsi: megaraid_sas: Add crash dump mode capability bit in MFI capabilities In kdump kernel mode, the driver works in reduced functionality mode with some features disabled such as reduced MSI-X count and RDPQ disabled, etc. However, the firmware is not aware of this mode in some cases, which results in undefined behavior. To address this, the driver informs the firmware about the kdump mode through MPI capabilities bit during driver initialization. This allows firmware to adjust its behavior accordingly. Signed-off-by: Chandrakanth Patil Signed-off-by: Sumit Saxena Link: https://lore.kernel.org/r/20230302105342.34933-3-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit bfa659177dcba48cf13f2bd88c1972f12a60bf1c Author: Chandrakanth Patil Date: Thu Mar 2 16:23:40 2023 +0530 scsi: megaraid_sas: Update max supported LD IDs to 240 The firmware only supports Logical Disk IDs up to 240 and LD ID 255 (0xFF) is reserved for deleted LDs. However, in some cases, firmware was assigning LD ID 254 (0xFE) to deleted LDs and this was causing the driver to mark the wrong disk as deleted. This in turn caused the wrong disk device to be taken offline by the SCSI midlayer. To address this issue, limit the LD ID range from 255 to 240. This ensures the deleted LD ID is properly identified and removed by the driver without accidently deleting any valid LDs. Fixes: ae6874ba4b43 ("scsi: megaraid_sas: Early detection of VD deletion through RaidMap update") Reported-by: Martin K. Petersen Signed-off-by: Chandrakanth Patil Signed-off-by: Sumit Saxena Link: https://lore.kernel.org/r/20230302105342.34933-2-chandrakanth.patil@broadcom.com Signed-off-by: Martin K. Petersen commit 8e45183978d64699df639e795235433a60f35047 Author: Ranjan Kumar Date: Tue Feb 28 06:08:35 2023 -0800 scsi: mpi3mr: Bad drive in topology results kernel crash When the SAS Transport Layer support is enabled and a device exposed to the OS by the driver fails INQUIRY commands, the driver frees up the memory allocated for an internal HBA port data structure. However, in some places, the reference to the freed memory is not cleared. When the firmware sends the Device Info change event for the same device again, the freed memory is accessed and that leads to memory corruption and OS crash. Signed-off-by: Ranjan Kumar Signed-off-by: Sreekanth Reddy Link: https://lore.kernel.org/r/20230228140835.4075-7-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 4f297e856a7b5da2f2c66a12e739666e23943560 Author: Ranjan Kumar Date: Tue Feb 28 06:08:34 2023 -0800 scsi: mpi3mr: NVMe command size greater than 8K fails A wrong variable is checked while populating PRP entries in the PRP page and this results in failure. No PRP entries in the PRP page were successfully created and any NVMe Encapsulated commands with PRP of size greater than 8K failed. Signed-off-by: Ranjan Kumar Signed-off-by: Sreekanth Reddy Link: https://lore.kernel.org/r/20230228140835.4075-6-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit ba8a9ba41fbde250fd8b0ed1e5dad0dc9318df46 Author: Ranjan Kumar Date: Tue Feb 28 06:08:33 2023 -0800 scsi: mpi3mr: Return proper values for failures in firmware init path Return proper non-zero return values for all the cases when the controller initialization and re-initialization fails. Signed-off-by: Ranjan Kumar Signed-off-by: Sreekanth Reddy Link: https://lore.kernel.org/r/20230228140835.4075-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 0a319f1629495d27879b7ebf6eee62b8cf6e4c37 Author: Ranjan Kumar Date: Tue Feb 28 06:08:32 2023 -0800 scsi: mpi3mr: Wait for diagnostic save during controller init If a controller reset operation is triggered to recover the controller from a fault state, then wait for the snapdump to be saved in the firmware region before proceeding to reset the controller. Signed-off-by: Ranjan Kumar Signed-off-by: Sreekanth Reddy Link: https://lore.kernel.org/r/20230228140835.4075-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 5b06a7169c59ce0c77ef8b9c82aa07c478f82aac Author: Ranjan Kumar Date: Tue Feb 28 06:08:31 2023 -0800 scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled Prevent driver from trying to dereference a NULL pointer in a debug print while removing a device during driver unload. Signed-off-by: Ranjan Kumar Signed-off-by: Sreekanth Reddy Link: https://lore.kernel.org/r/20230228140835.4075-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 02ca7da2919ada525fb424640205110e24646b50 Author: Ranjan Kumar Date: Tue Feb 28 06:08:30 2023 -0800 scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt As part of Task Management handling, the driver will disable and enable the MSIx index zero which belongs to the Admin reply queue. During this transition the driver loses some interrupts and this leads to Admin request and ioctl timeouts. After enabling the interrupts, poll the Admin reply queue to avoid timeouts. Signed-off-by: Ranjan Kumar Signed-off-by: Sreekanth Reddy Link: https://lore.kernel.org/r/20230228140835.4075-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e Author: Jakob Koschel Date: Wed Mar 1 18:19:14 2023 +0100 scsi: lpfc: Avoid usage of list iterator variable after loop If the &epd_pool->list is empty when executing lpfc_get_io_buf_from_expedite_pool() the function would return an invalid pointer. Even in the case if the list is guaranteed to be populated, the iterator variable should not be used after the loop to be more robust for future changes. Linus proposed to avoid any use of the list iterator variable after the loop, in the attempt to move the list iterator variable declaration into the macro to avoid any potential misuse after the loop [1]. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Signed-off-by: Jakob Koschel Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@gmail.com Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit 312320b0e0ec21249a17645683fe5304d796aec1 Author: Justin Tee Date: Mon Feb 27 20:43:36 2023 -0800 scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() If kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on lpfc_read_object()'s routine to NULL check pdata. Currently, an early return error is thrown from lpfc_read_object() to protect us from NULL ptr dereference, but the errno code is -ENODEV. Change the errno code to a more appropriate -ENOMEM. Reported-by: Kang Chen Link: https://lore.kernel.org/all/20230226102338.3362585-1-void0red@gmail.com Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20230228044336.5195-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit c9507eab9fa7af7ab4c80856eeafd1481ff16f7c Author: Asutosh Das Date: Wed Mar 1 17:42:56 2023 -0800 scsi: ufs: mcq: qcom: Clean the return path of ufs_qcom_mcq_config_resource() Smatch static checker reported: drivers/ufs/host/ufs-qcom.c:1469 ufs_qcom_mcq_config_resource() info: returning a literal zero is cleaner Fix the above warning by returning in place instead of a jump to a label. Also remove the usage of devm_kfree() as it's unnecessary in this function. Fixes: c263b4ef737e ("scsi: ufs: core: mcq: Configure resource regions") Reported-by: Dan Carpenter Signed-off-by: Asutosh Das Link: https://lore.kernel.org/r/3ebd2582af74b81ef7b57149f57c6a3bf0963953.1677721229.git.quic_asutoshd@quicinc.com Reviewed-by: Bjorn Andersson Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen commit c8be073bd2bced20f58e65276281fc116758c7cb Author: Asutosh Das Date: Wed Mar 1 17:41:06 2023 -0800 scsi: ufs: mcq: qcom: Fix passing zero to PTR_ERR Fix an error case in ufs_qcom_mcq_config_resource(), where the return value is set to 0 before passing it to PTR_ERR. This led to Smatch warning: drivers/ufs/host/ufs-qcom.c:1455 ufs_qcom_mcq_config_resource() warn: passing zero to 'PTR_ERR' Fixes: c263b4ef737e ("scsi: ufs: core: mcq: Configure resource regions") Reported-by: Dan Carpenter Signed-off-by: Asutosh Das Link: https://lore.kernel.org/r/94ca99b327af634799ce5f25d0112c28cd00970d.1677721072.git.quic_asutoshd@quicinc.com Reviewed-by: Bjorn Andersson Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen commit fa8d32721a07d1349d963832400e97ebb515aa96 Author: Dan Carpenter Date: Mon Feb 27 13:07:26 2023 +0300 scsi: ufs: ufs-qcom: Remove impossible check The "dev_req_params" pointer points to inside the middle of a struct so it can't be NULL. Removing this impossible condition is nice because now we don't need to consider the correct error code for that situation. Link: https://lore.kernel.org/r/Y/yA3niWUcGYgBU8@kili Fixes: f06fcc7155dc ("scsi: ufs-qcom: add QUniPro hardware support and power optimizations") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen commit 2ebe16155dc8bd4e602cad5b5f65458d2eaa1a75 Author: Adrien Thierry Date: Mon Feb 20 09:07:40 2023 -0500 scsi: ufs: core: Add soft dependency on governor_simpleondemand The ufshcd driver uses simpleondemand governor for devfreq. Add it to the list of ufshcd softdeps to allow userspace initramfs tools like dracut to automatically pull the governor module into the initramfs together with UFS drivers. Link: https://lore.kernel.org/r/20230220140740.14379-1-athierry@redhat.com Signed-off-by: Adrien Thierry Signed-off-by: Martin K. Petersen commit 06d1a90de60208054cca15ef200138cfdbb642a9 Author: Kang Chen Date: Mon Feb 27 11:10:30 2023 +0800 scsi: hisi_sas: Check devm_add_action() return value In case devm_add_action() fails, check it in the caller of interrupt_preinit_v3_hw(). Link: https://lore.kernel.org/r/20230227031030.893324-1-void0red@gmail.com Signed-off-by: Kang Chen Acked-by: Xiang Chen Signed-off-by: Martin K. Petersen commit 052750a4444577e6067bdf73dd5ff92876f59ef6 Author: Jianhua Lu Date: Tue Feb 21 20:36:33 2023 +0800 arm64: dts: qcom: sm8250-xiaomi-elish: Correct venus firmware path Missing vendor name for venus firmware path. Add it. Fixes: a41b617530bf ("arm64: dts: qcom: sm8250: Add device tree for Xiaomi Mi Pad 5 Pro") Signed-off-by: Jianhua Lu Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230221123633.25145-1-lujianhua000@gmail.com commit 27072f2ffb29283b9a44d878204c86c08d86b37f Author: Konrad Dybcio Date: Thu Feb 16 12:08:03 2023 +0100 arm64: dts: qcom: sm8550: Use correct CPU compatibles Use the correct compatibles for the four kinds of CPU cores used on SM8550, based on the value of their MIDR_EL1 registers: CPU7: 0x411fd4e0 - CX3 r1p1 CPU5-6: 0x412fd470 - CA710 r?p? CPU3-4: 0x411fd4d0 - CA715 r?p? CPU0-2: 0x411fd461 - CA510 r?p? Signed-off-by: Konrad Dybcio Acked-by: Rob Herring Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230216110803.3945747-2-konrad.dybcio@linaro.org commit 4059297ed0a5adf8e5fd0bd734d702a24202c02e Author: Abel Vesa Date: Thu Feb 9 09:45:10 2023 +0200 arm64: dts: qcom: sm8550: Add bias pull up value to tlmm i2c data clk states The default bias pull up value for the tlmm i2c data clk states is 2.2kOhms. Add this value to make sure the driver factors in the i2c pull up bit when writing the config register. Signed-off-by: Abel Vesa Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209074510.4153294-2-abel.vesa@linaro.org commit 11d5e41f5e129e39bddedc7244a0946a802d2e8e Author: Konrad Dybcio Date: Mon Jan 9 14:56:47 2023 +0100 arm64: dts: qcom: sm6375: Add missing power-domain-named to CDSP This was omitted when first introducing the node. Fix it. Fixes: fe6fd26aeddf ("arm64: dts: qcom: sm6375: Add ADSP&CDSP") Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230109135647.339224-5-konrad.dybcio@linaro.org commit 205c91fb6aca5f8bad5346181575a7ef78e43cea Author: Konrad Dybcio Date: Thu Feb 16 13:49:21 2023 +0100 arm64: dts: qcom: sm6115: Un-enable SPI5 by default The commit mentioned in the fixes tag erroneously enabled SPI5 unconditionally. Undo it. Fixes: 25aab0b852d6 ("arm64: dts: qcom: sm6115: Add geni debug uart node for qup0") Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230216124921.3985834-1-konrad.dybcio@linaro.org commit 8013295662f55696e5953ef14c31ba03721adf8f Author: Manivannan Sadhasivam Date: Sat Feb 11 10:54:15 2023 +0530 arm64: dts: qcom: sc8280xp: Add label property to vadc channel nodes For uniquely identifying the vadc channels, label property has to be used. The initial commit adding vadc support assumed that the driver will use the unit address along with the node name to identify the channels. But this assumption is now broken by, commit 701c875aded8 ("iio: adc: qcom-spmi-adc5: Fix the channel name") that stripped unit address from channel names. This results in probe failure of the vadc driver: [ 8.380370] iio iio:device0: tried to double register : in_temp_pmic-die-temp_input [ 8.380383] qcom-spmi-adc5 c440000.spmi:pmic@0:adc@3100: Failed to register sysfs interfaces [ 8.380386] qcom-spmi-adc5: probe of c440000.spmi:pmic@0:adc@3100 failed with error -16 Hence, let's get rid of the assumption about drivers and rely on label property to uniquely identify the channels. The labels are derived from the schematics for each PMIC. For internal adc channels such as die and xo, the PMIC names are used as a prefix. Fixes: 7c0151347401 ("arm64: dts: qcom: sc8280xp-x13s: Add PM8280_{1/2} ADC_TM5 channels") Fixes: 9d41cd17394a ("arm64: dts: qcom: sc8280xp-x13s: Add PMR735A VADC channel") Fixes: 3375151a7185 ("arm64: dts: qcom: sc8280xp-x13s: Add PM8280_{1/2} VADC channels") Fixes: 9a6b3042c533 ("arm64: dts: qcom: sc8280xp-x13s: Add PMK8280 VADC channels") Reported-by: Steev Klimaszewski Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230211052415.14581-1-manivannan.sadhasivam@linaro.org commit 672a58fc7c477e59981653a11241566870fff852 Author: Manivannan Sadhasivam Date: Fri Feb 24 13:30:45 2023 +0530 arm64: dts: qcom: sm8150: Fix the iommu mask used for PCIe controllers The iommu mask should be 0x3f as per Qualcomm internal documentation. Without the correct mask, the PCIe transactions from the endpoint will result in SMMU faults. Hence, fix it! Cc: stable@vger.kernel.org # 5.19 Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes") Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Reviewed-by: Bhupesh Sharma Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230224080045.6577-1-manivannan.sadhasivam@linaro.org commit 89dc65a7cc8a119c395c0931b12d7a514f9d2bcc Author: Conor Dooley Date: Tue Feb 28 19:26:55 2023 -0500 clk: k210: remove an implicit 64-bit division The K210 clock driver depends on SOC_CANAAN, which is only selectable when !MMU on RISC-V. !MMU is not possible on 32-bit yet, but patches have been sent for its enabling. The kernel test robot reported this implicit 64-bit division there. Replace the implicit division with an explicit one. Reported-by: kernel test robot Link: https://lore.kernel.org/linux-riscv/202301201538.zNlqgE4L-lkp@intel.com/ Signed-off-by: Conor Dooley Signed-off-by: Jesse Taube Link: https://lore.kernel.org/r/20230301002657.352637-2-Mr.Bossman075@gmail.com Reviewed-by: Damien Le Moal Signed-off-by: Stephen Boyd commit 877b03795fcf29ff2e2351f7e574ecc9b9c51732 Author: Daniel Wagner Date: Wed Feb 8 16:20:14 2023 +0100 scsi: qla2xxx: Add option to disable FC2 Target support Commit 44c57f205876 ("scsi: qla2xxx: Changes to support FCP2 Target") added support for FC2 Targets. Unfortunately, there are older setups which break with this new feature enabled. Allow to disable it via module option. Link: https://lore.kernel.org/r/20230208152014.109214-1-dwagner@suse.de Signed-off-by: Daniel Wagner Reviewed-by: Himanshu Madhani Signed-off-by: Martin K. Petersen commit 6cc55c969b7ce8d85e09a636693d4126c3676c11 Author: Maurizio Lombardi Date: Tue Feb 14 15:15:56 2023 +0100 scsi: target: iscsi: Fix an error message in iscsi_check_key() The first half of the error message is printed by pr_err(), the second half is printed by pr_debug(). The user will therefore see only the first part of the message and will miss some useful information. Link: https://lore.kernel.org/r/20230214141556.762047-1-mlombard@redhat.com Signed-off-by: Maurizio Lombardi Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit fb294b1c0ba982144ca467a75e7d01ff26304e2b Author: Mikulas Patocka Date: Mon Mar 6 11:17:58 2023 -0500 dm crypt: add cond_resched() to dmcrypt_write() The loop in dmcrypt_write may be running for unbounded amount of time, thus we need cond_resched() in it. This commit fixes the following warning: [ 3391.153255][ C12] watchdog: BUG: soft lockup - CPU#12 stuck for 23s! [dmcrypt_write/2:2897] ... [ 3391.387210][ C12] Call trace: [ 3391.390338][ C12] blk_attempt_bio_merge.part.6+0x38/0x158 [ 3391.395970][ C12] blk_attempt_plug_merge+0xc0/0x1b0 [ 3391.401085][ C12] blk_mq_submit_bio+0x398/0x550 [ 3391.405856][ C12] submit_bio_noacct+0x308/0x380 [ 3391.410630][ C12] dmcrypt_write+0x1e4/0x208 [dm_crypt] [ 3391.416005][ C12] kthread+0x130/0x138 [ 3391.419911][ C12] ret_from_fork+0x10/0x18 Reported-by: yangerkun Fixes: dc2676210c42 ("dm crypt: offload writes to thread") Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 9bbf5feecc7eab2c370496c1c161bbfe62084028 Author: Coly Li Date: Mon Feb 27 23:23:17 2023 +0800 dm thin: fix deadlock when swapping to thin device This is an already known issue that dm-thin volume cannot be used as swap, otherwise a deadlock may happen when dm-thin internal memory demand triggers swap I/O on the dm-thin volume itself. But thanks to commit a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device"), the limit_swap_bios target flag can also be used for dm-thin to avoid the recursive I/O when it is used as swap. Fix is to simply set ti->limit_swap_bios to true in both pool_ctr() and thin_ctr(). In my test, I create a dm-thin volume /dev/vg/swap and use it as swap device. Then I run fio on another dm-thin volume /dev/vg/main and use large --blocksize to trigger swap I/O onto /dev/vg/swap. The following fio command line is used in my test, fio --name recursive-swap-io --lockmem 1 --iodepth 128 \ --ioengine libaio --filename /dev/vg/main --rw randrw \ --blocksize 1M --numjobs 32 --time_based --runtime=12h Without this fix, the whole system can be locked up within 15 seconds. With this fix, there is no any deadlock or hung task observed after 2 hours of running fio. Furthermore, if blocksize is changed from 1M to 128M, after around 30 seconds fio has no visible I/O, and the out-of-memory killer message shows up in kernel message. After around 20 minutes all fio processes are killed and the whole system is back to being alive. This is exactly what is expected when recursive I/O happens on dm-thin volume when it is used as swap. Depends-on: a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device") Cc: stable@vger.kernel.org Signed-off-by: Coly Li Acked-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit e539a105f947b9db470fec39fe91d85fe737a432 Author: Jakub Kicinski Date: Sat Mar 4 11:26:10 2023 -0800 net: tls: fix device-offloaded sendpage straddling records Adrien reports that incorrect data is transmitted when a single page straddles multiple records. We would transmit the same data in all iterations of the loop. Reported-by: Adrien Moulin Link: https://lore.kernel.org/all/61481278.42813558.1677845235112.JavaMail.zimbra@corp.free.fr Fixes: c1318b39c7d3 ("tls: Add opt-in zerocopy mode of sendfile()") Tested-by: Adrien Moulin Reviewed-by: Tariq Toukan Acked-by: Maxim Mikityanskiy Link: https://lore.kernel.org/r/20230304192610.3818098-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 193250ace270fecd586dd2d0dfbd9cbd2ade977f Author: Daniel Golle Date: Sat Mar 4 13:43:20 2023 +0000 net: ethernet: mtk_eth_soc: fix RX data corruption issue Fix data corruption issue with SerDes connected PHYs operating at 1.25 Gbps speed where we could previously observe about 30% packet loss while the bad packet counter was increasing. As almost all boards with MediaTek MT7622 or MT7986 use either the MT7531 switch IC operating at 3.125Gbps SerDes rate or single-port PHYs using rate-adaptation to 2500Base-X mode, this issue only got exposed now when we started trying to use SFP modules operating with 1.25 Gbps with the BananaPi R3 board. The fix is to set bit 12 which disables the RX FIFO clear function when setting up MAC MCR, MediaTek SDK did the same change stating: "If without this patch, kernel might receive invalid packets that are corrupted by GMAC."[1] [1]: https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/+/d8a2975939a12686c4a95c40db21efdc3f821f63 Fixes: 42c03844e93d ("net-next: mediatek: add support for MediaTek MT7622 SoC") Tested-by: Bjørn Mork Signed-off-by: Daniel Golle Reviewed-by: Vladimir Oltean Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/138da2735f92c8b6f8578ec2e5a794ee515b665f.1677937317.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 58aac3a2ef414fea6d7fdf823ea177744a087d13 Author: Heiner Kallweit Date: Sat Mar 4 11:52:44 2023 +0100 net: phy: smsc: fix link up detection in forced irq mode Currently link up can't be detected in forced mode if polling isn't used. Only link up interrupt source we have is aneg complete which isn't applicable in forced mode. Therefore we have to use energy-on as link up indicator. Fixes: 7365494550f6 ("net: phy: smsc: skip ENERGYON interrupt if disabled") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 38d408f5b1250d56f8a19d2f2ff65aa8c7b93ff4 Merge: e5e7e398f6bb7 6206b2e787da2 Author: Mark Brown Date: Mon Mar 6 21:11:50 2023 +0000 ASoC: Intel: avs: Machine board fixes Merge series from Amadeusz Sławiński : Series of adjustments to machine board files. Use fixed format in boards that were not using one. Fix clock handling. commit 5b201a82cd9d0945d70562974ea6ad8e3b1861b5 Author: Arnaldo Carvalho de Melo Date: Mon Mar 6 14:50:45 2023 -0300 perf tools: Add Adrian Hunter to MAINTAINERS as a reviewer Adrian is the main author of the Intel PT codebase and has been reviewing perf tooling patches consistently for a long time, so lets reflect that in the MAINTAINERS file so that contributors add him to the CC list in patch submissions. Acked-by: Adrian Hunter Acked-by: Ian Rogers Acked-by: Jiri Olsa Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/lkml/ZAYosCjlzO9plAYO@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 06a1574b94ee5272789eaea05a5bdddedea7cc0d Author: Arnaldo Carvalho de Melo Date: Mon Mar 6 14:44:11 2023 -0300 tools headers UAPI: Sync linux/perf_event.h with the kernel sources To pick up the changes in: 09519ec3b19e4144 ("perf: Add perf_event_attr::config3") The patches for the tooling side will come later. This addresses this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/perf_event.h' differs from latest version at 'include/uapi/linux/perf_event.h' diff -u tools/include/uapi/linux/perf_event.h include/uapi/linux/perf_event.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Rob Herring Cc: Will Deacon Link: https://lore.kernel.org/lkml/ZAZLYmDjWjSItWOq@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 633a12fda6536a1a17bcea29502e777e86a4547e Author: Konrad Dybcio Date: Tue Jan 3 15:21:20 2023 +0100 interconnect: qcom: qcm2290: Fix MASTER_SNOC_BIMC_NRT Due to what seems to be a copy-paste error, the _NRT master was identical to the _RT master, which should not be the case.. Fix it using the values available from the downstream kernel [1]. [1] https://android.googlesource.com/kernel/msm-extra/devicetree/+/refs/heads/android-msm-bramble-4.19-android11-qpr1/qcom/scuba-bus.dtsi#127 Fixes: 1a14b1ac3935 ("interconnect: qcom: Add QCM2290 driver support") Signed-off-by: Konrad Dybcio Acked-by: Shawn Guo Link: https://lore.kernel.org/r/20230103142120.15605-1-konrad.dybcio@linaro.org Signed-off-by: Georgi Djakov commit 26243872fe26ec0df7d81766253d00213990e382 Author: Conor Dooley Date: Wed Feb 22 12:46:11 2023 +0000 MAINTAINERS: add missing clock driver coverage for Microchip FPGAs When the CCC support was added, the clock binding coverage was converted to a regex in commit 71c8517e004b ("MAINTAINERS: update polarfire soc clock binding"), but the coverage for the clock drivers themselves was not updated. Rectify that now. Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230222124610.257101-1-conor.dooley@microchip.com Signed-off-by: Stephen Boyd commit 8ca09d5fa3549d142c2080a72a4c70ce389163cd Author: Linus Torvalds Date: Mon Mar 6 12:15:13 2023 -0800 cpumask: fix incorrect cpumask scanning result checks It turns out that commit 596ff4a09b89 ("cpumask: re-introduce constant-sized cpumask optimizations") exposed a number of cases of drivers not checking the result of "cpumask_next()" and friends correctly. The documented correct check for "no more cpus in the cpumask" is to check for the result being equal or larger than the number of possible CPU ids, exactly _because_ we've always done those constant-sized cpumask scans using a widened type before. So the return value of a cpumask scan should be checked with if (cpu >= nr_cpu_ids) ... because the cpumask scan did not necessarily stop exactly *at* that maximum CPU id. But a few cases ended up instead using checks like if (cpu == nr_cpumask_bits) ... which used that internal "widened" number of bits. And that used to work pretty much by accident (ok, in this case "by accident" is simply because it matched the historical internal implementation of the cpumask scanning, so it was more of a "intentionally using implementation details rather than an accident"). But the extended constant-sized optimizations then did that internal implementation differently, and now that code that did things wrong but matched the old implementation no longer worked at all. Which then causes subsequent odd problems due to using what ends up being an invalid CPU ID. Most of these cases require either unusual hardware or special uses to hit, but the random.c one triggers quite easily. All you really need is to have a sufficiently small CONFIG_NR_CPUS value for the bit scanning optimization to be triggered, but not enough CPUs to then actually fill that widened cpumask. At that point, the cpumask scanning will return the NR_CPUS constant, which is _not_ the same as nr_cpumask_bits. This just does the mindless fix with sed -i 's/== nr_cpumask_bits/>= nr_cpu_ids/' to fix the incorrect uses. The ones in the SCSI lpfc driver in particular could probably be fixed more cleanly by just removing that repeated pattern entirely, but I am not emptionally invested enough in that driver to care. Reported-and-tested-by: Guenter Roeck Link: https://lore.kernel.org/lkml/481b19b5-83a0-4793-b4fd-194ad7b978c3@roeck-us.net/ Reported-and-tested-by: Geert Uytterhoeven Link: https://lore.kernel.org/lkml/CAMuHMdUKo_Sf7TjKzcNDa8Ve+6QrK+P8nSQrSQ=6LTRmcBKNww@mail.gmail.com/ Reported-by: Vernon Yang Link: https://lore.kernel.org/lkml/20230306160651.2016767-1-vernon2gm@gmail.com/ Cc: Yury Norov Cc: Jason A. Donenfeld Signed-off-by: Linus Torvalds commit 32dfc59e43019e43deab7afbfff37a2f9f17a222 Merge: 294635a8165a3 dfdd608c3b365 Author: Martin KaFai Lau Date: Mon Mar 6 11:44:14 2023 -0800 Merge branch 'fix resolving VAR after DATASEC' Lorenz Bauer says: ==================== See the first patch for a detailed explanation. v2: - Move RESOLVE_TBD assignment out of the loop (Martin) ==================== Signed-off-by: Martin KaFai Lau commit dfdd608c3b365f0fd49d7e13911ebcde06b9865b Author: Lorenz Bauer Date: Mon Mar 6 11:21:38 2023 +0000 selftests/bpf: check that modifier resolves after pointer Add a regression test that ensures that a VAR pointing at a modifier which follows a PTR (or STRUCT or ARRAY) is resolved correctly by the datasec validator. Signed-off-by: Lorenz Bauer Link: https://lore.kernel.org/r/20230306112138.155352-3-lmb@isovalent.com Signed-off-by: Martin KaFai Lau commit 9b459804ff9973e173fabafba2a1319f771e85fa Author: Lorenz Bauer Date: Mon Mar 6 11:21:37 2023 +0000 btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR btf_datasec_resolve contains a bug that causes the following BTF to fail loading: [1] DATASEC a size=2 vlen=2 type_id=4 offset=0 size=1 type_id=7 offset=1 size=1 [2] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) [3] PTR (anon) type_id=2 [4] VAR a type_id=3 linkage=0 [5] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none) [6] TYPEDEF td type_id=5 [7] VAR b type_id=6 linkage=0 This error message is printed during btf_check_all_types: [1] DATASEC a size=2 vlen=2 type_id=7 offset=1 size=1 Invalid type By tracing btf_*_resolve we can pinpoint the problem: btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_TBD) = 0 btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_TBD) = 0 btf_ptr_resolve(depth: 3, type_id: 3, mode: RESOLVE_PTR) = 0 btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_PTR) = 0 btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_PTR) = -22 The last invocation of btf_datasec_resolve should invoke btf_var_resolve by means of env_stack_push, instead it returns EINVAL. The reason is that env_stack_push is never executed for the second VAR. if (!env_type_is_resolve_sink(env, var_type) && !env_type_is_resolved(env, var_type_id)) { env_stack_set_next_member(env, i + 1); return env_stack_push(env, var_type, var_type_id); } env_type_is_resolve_sink() changes its behaviour based on resolve_mode. For RESOLVE_PTR, we can simplify the if condition to the following: (btf_type_is_modifier() || btf_type_is_ptr) && !env_type_is_resolved() Since we're dealing with a VAR the clause evaluates to false. This is not sufficient to trigger the bug however. The log output and EINVAL are only generated if btf_type_id_size() fails. if (!btf_type_id_size(btf, &type_id, &type_size)) { btf_verifier_log_vsi(env, v->t, vsi, "Invalid type"); return -EINVAL; } Most types are sized, so for example a VAR referring to an INT is not a problem. The bug is only triggered if a VAR points at a modifier. Since we skipped btf_var_resolve that modifier was also never resolved, which means that btf_resolved_type_id returns 0 aka VOID for the modifier. This in turn causes btf_type_id_size to return NULL, triggering EINVAL. To summarise, the following conditions are necessary: - VAR pointing at PTR, STRUCT, UNION or ARRAY - Followed by a VAR pointing at TYPEDEF, VOLATILE, CONST, RESTRICT or TYPE_TAG The fix is to reset resolve_mode to RESOLVE_TBD before attempting to resolve a VAR from a DATASEC. Fixes: 1dc92851849c ("bpf: kernel side support for BTF Var and DataSec") Signed-off-by: Lorenz Bauer Link: https://lore.kernel.org/r/20230306112138.155352-2-lmb@isovalent.com Signed-off-by: Martin KaFai Lau commit 66305069eb6d17d9190cbcd196f3f7487df47ae8 Merge: fe15c26ee26ef 1b9b4f922f961 Author: Dave Airlie Date: Tue Mar 7 05:42:28 2023 +1000 Merge tag 'drm-misc-fixes-2023-02-23' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A fix for nouveau preventing the system shutdown and one for a build warning, and NULL pointer dereference fix for cirrus. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20230223083839.5gtmu6i42bnj7pfh@houat commit 0ffad67784a097beccf34d297ddd1b0773b3b8a3 Author: Randy Dunlap Date: Sat Feb 25 21:39:47 2023 -0800 clk: HI655X: select REGMAP instead of depending on it REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it. Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues. Therefore, change the use of "depends on REGMAP" to "select REGMAP". Fixes: 3a49afb84ca0 ("clk: enable hi655x common clk automatically") Signed-off-by: Randy Dunlap Cc: Riku Voipio Cc: Stephen Boyd Cc: Michael Turquette Cc: linux-clk@vger.kernel.org Link: https://lore.kernel.org/r/20230226053953.4681-3-rdunlap@infradead.org Signed-off-by: Stephen Boyd commit 94511ebc6810142eb36c8b935e1713a15db94d28 Author: Nick Alcock Date: Wed Feb 22 12:14:38 2023 +0000 kbuild, clk: remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Cc: Luis Chamberlain Cc: linux-modules@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Hitomi Hasegawa Cc: Michael Turquette Cc: Stephen Boyd Cc: linux-clk@vger.kernel.org Link: https://lore.kernel.org/r/20230222121453.91915-13-nick.alcock@oracle.com Acked-by: Conor Dooley Reviewed-by: Conor Dooley Signed-off-by: Stephen Boyd commit 9d941b8abf863751c1c634d96539c3fab220a99c Author: Nick Alcock Date: Wed Feb 22 12:14:37 2023 +0000 kbuild, clk: bcm2835: remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Cc: Luis Chamberlain Cc: linux-modules@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Hitomi Hasegawa Cc: Michael Turquette Cc: Stephen Boyd Cc: Florian Fainelli Cc: Ray Jui Cc: Scott Branden Cc: linux-clk@vger.kernel.org Cc: linux-rpi-kernel@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230222121453.91915-12-nick.alcock@oracle.com Signed-off-by: Stephen Boyd commit c28cd1f3433c7e339315d1ddacaeacf0fdfbe252 Author: Saravana Kannan Date: Wed Mar 1 17:46:38 2023 -0800 clk: Mark a fwnode as initialized when using CLK_OF_DECLARE() macro We already mark fwnodes as initialized when they are registered as clock providers. We do this so that fw_devlink can tell when a clock driver doesn't use the driver core framework to probe/initialize its device. This ensures fw_devlink doesn't block the consumers of such a clock provider indefinitely. However, some users of CLK_OF_DECLARE() macros don't use the same node that matches the macro as the node for the clock provider, but they initialize the entire node. To cover these cases, also mark the nodes that match the macros as initialized when the init callback function is called. An example of this is "stericsson,u8500-clks" that's handled using CLK_OF_DECLARE() and looks something like this: clocks { compatible = "stericsson,u8500-clks"; prcmu_clk: prcmu-clock { #clock-cells = <1>; }; prcc_pclk: prcc-periph-clock { #clock-cells = <2>; }; prcc_kclk: prcc-kernel-clock { #clock-cells = <2>; }; prcc_reset: prcc-reset-controller { #reset-cells = <2>; }; ... }; This patch makes sure that "clocks" is marked as initialized so that fw_devlink knows that all nodes under it have been initialized. If the driver creates struct devices for some of the subnodes, fw_devlink is smart enough to know to wait for those devices to probe, so no special handling is required for those cases. Cc: Greg Kroah-Hartman Reported-by: Linus Walleij Link: https://lore.kernel.org/lkml/CACRpkdamxDX6EBVjKX5=D3rkHp17f5pwGdBVhzFU90-0MHY6dQ@mail.gmail.com/ Fixes: 4a032827daa8 ("of: property: Simplify of_link_to_phandle()") Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20230302014639.297514-1-saravanak@google.com Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Stephen Boyd commit 294635a8165a31408a8b3a24f9c74849ca3d8701 Author: Alexander Lobakin Date: Fri Feb 24 17:36:07 2023 +0100 bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES &xdp_buff and &xdp_frame are bound in a way that xdp_buff->data_hard_start == xdp_frame It's always the case and e.g. xdp_convert_buff_to_frame() relies on this. IOW, the following: for (u32 i = 0; i < 0xdead; i++) { xdpf = xdp_convert_buff_to_frame(&xdp); xdp_convert_frame_to_buff(xdpf, &xdp); } shouldn't ever modify @xdpf's contents or the pointer itself. However, "live packet" code wrongly treats &xdp_frame as part of its context placed *before* the data_hard_start. With such flow, data_hard_start is sizeof(*xdpf) off to the right and no longer points to the XDP frame. Instead of replacing `sizeof(ctx)` with `offsetof(ctx, xdpf)` in several places and praying that there are no more miscalcs left somewhere in the code, unionize ::frm with ::data in a flex array, so that both starts pointing to the actual data_hard_start and the XDP frame actually starts being a part of it, i.e. a part of the headroom, not the context. A nice side effect is that the maximum frame size for this mode gets increased by 40 bytes, as xdp_buff::frame_sz includes everything from data_hard_start (-> includes xdpf already) to the end of XDP/skb shared info. Also update %MAX_PKT_SIZE accordingly in the selftests code. Leave it hardcoded for 64 bit && 4k pages, it can be made more flexible later on. Minor: align `&head->data` with how `head->frm` is assigned for consistency. Minor #2: rename 'frm' to 'frame' in &xdp_page_head while at it for clarity. (was found while testing XDP traffic generator on ice, which calls xdp_convert_frame_to_buff() for each XDP frame) Fixes: b530e9e1063e ("bpf: Add "live packet" mode for XDP in BPF_PROG_RUN") Acked-by: Toke Høiland-Jørgensen Signed-off-by: Alexander Lobakin Link: https://lore.kernel.org/r/20230224163607.2994755-1-aleksander.lobakin@intel.com Signed-off-by: Martin KaFai Lau commit 80c16b2b121fbc3380dbffa9bab7559acbaaa2ed Author: Andy Shevchenko Date: Mon Mar 6 17:22:04 2023 +0200 cpumask: Fix typo nr_cpumask_size --> nr_cpumask_bits The never used nr_cpumask_size is just a typo, hence use existing redefinition that's called nr_cpumask_bits. Signed-off-by: Andy Shevchenko Signed-off-by: Linus Torvalds commit e4cc1483f35940c9288c332dd275f6fad485f8d2 Author: Filipe Manana Date: Mon Feb 27 12:53:56 2023 +0000 btrfs: fix extent map logging bit not cleared for split maps after dropping range At btrfs_drop_extent_map_range() we are clearing the EXTENT_FLAG_LOGGING bit on a 'flags' variable that was not initialized. This makes static checkers complain about it, so initialize the 'flags' variable before clearing the bit. In practice this has no consequences, because EXTENT_FLAG_LOGGING should not be set when btrfs_drop_extent_map_range() is called, as an fsync locks the inode in exclusive mode, locks the inode's mmap semaphore in exclusive mode too and it always flushes all delalloc. Also add a comment about why we clear EXTENT_FLAG_LOGGING on a copy of the flags of the split extent map. Reported-by: Dan Carpenter Link: https://lore.kernel.org/linux-btrfs/Y%2FyipSVozUDEZKow@kili/ Fixes: db21370bffbc ("btrfs: drop extent map range more efficiently") Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 95cd356ca23c3807b5f3503687161e216b1c520d Author: Johannes Thumshirn Date: Tue Feb 21 10:11:24 2023 -0800 btrfs: fix percent calculation for bg reclaim message We have a report, that the info message for block-group reclaim is crossing the 100% used mark. This is happening as we were truncating the divisor for the division (the block_group->length) to a 32bit value. Fix this by using div64_u64() to not truncate the divisor. In the worst case, it can lead to a div by zero error and should be possible to trigger on 4 disks RAID0, and each device is large enough: $ mkfs.btrfs -f /dev/test/scratch[1234] -m raid1 -d raid0 btrfs-progs v6.1 [...] Filesystem size: 40.00GiB Block group profiles: Data: RAID0 4.00GiB <<< Metadata: RAID1 256.00MiB System: RAID1 8.00MiB Reported-by: Forza Link: https://lore.kernel.org/linux-btrfs/e99483.c11a58d.1863591ca52@tnonline.net/ Fixes: 5f93e776c673 ("btrfs: zoned: print unusable percentage when reclaiming block groups") CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Anand Jain Reviewed-by: Qu Wenruo Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba [ add Qu's note ] Signed-off-by: David Sterba commit 98e8d36a26c2ed22f78316df7d4bf33e554b9f9f Author: Naohiro Aota Date: Mon Feb 13 14:10:38 2023 +0900 btrfs: fix unnecessary increment of read error stat on write error Current btrfs_log_dev_io_error() increases the read error count even if the erroneous IO is a WRITE request. This is because it forget to use "else if", and all the error WRITE requests counts as READ error as there is (of course) no REQ_RAHEAD bit set. Fixes: c3a62baf21ad ("btrfs: use chained bios when cloning") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Christoph Hellwig Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit c06016a02a6e316d861f7dddd4b70419a47ded2f Author: void0red Date: Sat Feb 18 12:36:48 2023 +0800 btrfs: handle btrfs_del_item errors in __btrfs_update_delayed_inode Even if the slot is already read out, we may still need to re-balance the tree, thus it can cause error in that btrfs_del_item() call and we need to handle it properly. Reviewed-by: Qu Wenruo Signed-off-by: void0red Signed-off-by: David Sterba commit 2943868a909f1d526da363dc077fd7b578643f4b Author: Qu Wenruo Date: Sat Feb 11 19:53:05 2023 +0800 btrfs: ioctl: return device fsid from DEV_INFO ioctl Currently user space utilizes dev info ioctl to grab the info of a certain devid, this includes its device uuid. But the returned info is not enough to determine if a device is a seed. Commit a26d60dedf9a ("btrfs: sysfs: add devinfo/fsid to retrieve actual fsid from the device") exports the same value in sysfs so this is for parity with ioctl. Add a new member, fsid, into btrfs_ioctl_dev_info_args, and populate the member with fsid value. This should not cause any compatibility problem, following the combinations: - Old user space, old kernel - Old user space, new kernel User space tool won't even check the new member. - New user space, old kernel The kernel won't touch the new member, and user space tool should zero out its argument, thus the new member is all zero. User space tool can then know the kernel doesn't support this fsid reporting, and falls back to whatever they can. - New user space, new kernel Go as planned. Would find the fsid member is no longer zero, and trust its value. Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 12148367d7235a015c7a3ab20bc189a34f63688e Author: Boris Burkov Date: Wed Feb 15 12:59:50 2023 -0800 btrfs: fix potential dead lock in size class loading logic As reported by Filipe, there's a potential deadlock caused by using btrfs_search_forward on commit_root. The locking there is unconditional, even if ->skip_locking and ->search_commit_root is set. It's not meant to be used for commit roots, so it always needs to do locking. So if another task is COWing a child node of the same root node and then needs to wait for block group caching to complete when trying to allocate a metadata extent, it deadlocks. For example: [539604.239315] sysrq: Show Blocked State [539604.240133] task:kworker/u16:6 state:D stack:0 pid:2119594 ppid:2 flags:0x00004000 [539604.241613] Workqueue: btrfs-cache btrfs_work_helper [btrfs] [539604.242673] Call Trace: [539604.243129] [539604.243925] __schedule+0x41d/0xee0 [539604.244797] ? rcu_read_lock_sched_held+0x12/0x70 [539604.245399] ? rwsem_down_read_slowpath+0x185/0x490 [539604.246111] schedule+0x5d/0xf0 [539604.246593] rwsem_down_read_slowpath+0x2da/0x490 [539604.247290] ? rcu_barrier_tasks_trace+0x10/0x20 [539604.248090] __down_read_common+0x3d/0x150 [539604.248702] down_read_nested+0xc3/0x140 [539604.249280] __btrfs_tree_read_lock+0x24/0x100 [btrfs] [539604.250097] btrfs_read_lock_root_node+0x48/0x60 [btrfs] [539604.250915] btrfs_search_forward+0x59/0x460 [btrfs] [539604.251781] ? btrfs_global_root+0x50/0x70 [btrfs] [539604.252476] caching_thread+0x1be/0x920 [btrfs] [539604.253167] btrfs_work_helper+0xf6/0x400 [btrfs] [539604.253848] process_one_work+0x24f/0x5a0 [539604.254476] worker_thread+0x52/0x3b0 [539604.255166] ? __pfx_worker_thread+0x10/0x10 [539604.256047] kthread+0xf0/0x120 [539604.256591] ? __pfx_kthread+0x10/0x10 [539604.257212] ret_from_fork+0x29/0x50 [539604.257822] [539604.258233] task:btrfs-transacti state:D stack:0 pid:2236474 ppid:2 flags:0x00004000 [539604.259802] Call Trace: [539604.260243] [539604.260615] __schedule+0x41d/0xee0 [539604.261205] ? rcu_read_lock_sched_held+0x12/0x70 [539604.262000] ? rwsem_down_read_slowpath+0x185/0x490 [539604.262822] schedule+0x5d/0xf0 [539604.263374] rwsem_down_read_slowpath+0x2da/0x490 [539604.266228] ? lock_acquire+0x160/0x310 [539604.266917] ? rcu_read_lock_sched_held+0x12/0x70 [539604.267996] ? lock_contended+0x19e/0x500 [539604.268720] __down_read_common+0x3d/0x150 [539604.269400] down_read_nested+0xc3/0x140 [539604.270057] __btrfs_tree_read_lock+0x24/0x100 [btrfs] [539604.271129] btrfs_read_lock_root_node+0x48/0x60 [btrfs] [539604.272372] btrfs_search_slot+0x143/0xf70 [btrfs] [539604.273295] update_block_group_item+0x9e/0x190 [btrfs] [539604.274282] btrfs_start_dirty_block_groups+0x1c4/0x4f0 [btrfs] [539604.275381] ? __mutex_unlock_slowpath+0x45/0x280 [539604.276390] btrfs_commit_transaction+0xee/0xed0 [btrfs] [539604.277391] ? lock_acquire+0x1a4/0x310 [539604.278080] ? start_transaction+0xcb/0x6c0 [btrfs] [539604.279099] transaction_kthread+0x142/0x1c0 [btrfs] [539604.279996] ? __pfx_transaction_kthread+0x10/0x10 [btrfs] [539604.280673] kthread+0xf0/0x120 [539604.281050] ? __pfx_kthread+0x10/0x10 [539604.281496] ret_from_fork+0x29/0x50 [539604.281966] [539604.282255] task:fsstress state:D stack:0 pid:2236483 ppid:1 flags:0x00004006 [539604.283897] Call Trace: [539604.284700] [539604.285088] __schedule+0x41d/0xee0 [539604.285660] schedule+0x5d/0xf0 [539604.286175] btrfs_wait_block_group_cache_progress+0xf2/0x170 [btrfs] [539604.287342] ? __pfx_autoremove_wake_function+0x10/0x10 [539604.288450] find_free_extent+0xd93/0x1750 [btrfs] [539604.289256] ? _raw_spin_unlock+0x29/0x50 [539604.289911] ? btrfs_get_alloc_profile+0x127/0x2a0 [btrfs] [539604.290843] btrfs_reserve_extent+0x147/0x290 [btrfs] [539604.291943] btrfs_alloc_tree_block+0xcb/0x3e0 [btrfs] [539604.292903] __btrfs_cow_block+0x138/0x580 [btrfs] [539604.293773] btrfs_cow_block+0x10e/0x240 [btrfs] [539604.294595] btrfs_search_slot+0x7f3/0xf70 [btrfs] [539604.295585] btrfs_update_device+0x71/0x1b0 [btrfs] [539604.296459] btrfs_chunk_alloc_add_chunk_item+0xe0/0x340 [btrfs] [539604.297489] btrfs_chunk_alloc+0x1bf/0x490 [btrfs] [539604.298335] find_free_extent+0x6fa/0x1750 [btrfs] [539604.299174] ? _raw_spin_unlock+0x29/0x50 [539604.299950] ? btrfs_get_alloc_profile+0x127/0x2a0 [btrfs] [539604.300918] btrfs_reserve_extent+0x147/0x290 [btrfs] [539604.301797] btrfs_alloc_tree_block+0xcb/0x3e0 [btrfs] [539604.303017] ? lock_release+0x224/0x4a0 [539604.303855] __btrfs_cow_block+0x138/0x580 [btrfs] [539604.304789] btrfs_cow_block+0x10e/0x240 [btrfs] [539604.305611] btrfs_search_slot+0x7f3/0xf70 [btrfs] [539604.306682] ? btrfs_global_root+0x50/0x70 [btrfs] [539604.308198] lookup_inline_extent_backref+0x17b/0x7a0 [btrfs] [539604.309254] lookup_extent_backref+0x43/0xd0 [btrfs] [539604.310122] __btrfs_free_extent+0xf8/0x810 [btrfs] [539604.310874] ? lock_release+0x224/0x4a0 [539604.311724] ? btrfs_merge_delayed_refs+0x17b/0x1d0 [btrfs] [539604.313023] __btrfs_run_delayed_refs+0x2ba/0x1260 [btrfs] [539604.314271] btrfs_run_delayed_refs+0x8f/0x1c0 [btrfs] [539604.315445] ? rcu_read_lock_sched_held+0x12/0x70 [539604.316706] btrfs_commit_transaction+0xa2/0xed0 [btrfs] [539604.317855] ? do_raw_spin_unlock+0x4b/0xa0 [539604.318544] ? _raw_spin_unlock+0x29/0x50 [539604.319240] create_subvol+0x53d/0x6e0 [btrfs] [539604.320283] btrfs_mksubvol+0x4f5/0x590 [btrfs] [539604.321220] __btrfs_ioctl_snap_create+0x11b/0x180 [btrfs] [539604.322307] btrfs_ioctl_snap_create_v2+0xc6/0x150 [btrfs] [539604.323295] btrfs_ioctl+0x9f7/0x33e0 [btrfs] [539604.324331] ? rcu_read_lock_sched_held+0x12/0x70 [539604.325137] ? lock_release+0x224/0x4a0 [539604.325808] ? __x64_sys_ioctl+0x87/0xc0 [539604.326467] __x64_sys_ioctl+0x87/0xc0 [539604.327109] do_syscall_64+0x38/0x90 [539604.327875] entry_SYSCALL_64_after_hwframe+0x72/0xdc [539604.328792] RIP: 0033:0x7f05a7babaeb This needs to use regular btrfs_search_slot() with some skip and stop logic. Since we only consider five samples (five search slots), don't bother with the complexity of looking for commit_root_sem contention. If necessary, it can be added to the load function in between samples. Reported-by: Filipe Manana Link: https://lore.kernel.org/linux-btrfs/CAL3q7H7eKMD44Z1+=Kb-1RFMMeZpAm2fwyO59yeBwCcSOU80Pg@mail.gmail.com/ Fixes: c7eec3d9aa95 ("btrfs: load block group size class when caching") Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 7d0930647c020f75592adde8712d2cb002b29387 Author: Arnaldo Carvalho de Melo Date: Mon Mar 6 14:25:21 2023 -0300 tools headers x86 cpufeatures: Sync with the kernel sources To pick the changes from: 8415a74852d7c247 ("x86/cpu, kvm: Add support for CPUID_80000021_EAX") This only causes these perf files to be rebuilt: CC /tmp/build/perf/bench/mem-memcpy-x86-64-asm.o CC /tmp/build/perf/bench/mem-memset-x86-64-asm.o And addresses these perf build warnings: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/required-features.h' differs from latest version at 'arch/x86/include/asm/required-features.h' diff -u tools/arch/x86/include/asm/required-features.h arch/x86/include/asm/required-features.h Cc: Adrian Hunter Cc: Borislav Petkov (AMD) Cc: Ian Rogers Cc: Jiri Olsa Cc: Kim Phillips Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZAYlS2XTJ5hRtss7@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 6206b2e787da2ed567922c37bb588a44f6fb6705 Author: Cezary Rojewski Date: Fri Mar 3 14:48:54 2023 +0100 ASoC: Intel: avs: nau8825: Adjust clock control Internal clock shall be adjusted also in cases when DAPM event other than 'ON' is triggered. Signed-off-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230303134854.2277146-6-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 933de2d127281731166cf2880fa1e23c5a0f7faa Author: Cezary Rojewski Date: Fri Mar 3 14:48:53 2023 +0100 ASoC: Intel: avs: ssm4567: Remove nau8825 bits Some of the nau8825 clock control got into the ssm4567, remove it. Signed-off-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230303134854.2277146-5-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit d24dbc865c2bd5946bef62bb862a65df092dfc79 Author: Amadeusz Sławiński Date: Fri Mar 3 14:48:52 2023 +0100 ASoC: Intel: avs: rt5682: Explicitly define codec format rt5682 is headset codec configured in 48000/2/S24_LE format regardless of front end format, so force it to be so. Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230303134854.2277146-4-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 61f368624fe4d0c25c6e9c917574b8ace51d776e Author: Amadeusz Sławiński Date: Fri Mar 3 14:48:51 2023 +0100 ASoC: Intel: avs: da7219: Explicitly define codec format da7219 is headset codec configured in 48000/2/S24_LE format regardless of front end format, so force it to be so. Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230303134854.2277146-3-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit d16c893425d07ada1fdd817ec06d322efcf69480 Author: Amadeusz Sławiński Date: Fri Mar 3 14:48:50 2023 +0100 ASoC: Intel: avs: max98357a: Explicitly define codec format max98357a is speaker codec configured in 48000/2/S16_LE format regardless of front end format, so force it to be so. Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230303134854.2277146-2-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit b7abcd9c656b982a99e18f795bb1cf81f84b656d Author: Bagas Sanjaya Date: Tue Feb 28 14:45:23 2023 +0700 bpf, doc: Link to submitting-patches.rst for general patch submission info The link for patch submission information in general refers to index page for "Working with the kernel development community" section of kernel docs, whereas the link should have been Documentation/process/submitting-patches.rst instead. Fix it by replacing the index target with the appropriate doc. Fixes: 542228384888f5 ("bpf, doc: convert bpf_devel_QA.rst to use RST formatting") Signed-off-by: Bagas Sanjaya Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230228074523.11493-3-bagasdotme@gmail.com commit 32db18d606c9a6eac7ac8bb12b4bf0e2eb1d5d14 Author: Bagas Sanjaya Date: Tue Feb 28 14:45:22 2023 +0700 bpf, doc: Do not link to docs.kernel.org for kselftest link The question on how to run BPF selftests have a reference link to kernel selftest documentation (Documentation/dev-tools/kselftest.rst). However, it uses external link to the documentation at kernel.org/docs (aka docs.kernel.org) instead, which requires Internet access. Fix this and replace the link with internal linking, by using :doc: directive while keeping the anchor text. Fixes: b7a27c3aafa252 ("bpf, doc: howto use/run the BPF selftests") Signed-off-by: Bagas Sanjaya Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230228074523.11493-2-bagasdotme@gmail.com commit 63bceed808c5cafbac4e20b5a40012a0ec6c6529 Author: Jan Kara Date: Tue Feb 28 12:11:38 2023 +0100 udf: Warn if block mapping is done for in-ICB files Now that address space operations are merge dfor in-ICB and normal files, it is more likely some code mistakenly tries to map blocks for in-ICB files. WARN and return error instead of silently returning garbage. Signed-off-by: Jan Kara commit cecb1f06541e12ec68805dbddb2013ee720dfe3d Author: Jan Kara Date: Tue Feb 28 12:00:25 2023 +0100 udf: Fix reading of in-ICB files After merging address space operations of normal and in-ICB files, readahead could get called for in-ICB files which resulted in udf_get_block() being called for these files. udf_get_block() is not prepared to be called for in-ICB files and ends up returning garbage results as it interprets file data as extent list. Fix the problem by skipping readahead for in-ICB files. Fixes: 37a8a39f7ad3 ("udf: Switch to single address_space_operations") Signed-off-by: Jan Kara commit 49854d3ccc55efd7e6873e0c39f360bdbe251c51 Author: Jan Kara Date: Mon Feb 27 19:32:19 2023 +0100 udf: Fix lost writes in udf_adinicb_writepage() The patch converting udf_adinicb_writepage() to avoid manually kmapping the page used memcpy_to_page() however that copies in the wrong direction (effectively overwriting file data with the old contents). What we should be using is memcpy_from_page() to copy data from the page into the inode and then mark inode dirty to store the data. Fixes: 5cfc45321a6d ("udf: Convert udf_adinicb_writepage() to memcpy_to_page()") Signed-off-by: Jan Kara commit 75dce6a941e3f16c3b4878c8b2f46d5d07c619ce Author: Christophe JAILLET Date: Wed Feb 15 12:08:45 2023 +0100 mtd: nand: mxic-ecc: Fix mxic_ecc_data_xfer_wait_for_completion() when irq is used wait_for_completion_timeout() and readl_poll_timeout() don't handle their return value the same way. wait_for_completion_timeout() returns 0 on time out (and >0 in all other cases) readl_poll_timeout() returns 0 on success and -ETIMEDOUT upon a timeout. In order for the error handling path to work in both cases, the logic against wait_for_completion_timeout() needs to be inverted. Fixes: 48e6633a9fa2 ("mtd: nand: mxic-ecc: Add Macronix external ECC engine support") Signed-off-by: Christophe JAILLET Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/beddbc374557e44ceec897e68c4a5d12764ddbb9.1676459308.git.christophe.jaillet@wanadoo.fr commit 4ce341de6c02d02aba7c78a6447ccfcaa9eeb328 Author: Arseniy Krasnov Date: Mon Feb 27 13:24:25 2023 +0300 mtd: rawnand: meson: initialize struct with zeroes This structure must be zeroed, because it's field 'hw->core' is used as 'parent' in 'clk_core_fill_parent_index()', but it will be uninitialized. This happens, because when this struct is not zeroed, pointer 'hw' is "initialized" by garbage, which is valid pointer, but points to some garbage. So 'hw' will be dereferenced, but 'core' contains some random data which will be interpreted as a pointer. The following backtrace is result of dereference of such pointer: [ 1.081319] __clk_register+0x414/0x820 [ 1.085113] devm_clk_register+0x64/0xd0 [ 1.088995] meson_nfc_probe+0x258/0x6ec [ 1.092875] platform_probe+0x70/0xf0 [ 1.096498] really_probe+0xc8/0x3e0 [ 1.100034] __driver_probe_device+0x84/0x190 [ 1.104346] driver_probe_device+0x44/0x120 [ 1.108487] __driver_attach+0xb4/0x220 [ 1.112282] bus_for_each_dev+0x78/0xd0 [ 1.116077] driver_attach+0x2c/0x40 [ 1.119613] bus_add_driver+0x184/0x240 [ 1.123408] driver_register+0x80/0x140 [ 1.127203] __platform_driver_register+0x30/0x40 [ 1.131860] meson_nfc_driver_init+0x24/0x30 Fixes: 1e4d3ba66888 ("mtd: rawnand: meson: fix the clock") Signed-off-by: Arseniy Krasnov Acked-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230227102425.793841-1-AVKrasnov@sberdevices.ru commit 1eb65c8687316c65140b48fad27133d583178e15 Author: Mohammed Gamal Date: Fri Feb 17 22:44:11 2023 +0200 Drivers: vmbus: Check for channel allocation before looking up relids relid2channel() assumes vmbus channel array to be allocated when called. However, in cases such as kdump/kexec, not all relids will be reset by the host. When the second kernel boots and if the guest receives a vmbus interrupt during vmbus driver initialization before vmbus_connect() is called, before it finishes, or if it fails, the vmbus interrupt service routine is called which in turn calls relid2channel() and can cause a null pointer dereference. Print a warning and error out in relid2channel() for a channel id that's invalid in the second kernel. Fixes: 8b6a877c060e ("Drivers: hv: vmbus: Replace the per-CPU channel lists with a global array of channels") Signed-off-by: Mohammed Gamal Reviewed-by: Dexuan Cui Link: https://lore.kernel.org/r/20230217204411.212709-1-mgamal@redhat.com Signed-off-by: Wei Liu commit ceac10c83b330680cc01ceaaab86cd49f4f30d81 Author: Andrew Jeffery Date: Wed Feb 22 00:10:14 2023 +0100 ARM: 9290/1: uaccess: Fix KASAN false-positives __copy_to_user_memcpy() and __clear_user_memset() had been calling memcpy() and memset() respectively, leading to false-positive KASAN reports when starting userspace: [ 10.707901] Run /init as init process [ 10.731892] process '/bin/busybox' started with executable stack [ 10.745234] ================================================================== [ 10.745796] BUG: KASAN: user-memory-access in __clear_user_memset+0x258/0x3ac [ 10.747260] Write of size 2687 at addr 000de581 by task init/1 Use __memcpy() and __memset() instead to allow userspace access, which is of course the intent of these functions. Signed-off-by: Andrew Jeffery Signed-off-by: Zev Weiss Reviewed-by: Arnd Bergmann Signed-off-by: Russell King (Oracle) commit 0d00cd114f20e4a6db37e4b08435c27acc1d1db0 Author: Dmitry Baryshkov Date: Thu Jan 5 02:22:21 2023 +0200 interconnect: qcom: sm8550: switch to qcom_icc_rpmh_* function Change sm8550 interconnect driver to use generic qcom_icc_rpmh_* functions rather than embedding a copy of thema. This also fixes an overallocation of memory for icc_onecell_data structure. Fixes: e6f0d6a30f73 ("interconnect: qcom: Add SM8550 interconnect provider driver") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230105002221.1416479-4-dmitry.baryshkov@linaro.org Signed-off-by: Georgi Djakov commit 87e8fab1917a2b3f6e3dedfd1cdf22a1416e6676 Author: Dmitry Baryshkov Date: Thu Jan 5 02:22:20 2023 +0200 interconnect: qcom: sm8450: switch to qcom_icc_rpmh_* function Change sm8450 interconnect driver to use generic qcom_icc_rpmh_* functions rather than embedding a copy of thema. This also fixes an overallocation of memory for icc_onecell_data structure. Fixes: fafc114a468e ("interconnect: qcom: Add SM8450 interconnect provider driver") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230105002221.1416479-3-dmitry.baryshkov@linaro.org Signed-off-by: Georgi Djakov commit f77ebdda0ee652124061c2ac42399bb6c367e729 Author: Dmitry Baryshkov Date: Thu Jan 5 02:22:19 2023 +0200 interconnect: qcom: osm-l3: fix icc_onecell_data allocation This is a struct with a trailing zero-length array of icc_node pointers but it's allocated as if it were a single array of icc_nodes instead. Fortunately this overallocates memory rather then allocating less memory than required. Fix by replacing devm_kcalloc() with devm_kzalloc() and struct_size() macro. Fixes: 5bc9900addaf ("interconnect: qcom: Add OSM L3 interconnect provider support") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230105002221.1416479-2-dmitry.baryshkov@linaro.org Signed-off-by: Georgi Djakov commit 913a956c4363c3b5fd13d3a00836fad4c46646a7 Author: Dario Binacchi Date: Mon Feb 27 21:51:31 2023 +0100 pinctrl: stm32: use dynamic allocation of GPIO base Since commit 502df79b860563d7 ("gpiolib: Warn on drivers still using static gpiobase allocation"), one or more warnings are printed during boot on systems where static allocation of GPIO base is used: [ 0.197707] gpio gpiochip0: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.199942] stm32f429-pinctrl soc:pinctrl@40020000: GPIOA bank added [ 0.200711] gpio gpiochip1: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.202855] stm32f429-pinctrl soc:pinctrl@40020000: GPIOB bank added [ 0.203591] gpio gpiochip2: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.205704] stm32f429-pinctrl soc:pinctrl@40020000: GPIOC bank added [ 0.206338] gpio gpiochip3: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.208448] stm32f429-pinctrl soc:pinctrl@40020000: GPIOD bank added [ 0.209182] gpio gpiochip4: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.211282] stm32f429-pinctrl soc:pinctrl@40020000: GPIOE bank added [ 0.212094] gpio gpiochip5: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.214270] stm32f429-pinctrl soc:pinctrl@40020000: GPIOF bank added [ 0.215005] gpio gpiochip6: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.217110] stm32f429-pinctrl soc:pinctrl@40020000: GPIOG bank added [ 0.217845] gpio gpiochip7: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.219959] stm32f429-pinctrl soc:pinctrl@40020000: GPIOH bank added [ 0.220602] gpio gpiochip8: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.222714] stm32f429-pinctrl soc:pinctrl@40020000: GPIOI bank added [ 0.223483] gpio gpiochip9: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.225594] stm32f429-pinctrl soc:pinctrl@40020000: GPIOJ bank added [ 0.226336] gpio gpiochip10: Static allocation of GPIO base is deprecated, use dynamic allocation. [ 0.228490] stm32f429-pinctrl soc:pinctrl@40020000: GPIOK bank added So let's follow the suggestion and use dynamic allocation. Tested on STM32F429I-DISC1 board. Signed-off-by: Dario Binacchi Link: https://lore.kernel.org/r/20230227205131.2104082-1-dario.binacchi@amarulasolutions.com Signed-off-by: Linus Walleij commit 657fd9da2d4b4aa0a384105b236baa22fa0233bf Author: Horatiu Vultur Date: Mon Feb 6 21:37:20 2023 +0100 pinctrl: ocelot: Fix alt mode for ocelot In case the driver was trying to set an alternate mode for gpio 0 or 32 then the mode was not set correctly. The reason is that there is computation error inside the function ocelot_pinmux_set_mux because in this case it was trying to shift to left by -1. Fix this by actually shifting the function bits and not the position. Fixes: 4b36082e2e09 ("pinctrl: ocelot: fix pinmuxing for pins after 31") Signed-off-by: Horatiu Vultur Link: https://lore.kernel.org/r/20230206203720.1177718-1-horatiu.vultur@microchip.com Signed-off-by: Linus Walleij commit 7bb97e360acdd38b68ad0a1defb89c6e89c85596 Author: Johan Hovold Date: Fri Feb 24 14:08:28 2023 +0100 pinctrl: at91-pio4: fix domain name assignment Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name information only") an IRQ domain is always given a name during allocation (e.g. used for the debugfs entry). Drop the no longer valid name assignment, which would lead to an attempt to free a string constant when removing the domain on late probe failures (e.g. probe deferral). Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only") Cc: stable@vger.kernel.org # 4.13 Signed-off-by: Johan Hovold Reviewed-by: Claudiu Beznea Tested-by: Claudiu Beznea # on SAMA7G5 Link: https://lore.kernel.org/r/20230224130828.27985-1-johan+linaro@kernel.org Signed-off-by: Linus Walleij commit 6de67ca4dab7d855ef9598cd894cd7dfa4077f96 Author: Arınç ÜNAL Date: Sat Feb 18 09:51:07 2023 +0300 pinctrl: mediatek: fix naming inconsistency Some options include "MediaTek", some "Mediatek". Rename all to "MediaTek" to address the naming inconsistency. Signed-off-by: Arınç ÜNAL Reviewed-by: Daniel Golle Link: https://lore.kernel.org/r/20230218065108.8958-2-arinc.unal@arinc9.com Signed-off-by: Linus Walleij commit c0ad453e94e5c404efbcf668648d07eaa1a71ed7 Author: Arınç ÜNAL Date: Sat Feb 18 09:51:06 2023 +0300 pinctrl: mediatek: add missing options to PINCTRL_MT7981 There are options missing from PINCTRL_MT7981 whilst being on every other pin controller. Add them. Signed-off-by: Arınç ÜNAL Acked-by: Daniel Golle Link: https://lore.kernel.org/r/20230218065108.8958-1-arinc.unal@arinc9.com Signed-off-by: Linus Walleij commit e36a82bebbf7da814530d5a179bef9df5934b717 Author: Michael Schmitz Date: Wed Mar 1 15:11:07 2023 +1300 m68k: Only force 030 bus error if PC not in exception table __get_kernel_nofault() does copy data in supervisor mode when forcing a task backtrace log through /proc/sysrq_trigger. This is expected cause a bus error exception on e.g. NULL pointer dereferencing when logging a kernel task has no workqueue associated. This bus error ought to be ignored. Our 030 bus error handler is ill equipped to deal with this: Whenever ssw indicates a kernel mode access on a data fault, we don't even attempt to handle the fault and instead always send a SEGV signal (or panic). As a result, the check for exception handling at the fault PC (buried in send_sig_fault() which gets called from do_page_fault() eventually) is never used. In contrast, both 040 and 060 access error handlers do not care whether a fault happened on supervisor mode access, and will call do_page_fault() on those, ultimately honoring the exception table. Add a check in bus_error030 to call do_page_fault() in case we do have an entry for the fault PC in our exception table. I had attempted a fix for this earlier in 2019 that did rely on testing pagefault_disabled() (see link below) to achieve the same thing, but this patch should be more generic. Tested on 030 Atari Falcon. Reported-by: Eero Tamminen Link: https://lore.kernel.org/r/alpine.LNX.2.21.1904091023540.25@nippy.intranet Link: https://lore.kernel.org/r/63130691-1984-c423-c1f2-73bfd8d3dcd3@gmail.com Signed-off-by: Michael Schmitz Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230301021107.26307-1-schmitzmic@gmail.com Signed-off-by: Geert Uytterhoeven commit d4b97925e87eb133e400fe4a482d750c74ce392f Author: Geert Uytterhoeven Date: Mon Feb 27 21:14:13 2023 +0100 m68k: mm: Move initrd phys_to_virt handling after paging_init() When booting with an initial ramdisk on platforms where physical memory does not start at address zero (e.g. on Amiga): initrd: 0ef0602c - 0f800000 Zone ranges: DMA [mem 0x0000000008000000-0x000000f7ffffffff] Normal empty Movable zone start for each node Early memory node ranges node 0: [mem 0x0000000008000000-0x000000000f7fffff] Initmem setup node 0 [mem 0x0000000008000000-0x000000000f7fffff] Unable to handle kernel access at virtual address (ptrval) Oops: 00000000 Modules linked in: PC: [<00201d3c>] memcmp+0x28/0x56 As phys_to_virt() relies on m68k_memoffset and module_fixup(), it must not be called before paging_init(). Hence postpone the phys_to_virt handling for the initial ramdisk until after calling paging_init(). While at it, reduce #ifdef clutter by using IS_ENABLED() instead. Fixes: 376e3fdecb0dcae2 ("m68k: Enable memtest functionality") Reported-by: Stephen Walsh Link: https://lists.debian.org/debian-68k/2022/09/msg00007.html Reported-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/4f45f05f377bf3f5baf88dbd5c3c8aeac59d94f0.camel@physik.fu-berlin.de Signed-off-by: Geert Uytterhoeven Acked-by: Finn Thain Link: https://lore.kernel.org/r/dff216da09ab7a60217c3fc2147e671ae07d636f.1677528627.git.geert@linux-m68k.org commit 0d9fad91abfd723ea5070a46d98a9f4496c93ba9 Author: Kars de Jong Date: Thu Feb 23 12:23:49 2023 +0100 m68k: mm: Fix systems with memory at end of 32-bit address space The calculation of end addresses of memory chunks overflowed to 0 when a memory chunk is located at the end of 32-bit address space. This is the case for the HP300 architecture. Link: https://lore.kernel.org/linux-m68k/CACz-3rhUo5pgNwdWHaPWmz+30Qo9xCg70wNxdf7o5x-6tXq8QQ@mail.gmail.com/ Signed-off-by: Kars de Jong Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230223112349.26675-1-jongk@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit 14e998ed42208f60d5f848f5e025fa2c2e9667b0 Author: Arnaldo Carvalho de Melo Date: Mon Mar 6 09:26:35 2023 -0300 tools include UAPI: Sync linux/vhost.h with the kernel sources To get the changes in: 3b688d7a086d0438 ("vhost-vdpa: uAPI to resume the device") To pick up these changes and support them: $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > before $ cp ../linux/include/uapi/linux/vhost.h tools/include/uapi/linux/vhost.h $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > after $ diff -u before after --- before 2023-03-06 09:26:14.889251817 -0300 +++ after 2023-03-06 09:26:20.594406270 -0300 @@ -30,6 +30,7 @@ [0x77] = "VDPA_SET_CONFIG_CALL", [0x7C] = "VDPA_SET_GROUP_ASID", [0x7D] = "VDPA_SUSPEND", + [0x7E] = "VDPA_RESUME", }; static const char *vhost_virtio_ioctl_read_cmds[] = { [0x00] = "GET_FEATURES", $ For instance, see how those 'cmd' ioctl arguments get translated, now VDPA_RESUME will be as well: # perf trace -a -e ioctl --max-events=10 0.000 ( 0.011 ms): pipewire/2261 ioctl(fd: 60, cmd: SNDRV_PCM_HWSYNC, arg: 0x1) = 0 21.353 ( 0.014 ms): pipewire/2261 ioctl(fd: 60, cmd: SNDRV_PCM_HWSYNC, arg: 0x1) = 0 25.766 ( 0.014 ms): gnome-shell/2196 ioctl(fd: 14, cmd: DRM_I915_IRQ_WAIT, arg: 0x7ffe4a22c740) = 0 25.845 ( 0.034 ms): gnome-shel:cs0/2212 ioctl(fd: 14, cmd: DRM_I915_IRQ_EMIT, arg: 0x7fd43915dc70) = 0 25.916 ( 0.011 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ADDFB2, arg: 0x7ffe4a22c8a0) = 0 25.941 ( 0.025 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ATOMIC, arg: 0x7ffe4a22c840) = 0 32.915 ( 0.009 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_RMFB, arg: 0x7ffe4a22cf9c) = 0 42.522 ( 0.013 ms): gnome-shell/2196 ioctl(fd: 14, cmd: DRM_I915_IRQ_WAIT, arg: 0x7ffe4a22c740) = 0 42.579 ( 0.031 ms): gnome-shel:cs0/2212 ioctl(fd: 14, cmd: DRM_I915_IRQ_EMIT, arg: 0x7fd43915dc70) = 0 42.644 ( 0.010 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ADDFB2, arg: 0x7ffe4a22c8a0) = 0 # Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Michael S. Tsirkin Cc: Namhyung Kim Cc: Sebastien Boeuf Link: https://lore.kernel.org/lkml/ZAXdCTecxSNwAoeK@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 4a02426787bf024dafdb79b362285ee325de3f5e Author: Florian Westphal Date: Fri Mar 3 10:58:56 2023 +0100 netfilter: tproxy: fix deadlock due to missing BH disable The xtables packet traverser performs an unconditional local_bh_disable(), but the nf_tables evaluation loop does not. Functions that are called from either xtables or nftables must assume that they can be called in process context. inet_twsk_deschedule_put() assumes that no softirq interrupt can occur. If tproxy is used from nf_tables its possible that we'll deadlock trying to aquire a lock already held in process context. Add a small helper that takes care of this and use it. Link: https://lore.kernel.org/netfilter-devel/401bd6ed-314a-a196-1cdc-e13c720cc8f2@balasys.hu/ Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support") Reported-and-tested-by: Major Dávid Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9f7dd42f0db1dc6915a52d4a8a96ca18dd8cc34e Author: Ivan Delalande Date: Thu Mar 2 17:48:31 2023 -0800 netfilter: ctnetlink: revert to dumping mark regardless of event type It seems that change was unintentional, we have userspace code that needs the mark while listening for events like REPLY, DESTROY, etc. Also include 0-marks in requested dumps, as they were before that fix. Fixes: 1feeae071507 ("netfilter: ctnetlink: fix compilation warning after data race fixes in ct mark") Signed-off-by: Ivan Delalande Signed-off-by: Pablo Neira Ayuso commit d49765b5f4320a402fbc4ed5edfd73d87640f27c Author: Randy Dunlap Date: Sat Feb 25 21:39:48 2023 -0800 gpio: GPIO_REGMAP: select REGMAP instead of depending on it REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it. Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues. Therefore, change the use of "depends on REGMAP" to "select REGMAP". Fixes: ebe363197e52 ("gpio: add a reusable generic gpio_chip using regmap") Signed-off-by: Randy Dunlap Cc: Michael Walle Cc: Linus Walleij Cc: Bartosz Golaszewski Cc: linux-gpio@vger.kernel.org Acked-by: Michael Walle Signed-off-by: Bartosz Golaszewski commit 7af9da8ce8f9a16221ecd8ba4280582f5bd452fc Author: Sanjay R Mehta Date: Tue Feb 14 13:13:50 2023 -0600 thunderbolt: Add quirk to disable CLx Add QUIRK_NO_CLX to disable the CLx state for hardware which doesn't supports it. AMD Yellow Carp and Pink Sardine don't support CLx state, hence disabling it using QUIRK_NO_CLX. Cc: stable@vger.kernel.org Signed-off-by: Sanjay R Mehta Signed-off-by: Basavaraj Natikar [mw: added debug log when the quirk is run] Signed-off-by: Mika Westerberg commit 89b59a84cb166f1ab5b6de9830e61324937c661e Author: Selvin Xavier Date: Fri Mar 3 18:43:58 2023 -0800 bnxt_en: Fix the double free during device removal Following warning reported by KASAN during driver unload ================================================================== BUG: KASAN: double-free in bnxt_remove_one+0x103/0x200 [bnxt_en] Free of addr ffff88814e8dd4c0 by task rmmod/17469 CPU: 47 PID: 17469 Comm: rmmod Kdump: loaded Tainted: G S 6.2.0-rc7+ #2 Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.3.10 08/15/2019 Call Trace: dump_stack_lvl+0x33/0x46 print_report+0x17b/0x4b3 ? __call_rcu_common.constprop.79+0x27e/0x8c0 ? __pfx_free_object_rcu+0x10/0x10 ? __virt_addr_valid+0xe3/0x160 ? bnxt_remove_one+0x103/0x200 [bnxt_en] kasan_report_invalid_free+0x64/0xd0 ? bnxt_remove_one+0x103/0x200 [bnxt_en] ? bnxt_remove_one+0x103/0x200 [bnxt_en] __kasan_slab_free+0x179/0x1c0 ? bnxt_remove_one+0x103/0x200 [bnxt_en] __kmem_cache_free+0x194/0x350 bnxt_remove_one+0x103/0x200 [bnxt_en] pci_device_remove+0x62/0x110 device_release_driver_internal+0xf6/0x1c0 driver_detach+0x76/0xe0 bus_remove_driver+0x89/0x160 pci_unregister_driver+0x26/0x110 ? strncpy_from_user+0x188/0x1c0 bnxt_exit+0xc/0x24 [bnxt_en] __x64_sys_delete_module+0x21f/0x390 ? __pfx___x64_sys_delete_module+0x10/0x10 ? __pfx_mem_cgroup_handle_over_high+0x10/0x10 ? _raw_spin_lock+0x87/0xe0 ? __pfx__raw_spin_lock+0x10/0x10 ? __audit_syscall_entry+0x185/0x210 ? ktime_get_coarse_real_ts64+0x51/0x80 ? syscall_trace_enter.isra.18+0x126/0x1a0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7effcb6fd71b Code: 73 01 c3 48 8b 0d 6d 17 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 17 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffeada270b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 00005623660e0750 RCX: 00007effcb6fd71b RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005623660e07b8 RBP: 0000000000000000 R08: 00007ffeada26031 R09: 0000000000000000 R10: 00007effcb771280 R11: 0000000000000206 R12: 00007ffeada272e0 R13: 00007ffeada28bc4 R14: 00005623660e02a0 R15: 00005623660e0750 Auxiliary device structures are freed in bnxt_aux_dev_release. So avoid calling kfree from bnxt_remove_one. Also, set bp->edev to NULL before freeing the auxilary private structure. Fixes: d80d88b0dfff ("bnxt_en: Add auxiliary driver support") Reviewed-by: Ajit Khaparde Reviewed-by: Andy Gospodarek Signed-off-by: Selvin Xavier Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit accd7e23693aaaa9aa0d3e9eca0ae77d1be80ab3 Author: Michael Chan Date: Fri Mar 3 18:43:57 2023 -0800 bnxt_en: Avoid order-5 memory allocation for TPA data The driver needs to keep track of all the possible concurrent TPA (GRO/LRO) completions on the aggregation ring. On P5 chips, the maximum number of concurrent TPA is 256 and the amount of memory we allocate is order-5 on systems using 4K pages. Memory allocation failure has been reported: NetworkManager: page allocation failure: order:5, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 CPU: 15 PID: 2995 Comm: NetworkManager Kdump: loaded Not tainted 5.10.156 #1 Hardware name: Dell Inc. PowerEdge R660/0M1CC5, BIOS 0.2.25 08/12/2022 Call Trace: dump_stack+0x57/0x6e warn_alloc.cold.120+0x7b/0xdd ? _cond_resched+0x15/0x30 ? __alloc_pages_direct_compact+0x15f/0x170 __alloc_pages_slowpath.constprop.108+0xc58/0xc70 __alloc_pages_nodemask+0x2d0/0x300 kmalloc_order+0x24/0xe0 kmalloc_order_trace+0x19/0x80 bnxt_alloc_mem+0x1150/0x15c0 [bnxt_en] ? bnxt_get_func_stat_ctxs+0x13/0x60 [bnxt_en] __bnxt_open_nic+0x12e/0x780 [bnxt_en] bnxt_open+0x10b/0x240 [bnxt_en] __dev_open+0xe9/0x180 __dev_change_flags+0x1af/0x220 dev_change_flags+0x21/0x60 do_setlink+0x35c/0x1100 Instead of allocating this big chunk of memory and dividing it up for the concurrent TPA instances, allocate each small chunk separately for each TPA instance. This will reduce it to order-0 allocations. Fixes: 79632e9ba386 ("bnxt_en: Expand bnxt_tpa_info struct to support 57500 chips.") Reviewed-by: Somnath Kotur Reviewed-by: Damodharam Ammepalli Reviewed-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit f4b47a2e9463950df3e7c8b70e017877c1d4eb11 Author: Russell King (Oracle) Date: Fri Mar 3 16:37:54 2023 +0000 net: phylib: get rid of unnecessary locking The locking in phy_probe() and phy_remove() does very little to prevent any races with e.g. phy_attach_direct(), but instead causes lockdep ABBA warnings. Remove it. ====================================================== WARNING: possible circular locking dependency detected 6.2.0-dirty #1108 Tainted: G W E ------------------------------------------------------ ip/415 is trying to acquire lock: ffff5c268f81ef50 (&dev->lock){+.+.}-{3:3}, at: phy_attach_direct+0x17c/0x3a0 [libphy] but task is already holding lock: ffffaef6496cb518 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x154/0x560 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (rtnl_mutex){+.+.}-{3:3}: __lock_acquire+0x35c/0x6c0 lock_acquire.part.0+0xcc/0x220 lock_acquire+0x68/0x84 __mutex_lock+0x8c/0x414 mutex_lock_nested+0x34/0x40 rtnl_lock+0x24/0x30 sfp_bus_add_upstream+0x34/0x150 phy_sfp_probe+0x4c/0x94 [libphy] mv3310_probe+0x148/0x184 [marvell10g] phy_probe+0x8c/0x200 [libphy] call_driver_probe+0xbc/0x15c really_probe+0xc0/0x320 __driver_probe_device+0x84/0x120 driver_probe_device+0x44/0x120 __device_attach_driver+0xc4/0x160 bus_for_each_drv+0x80/0xe0 __device_attach+0xb0/0x1f0 device_initial_probe+0x1c/0x2c bus_probe_device+0xa4/0xb0 device_add+0x360/0x53c phy_device_register+0x60/0xa4 [libphy] fwnode_mdiobus_phy_device_register+0xc0/0x190 [fwnode_mdio] fwnode_mdiobus_register_phy+0x160/0xd80 [fwnode_mdio] of_mdiobus_register+0x140/0x340 [of_mdio] orion_mdio_probe+0x298/0x3c0 [mvmdio] platform_probe+0x70/0xe0 call_driver_probe+0x34/0x15c really_probe+0xc0/0x320 __driver_probe_device+0x84/0x120 driver_probe_device+0x44/0x120 __driver_attach+0x104/0x210 bus_for_each_dev+0x78/0xdc driver_attach+0x2c/0x3c bus_add_driver+0x184/0x240 driver_register+0x80/0x13c __platform_driver_register+0x30/0x3c xt_compat_calc_jump+0x28/0xa4 [x_tables] do_one_initcall+0x50/0x1b0 do_init_module+0x50/0x1fc load_module+0x684/0x744 __do_sys_finit_module+0xc4/0x140 __arm64_sys_finit_module+0x28/0x34 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x6c/0x1b0 do_el0_svc+0x34/0x44 el0_svc+0x48/0xf0 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a0/0x1a4 -> #0 (&dev->lock){+.+.}-{3:3}: check_prev_add+0xb4/0xc80 validate_chain+0x414/0x47c __lock_acquire+0x35c/0x6c0 lock_acquire.part.0+0xcc/0x220 lock_acquire+0x68/0x84 __mutex_lock+0x8c/0x414 mutex_lock_nested+0x34/0x40 phy_attach_direct+0x17c/0x3a0 [libphy] phylink_fwnode_phy_connect.part.0+0x70/0xe4 [phylink] phylink_fwnode_phy_connect+0x48/0x60 [phylink] mvpp2_open+0xec/0x2e0 [mvpp2] __dev_open+0x104/0x214 __dev_change_flags+0x1d4/0x254 dev_change_flags+0x2c/0x7c do_setlink+0x254/0xa50 __rtnl_newlink+0x430/0x514 rtnl_newlink+0x58/0x8c rtnetlink_rcv_msg+0x17c/0x560 netlink_rcv_skb+0x64/0x150 rtnetlink_rcv+0x20/0x30 netlink_unicast+0x1d4/0x2b4 netlink_sendmsg+0x1a4/0x400 ____sys_sendmsg+0x228/0x290 ___sys_sendmsg+0x88/0xec __sys_sendmsg+0x70/0xd0 __arm64_sys_sendmsg+0x2c/0x40 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x6c/0x1b0 do_el0_svc+0x34/0x44 el0_svc+0x48/0xf0 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a0/0x1a4 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rtnl_mutex); lock(&dev->lock); lock(rtnl_mutex); lock(&dev->lock); *** DEADLOCK *** Fixes: 298e54fa810e ("net: phy: add core phylib sfp support") Reported-by: Marc Zyngier Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit b2b76e977fc6bc38e6a4dedb62b34bc90cc6ce97 Author: Cristian Marussi Date: Thu Feb 23 15:23:30 2023 +0000 firmware: arm_scmi: Fix raw coexistence mode behaviour on failure path When SCMI raw coexistence mode is enabled make the core stack probe successfully even when the initial base protocol exchanges with the platform/server failed. This behaviour enables the system to boot with a broken regular SCMI stack but with a fully functional and accessible SCMI raw debugfs interface that can be used to further debug the issue. Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20230223152330.2707260-1-cristian.marussi@arm.com Signed-off-by: Sudeep Holla commit 418a406d92cc276ddf81d4223271af1ae09fa5af Author: Ye Xingchen Date: Fri Feb 10 15:20:07 2023 +0800 firmware: arm_scmi: Remove duplicate include header inclusion linux/of.h is included more than once, just remove the duplicate include header inclusion. Signed-off-by: Ye Xingchen Link: https://lore.kernel.org/r/202302101520071730986@zte.com.cn Signed-off-by: Sudeep Holla commit 6bed395d7db2c039c0ef4123a379e27c528a3357 Author: Dan Carpenter Date: Wed Feb 22 18:17:06 2023 +0300 firmware: arm_scmi: Return a literal instead of a variable In this context "return scmi_dev;" and "return NULL;" are equivalent but it is more readable to return a literal. Signed-off-by: Dan Carpenter Reviewed-by: Cristian Marussi Link: https://lore.kernel.org/r/Y/Yx8pOdf8rNhPVe@kili Signed-off-by: Sudeep Holla commit 8ab5059dc4f4c34325eba6270ef12a4ab1386019 Author: Dan Carpenter Date: Mon Jan 23 18:07:07 2023 +0300 firmware: arm_scmi: Clean up a return statement in scmi_probe The comments say "enabled" where "disabled" is intended. Also it's cleaner to return zero explicitly instead of ret. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Y86im5M49p3ePGxj@kili Signed-off-by: Sudeep Holla commit 5c8cf1664f288098a971a1d1e65716a2b6a279e1 Author: Christian Hewitt Date: Fri Mar 3 12:33:12 2023 +0000 drm/meson: fix 1px pink line on GXM when scaling video overlay Playing media with a resolution smaller than the crtc size requires the video overlay to be scaled for output and GXM boards display a 1px pink line on the bottom of the scaled overlay. Comparing with the downstream vendor driver revealed VPP_DUMMY_DATA not being set [0]. Setting VPP_DUMMY_DATA prevents the 1px pink line from being seen. [0] https://github.com/endlessm/linux-s905x/blob/master/drivers/amlogic/amports/video.c#L7869 Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") Suggested-by: Martin Blumenstingl Signed-off-by: Christian Hewitt Acked-by: Martin Blumenstingl Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230303123312.155164-1-christianshewitt@gmail.com commit a9334b702a03b693f54ebd3b98f67bf722b74870 Author: Rongguang Wei Date: Thu Mar 2 14:21:43 2023 +0800 net: stmmac: add to set device wake up flag when stmmac init phy When MAC is not support PMT, driver will check PHY's WoL capability and set device wakeup capability in stmmac_init_phy(). We can enable the WoL through ethtool, the driver would enable the device wake up flag. Now the device_may_wakeup() return true. But if there is a way which enable the PHY's WoL capability derectly, like in BIOS. The driver would not know the enable thing and would not set the device wake up flag. The phy_suspend may failed like this: [ 32.409063] PM: dpm_run_callback(): mdio_bus_phy_suspend+0x0/0x50 returns -16 [ 32.409065] PM: Device stmmac-1:00 failed to suspend: error -16 [ 32.409067] PM: Some devices failed to suspend, or early wake event detected Add to set the device wakeup enable flag according to the get_wol function result in PHY can fix the error in this scene. v2: add a Fixes tag. Fixes: 1d8e5b0f3f2c ("net: stmmac: Support WOL with phy") Signed-off-by: Rongguang Wei Signed-off-by: David S. Miller commit ec738ca127d07ecac6afae36e2880341ec89150e Author: Greg Kroah-Hartman Date: Wed Feb 8 17:02:30 2023 +0100 mtd: spi-nor: fix memory leak when using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To solve this, remove the lookup and create the directory on the first device found, and then remove it when the module is unloaded. Cc: Tudor Ambarus Cc: Pratyush Yadav Cc: Miquel Raynal Cc: Richard Weinberger Cc: Vignesh Raghavendra Cc: linux-mtd@lists.infradead.org Reviewed-by: Michael Walle Link: https://lore.kernel.org/r/20230208160230.2179905-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 916508c30e22f658f12dc736f8198d8a096cb24d Author: Michael Walle Date: Tue Feb 7 14:10:20 2023 +0100 Revert "arm64: dts: ls1028a: sl28: get MAC addresses from VPD" With commit b203e6f1e833 ("arm64: dts: ls1028a: sl28: get MAC addresses from VPD"), the network adapter now depends on the nvmem device to be present, which isn't the case and thus breaks networking on this board. Revert it. Fixes: b203e6f1e833 ("arm64: dts: ls1028a: sl28: get MAC addresses from VPD") Signed-off-by: Michael Walle Signed-off-by: Shawn Guo commit fd4334a06d452ce89a0bb831b03130c51331d927 Author: Alexander Stein Date: Tue Jan 31 11:35:58 2023 +0100 arm64: dts: freescale: imx8-ss-lsio: Fix flexspi clock order The correct clock order is "fspi_en" and "fspi". As they are identical just reordering the names is sufficient. Fixes: 6276d66984e9 ("arm64: dts: imx8dxl: add flexspi0 support") Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit d0dc41119905f740e8d5594adce277f7c0de8c92 Author: Zhang Xiaoxu Date: Wed Nov 16 11:11:36 2022 +0800 cifs: Move the in_send statistic to __smb_send_rqst() When send SMB_COM_NT_CANCEL and RFC1002_SESSION_REQUEST, the in_send statistic was lost. Let's move the in_send statistic to the send function to avoid this scenario. Fixes: 7ee1af765dfa ("[CIFS]") Signed-off-by: Zhang Xiaoxu Signed-off-by: Steve French commit e5e7e398f6bb7918dab0612eb6991f7bae95520d Author: Ravulapati Vishnu Vardhan Rao Date: Sat Mar 4 13:37:02 2023 +0530 ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds When we run syzkaller we get below Out of Bound. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the issue: dump_backtrace+0x0/0x4c8 show_stack+0x34/0x44 dump_stack_lvl+0xd8/0x118 print_address_description+0x30/0x2d8 kasan_report+0x158/0x198 __asan_report_load4_noabort+0x44/0x50 regcache_flat_read+0x10c/0x110 regcache_read+0xf4/0x180 _regmap_read+0xc4/0x278 _regmap_update_bits+0x130/0x290 regmap_update_bits_base+0xc0/0x15c snd_soc_component_update_bits+0xa8/0x22c snd_soc_component_write_field+0x68/0xd4 tx_macro_digital_mute+0xec/0x140 Actually There is no need to have decimator with 32 bits. By limiting the variable with short type u8 issue is resolved. Signed-off-by: Ravulapati Vishnu Vardhan Rao Link: https://lore.kernel.org/r/20230304080702.609-1-quic_visr@quicinc.com Signed-off-by: Mark Brown commit 65882134bc622a1e57bd5928ac588855ea2e3ddd Author: Krzysztof Kozlowski Date: Thu Mar 2 13:29:08 2023 +0100 ASoC: qcom: q6prm: fix incorrect clk_root passed to ADSP The second to last argument is clk_root (root of the clock), however the code called q6prm_request_lpass_clock() with clk_attr instead (copy-paste error). This effectively was passing value of 1 as root clock which worked on some of the SoCs (e.g. SM8450) but fails on others, depending on the ADSP. For example on SM8550 this "1" as root clock is not accepted and results in errors coming from ADSP. Fixes: 2f20640491ed ("ASoC: qdsp6: qdsp6: q6prm: handle clk disable correctly") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230302122908.221398-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 03d0f97fdb45c99cf6f808832db8bd5534e22374 Author: Luca Ceresoli Date: Fri Mar 3 10:34:10 2023 +0100 ASoC: clarify that SND_SOC_IMX_SGTL5000 is the old driver Both SND_SOC_IMX_SGTL5000 and SND_SOC_FSL_ASOC_CARD implement the fsl,imx-audio-sgtl5000 compatible string, which is confusing. It took a little research to find out that the latter is much newer and it is supposed to be the preferred choice since several years. Add a clarification note to avoid wasting time for future readers. Signed-off-by: Luca Ceresoli Link: https://lore.kernel.org/r/20230303093410.357621-1-luca.ceresoli@bootlin.com Signed-off-by: Mark Brown commit 8ac5b996bf5199f15b7687ceae989f8b2a410dda Author: Dave Chinner Date: Sun Mar 5 15:13:23 2023 -0800 xfs: fix off-by-one-block in xfs_discard_folio() The recent writeback corruption fixes changed the code in xfs_discard_folio() to calculate a byte range to for punching delalloc extents. A mistake was made in using round_up(pos) for the end offset, because when pos points at the first byte of a block, it does not get rounded up to point to the end byte of the block. hence the punch range is short, and this leads to unexpected behaviour in certain cases in xfs_bmap_punch_delalloc_range. e.g. pos = 0 means we call xfs_bmap_punch_delalloc_range(0,0), so there is no previous extent and it rounds up the punch to the end of the delalloc extent it found at offset 0, not the end of the range given to xfs_bmap_punch_delalloc_range(). Fix this by handling the zero block offset case correctly. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=217030 Link: https://lore.kernel.org/linux-xfs/Y+vOfaxIWX1c%2Fyy9@bfoster/ Fixes: 7348b322332d ("xfs: xfs_bmap_punch_delalloc_range() should take a byte range") Reported-by: Pengfei Xu Found-by: Brian Foster Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 0c7273e494dd5121e20e160cb2f047a593ee14a8 Author: Dave Chinner Date: Sun Mar 5 15:13:22 2023 -0800 xfs: quotacheck failure can race with background inode inactivation The background inode inactivation can attached dquots to inodes, but this can race with a foreground quotacheck failure that leads to disabling quotas and freeing the mp->m_quotainfo structure. The background inode inactivation then tries to allocate a quota, tries to dereference mp->m_quotainfo, and crashes like so: XFS (loop1): Quotacheck: Unsuccessful (Error -5): Disabling quotas. xfs filesystem being mounted at /root/syzkaller.qCVHXV/0/file0 supports timestamps until 2038 (0x7fffffff) BUG: kernel NULL pointer dereference, address: 00000000000002a8 .... CPU: 0 PID: 161 Comm: kworker/0:4 Not tainted 6.2.0-c9c3395d5e3d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: xfs-inodegc/loop1 xfs_inodegc_worker RIP: 0010:xfs_dquot_alloc+0x95/0x1e0 .... Call Trace: xfs_qm_dqread+0x46/0x440 xfs_qm_dqget_inode+0x154/0x500 xfs_qm_dqattach_one+0x142/0x3c0 xfs_qm_dqattach_locked+0x14a/0x170 xfs_qm_dqattach+0x52/0x80 xfs_inactive+0x186/0x340 xfs_inodegc_worker+0xd3/0x430 process_one_work+0x3b1/0x960 worker_thread+0x52/0x660 kthread+0x161/0x1a0 ret_from_fork+0x29/0x50 .... Prevent this race by flushing all the queued background inode inactivations pending before purging all the cached dquots when quotacheck fails. Reported-by: Pengfei Xu Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 48e8186870d9d0902e712d601ccb7098cb220688 Author: Tony O'Brien Date: Wed Feb 22 13:52:28 2023 +1300 hwmon: (adt7475) Fix masking of hysteresis registers The wrong bits are masked in the hysteresis register; indices 0 and 2 should zero bits [7:4] and preserve bits [3:0], and index 1 should zero bits [3:0] and preserve bits [7:4]. Fixes: 1c301fc5394f ("hwmon: Add a driver for the ADT7475 hardware monitoring chip") Signed-off-by: Tony O'Brien Link: https://lore.kernel.org/r/20230222005228.158661-3-tony.obrien@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit 5f8d1e3b6f9b5971f9c06d5846ce00c49e3a8d94 Author: Tony O'Brien Date: Wed Feb 22 13:52:27 2023 +1300 hwmon: (adt7475) Display smoothing attributes in correct order Throughout the ADT7475 driver, attributes relating to the temperature sensors are displayed in the order Remote 1, Local, Remote 2. Make temp_st_show() conform to this expectation so that values set by temp_st_store() can be displayed using the correct attribute. Fixes: 8f05bcc33e74 ("hwmon: (adt7475) temperature smoothing") Signed-off-by: Tony O'Brien Link: https://lore.kernel.org/r/20230222005228.158661-2-tony.obrien@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit fe15c26ee26efa11741a7b632e9f23b01aca4cc6 Author: Linus Torvalds Date: Sun Mar 5 14:52:03 2023 -0800 Linux 6.3-rc1 commit 596ff4a09b8981790e15572e8e7bc904df5835e7 Author: Linus Torvalds Date: Sat Mar 4 13:35:43 2023 -0800 cpumask: re-introduce constant-sized cpumask optimizations Commit aa47a7c215e7 ("lib/cpumask: deprecate nr_cpumask_bits") resulted in the cpumask operations potentially becoming hugely less efficient, because suddenly the cpumask was always considered to be variable-sized. The optimization was then later added back in a limited form by commit 6f9c07be9d02 ("lib/cpumask: add FORCE_NR_CPUS config option"), but that FORCE_NR_CPUS option is not useful in a generic kernel and more of a special case for embedded situations with fixed hardware. Instead, just re-introduce the optimization, with some changes. Instead of depending on CPUMASK_OFFSTACK being false, and then always using the full constant cpumask width, this introduces three different cpumask "sizes": - the exact size (nr_cpumask_bits) remains identical to nr_cpu_ids. This is used for situations where we should use the exact size. - the "small" size (small_cpumask_bits) is the NR_CPUS constant if it fits in a single word and the bitmap operations thus end up able to trigger the "small_const_nbits()" optimizations. This is used for the operations that have optimized single-word cases that get inlined, notably the bit find and scanning functions. - the "large" size (large_cpumask_bits) is the NR_CPUS constant if it is an sufficiently small constant that makes simple "copy" and "clear" operations more efficient. This is arbitrarily set at four words or less. As a an example of this situation, without this fixed size optimization, cpumask_clear() will generate code like movl nr_cpu_ids(%rip), %edx addq $63, %rdx shrq $3, %rdx andl $-8, %edx callq memset@PLT on x86-64, because it would calculate the "exact" number of longwords that need to be cleared. In contrast, with this patch, using a MAX_CPU of 64 (which is quite a reasonable value to use), the above becomes a single movq $0,cpumask instruction instead, because instead of caring to figure out exactly how many CPU's the system has, it just knows that the cpumask will be a single word and can just clear it all. Note that this does end up tightening the rules a bit from the original version in another way: operations that set bits in the cpumask are now limited to the actual nr_cpu_ids limit, whereas we used to do the nr_cpumask_bits thing almost everywhere in the cpumask code. But if you just clear bits, or scan for bits, we can use the simpler compile-time constants. In the process, remove 'cpumask_complement()' and 'for_each_cpu_not()' which were not useful, and which fundamentally have to be limited to 'nr_cpu_ids'. Better remove them now than have somebody introduce use of them later. Of course, on x86-64 with MAXSMP there is no sane small compile-time constant for the cpumask sizes, and we end up using the actual CPU bits, and will generate the above kind of horrors regardless. Please don't use MAXSMP unless you really expect to have machines with thousands of cores. Signed-off-by: Linus Torvalds commit f915322fe014c5c515119381e886faf07b3c9d31 Merge: 7f9ec7d8169b5 660ca9470f9c6 Author: Linus Torvalds Date: Sun Mar 5 11:32:30 2023 -0800 Merge tag 'v6.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a regression in the caam driver" * tag 'v6.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: caam - Fix edesc/iv ordering mixup commit 7f9ec7d8169b5281eff2b907d8ffb1bf56045f73 Merge: 4e9c542c7a51b dd093fb08e8f8 Author: Linus Torvalds Date: Sun Mar 5 11:27:48 2023 -0800 Merge tag 'x86-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 updates from Thomas Gleixner: "A small set of updates for x86: - Return -EIO instead of success when the certificate buffer for SEV guests is not large enough - Allow STIPB to be enabled with legacy IBSR. Legacy IBRS is cleared on return to userspace for performance reasons, but the leaves user space vulnerable to cross-thread attacks which STIBP prevents. Update the documentation accordingly" * tag 'x86-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: virt/sev-guest: Return -EIO if certificate buffer is not large enough Documentation/hw-vuln: Document the interaction between IBRS and STIBP x86/speculation: Allow enabling STIBP with legacy IBRS commit 4e9c542c7a51bcc8f6ce283459900ba47a6690f5 Merge: 1a90673e17b6b 0fb7fb713461e Author: Linus Torvalds Date: Sun Mar 5 11:19:16 2023 -0800 Merge tag 'irq-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "A set of updates for the interrupt susbsystem: - Prevent possible NULL pointer derefences in irq_data_get_affinity_mask() and irq_domain_create_hierarchy() - Take the per device MSI lock before invoking code which relies on it being hold - Make sure that MSI descriptors are unreferenced before freeing them. This was overlooked when the platform MSI code was converted to use core infrastructure and results in a fals positive warning - Remove dead code in the MSI subsystem - Clarify the documentation for pci_msix_free_irq() - More kobj_type constification" * tag 'irq-urgent-2023-03-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced genirq/msi: Drop dead domain name assignment irqdomain: Add missing NULL pointer check in irq_domain_create_hierarchy() genirq/irqdesc: Make kobj_type structures constant PCI/MSI: Clarify usage of pci_msix_free_irq() genirq/msi: Take the per-device MSI lock before validating the control structure genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() commit 1a90673e17b6bcc6b6e8c072015956a6204e0f2d Merge: 1a8d05a726dc5 3304f18bfcf58 Author: Linus Torvalds Date: Sun Mar 5 11:11:52 2023 -0800 Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs update from Al Viro: "Adding Christian Brauner as VFS co-maintainer" * tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: Adding VFS co-maintainer commit 1a8d05a726dc5b82e608f0962511e15fcbcab1ab Merge: 95207db8166ab caa82ae7ef52b Author: Linus Torvalds Date: Sun Mar 5 11:07:58 2023 -0800 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull VM_FAULT_RETRY fixes from Al Viro: "Some of the page fault handlers do not deal with the following case correctly: - handle_mm_fault() has returned VM_FAULT_RETRY - there is a pending fatal signal - fault had happened in kernel mode Correct action in such case is not "return unconditionally" - fatal signals are handled only upon return to userland and something like copy_to_user() would end up retrying the faulting instruction and triggering the same fault again and again. What we need to do in such case is to make the caller to treat that as failed uaccess attempt - handle exception if there is an exception handler for faulting instruction or oops if there isn't one. Over the years some architectures had been fixed and now are handling that case properly; some still do not. This series should fix the remaining ones. Status: - m68k, riscv, hexagon, parisc: tested/acked by maintainers. - alpha, sparc32, sparc64: tested locally - bug has been reproduced on the unpatched kernel and verified to be fixed by this series. - ia64, microblaze, nios2, openrisc: build, but otherwise completely untested" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: openrisc: fix livelock in uaccess nios2: fix livelock in uaccess microblaze: fix livelock in uaccess ia64: fix livelock in uaccess sparc: fix livelock in uaccess alpha: fix livelock in uaccess parisc: fix livelock in uaccess hexagon: fix livelock in uaccess riscv: fix livelock in uaccess m68k: fix livelock in uaccess commit 95207db8166ab95c42a03fdc5e3abd212c9987dc Author: Masahiro Yamada Date: Mon Oct 17 03:23:49 2022 +0900 Remove Intel compiler support include/linux/compiler-intel.h had no update in the past 3 years. We often forget about the third C compiler to build the kernel. For example, commit a0a12c3ed057 ("asm goto: eradicate CC_HAS_ASM_GOTO") only mentioned GCC and Clang. init/Kconfig defines CC_IS_GCC and CC_IS_CLANG but not CC_IS_ICC, and nobody has reported any issue. I guess the Intel Compiler support is broken, and nobody is caring about it. Harald Arnesen pointed out ICC (classic Intel C/C++ compiler) is deprecated: $ icc -v icc: remark #10441: The Intel(R) C++ Compiler Classic (ICC) is deprecated and will be removed from product release in the second half of 2023. The Intel(R) oneAPI DPC++/C++ Compiler (ICX) is the recommended compiler moving forward. Please transition to use this compiler. Use '-diag-disable=10441' to disable this message. icc version 2021.7.0 (gcc version 12.1.0 compatibility) Arnd Bergmann provided a link to the article, "Intel C/C++ compilers complete adoption of LLVM". lib/zstd/common/compiler.h and lib/zstd/compress/zstd_fast.c were kept untouched for better sync with https://github.com/facebook/zstd Link: https://www.intel.com/content/www/us/en/developer/articles/technical/adoption-of-llvm-complete-icx.html Signed-off-by: Masahiro Yamada Acked-by: Arnd Bergmann Reviewed-by: Nick Desaulniers Reviewed-by: Nathan Chancellor Reviewed-by: Miguel Ojeda Signed-off-by: Linus Torvalds commit 3304f18bfcf588df0fe3b703b6a6c1129d80bdc7 Author: Al Viro Date: Sat Mar 4 20:27:29 2023 -0500 Adding VFS co-maintainer Acked-by: Christian Brauner Signed-off-by: Al Viro commit b01fe98d34f3bed944a93bd8119fed80c856fad8 Merge: e77d587a2c04e 65609d3206f78 Author: Linus Torvalds Date: Sat Mar 4 14:48:29 2023 -0800 Merge tag 'i2c-for-6.3-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: "Some improvements/fixes for the newly added GXP driver and a Kconfig dependency fix" * tag 'i2c-for-6.3-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: gxp: fix an error code in probe i2c: gxp: return proper error on address NACK i2c: gxp: remove "empty" switch statement i2c: Disable I2C_APPLE when I2C_PASEMI is a builtin commit e77d587a2c04e82c6a0dffa4a32c874a4029385d Author: Linus Torvalds Date: Sat Mar 4 14:03:27 2023 -0800 mm: avoid gcc complaint about pointer casting The migration code ends up temporarily stashing information of the wrong type in unused fields of the newly allocated destination folio. That all works fine, but gcc does complain about the pointer type mis-use: mm/migrate.c: In function ‘__migrate_folio_extract’: mm/migrate.c:1050:20: note: randstruct: casting between randomized structure pointer types (ssa): ‘struct anon_vma’ and ‘struct address_space’ 1050 | *anon_vmap = (void *)dst->mapping; | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~ and gcc is actually right to complain since it really doesn't understand that this is a very temporary special case where this is ok. This could be fixed in different ways by just obfuscating the assignment sufficiently that gcc doesn't see what is going on, but the truly "proper C" way to do this is by explicitly using a union. Using unions for type conversions like this is normally hugely ugly and syntactically nasty, but this really is one of the few cases where we want to make it clear that we're not doing type conversion, we're really re-using the value bit-for-bit just using another type. IOW, this should not become a common pattern, but in this one case using that odd union is probably the best way to document to the compiler what is conceptually going on here. [ Side note: there are valid cases where we convert pointers to other pointer types, notably the whole "folio vs page" situation, where the types actually have fundamental commonalities. The fact that the gcc note is limited to just randomized structures means that we don't see equivalent warnings for those cases, but it migth also mean that we miss other cases where we do play these kinds of dodgy games, and this kind of explicit conversion might be a good idea. ] I verified that at least for an allmodconfig build on x86-64, this generates the exact same code, apart from line numbers and assembler comment changes. Fixes: 64c8902ed441 ("migrate_pages: split unmap_and_move() to _unmap() and _move()") Cc: Huang, Ying Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 20fdfd55ab5c3fdff5b43de632a8d8fb7744e186 Merge: c29214bc89169 ecf1d926661be Author: Linus Torvalds Date: Sat Mar 4 13:32:50 2023 -0800 Merge tag 'mm-hotfixes-stable-2023-03-04-13-12' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "17 hotfixes. Eight are for MM and seven are for other parts of the kernel. Seven are cc:stable and eight address post-6.3 issues or were judged unsuitable for -stable backporting" * tag 'mm-hotfixes-stable-2023-03-04-13-12' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mailmap: map Dikshita Agarwal's old address to his current one mailmap: map Vikash Garodia's old address to his current one fs/cramfs/inode.c: initialize file_ra_state fs: hfsplus: fix UAF issue in hfsplus_put_super panic: fix the panic_print NMI backtrace setting lib: parser: update documentation for match_NUMBER functions kasan, x86: don't rename memintrinsics in uninstrumented files kasan: test: fix test for new meminstrinsic instrumentation kasan: treat meminstrinsic as builtins in uninstrumented files kasan: emit different calls for instrumentable memintrinsics ocfs2: fix non-auto defrag path not working issue ocfs2: fix defrag path triggering jbd2 ASSERT mailmap: map Georgi Djakov's old Linaro address to his current one mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON lib/zlib: DFLTCC deflate does not write all available bits for Z_NO_FLUSH mm/damon/paddr: fix missing folio_put() mm/mremap: fix dup_anon_vma() in vma_merge() case 4 commit c29214bc89169f735657f614bde7c0fad74bd1b5 Merge: d172859ebff33 f8b2336f15f3b Author: Linus Torvalds Date: Sat Mar 4 11:20:42 2023 -0800 Merge tag 'powerpc-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Drop orphaned VAS MAINTAINERS entry - Fix build errors with clang and KCSAN - Avoid build errors seen with LD_DEAD_CODE_DATA_ELIMINATION together with recordmcount Thanks to Nathan Chancellor. * tag 'powerpc-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Avoid dead code/data elimination when using recordmcount powerpc/vmlinux.lds: Add .text.asan/tsan sections powerpc: Drop orphaned VAS MAINTAINERS entry commit d172859ebff33598d80089c0bec44471872d2628 Merge: 0988a0ea79199 a8e98f3448e1a Author: Linus Torvalds Date: Sat Mar 4 10:53:59 2023 -0800 Merge tag 'sound-fix-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of various small fixes that have been gathered since the last PR. The majority of changes are for ASoC, and there is a small change in ASoC PCM core, but the rest are all for driver- specific fixes / quirks / updates" * tag 'sound-fix-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (32 commits) ALSA: ice1712: Delete unreachable code in aureon_add_controls() ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC ALSA: hda/realtek: Improve support for Dell Precision 3260 ASoC: mediatek: mt8195: add missing initialization ASoC: mediatek: mt8188: add missing initialization ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43) ASoC: zl38060 add gpiolib dependency ASoC: sam9g20ek: Disable capture unless building with microphone input ASoC: mt8192: Fix range for sidetone positive gain ASoC: mt8192: Report an error if when an invalid sidetone gain is written ASoC: mt8192: Fix event generation for controls ASoC: mt8192: Remove spammy log messages ASoC: mchp-pdmc: fix poc noise at capture startup ASoC: dt-bindings: sama7g5-pdmc: add microchip,startup-delay-us binding ASoC: soc-pcm: add option to start DMA after DAI ASoC: mt8183: Fix event generation for I2S DAI operations ASoC: mt8183: Remove spammy logging from I2S DAI driver ASoC: mt6358: Remove undefined HPx Mux enumeration values ASoC: mt6358: Validate Wake on Voice 2 writes ... commit f773f0a331d6c41733b17bebbc1b6cae12e016f5 Author: ZhaoLong Wang Date: Sat Mar 4 09:41:41 2023 +0800 ubi: Fix deadlock caused by recursively holding work_sem During the processing of the bgt, if the sync_erase() return -EBUSY or some other error code in __erase_worker(),schedule_erase() called again lead to the down_read(ubi->work_sem) hold twice and may get block by down_write(ubi->work_sem) in ubi_update_fastmap(), which cause deadlock. ubi bgt other task do_work down_read(&ubi->work_sem) ubi_update_fastmap erase_worker # Blocked by down_read __erase_worker down_write(&ubi->work_sem) schedule_erase schedule_ubi_work down_read(&ubi->work_sem) Fix this by changing input parameter @nested of the schedule_erase() to 'true' to avoid recursively acquiring the down_read(&ubi->work_sem). Also, fix the incorrect comment about @nested parameter of the schedule_erase() because when down_write(ubi->work_sem) is held, the @nested is also need be true. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217093 Fixes: 2e8f08deabbc ("ubi: Fix races around ubi_refill_pools()") Signed-off-by: ZhaoLong Wang Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 3ee7cb4fdf37e3763b3b10da2a7715b7a7a2a783 Author: Arnaldo Carvalho de Melo Date: Fri Mar 3 22:36:04 2023 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes in: e7862eda309ecfcc ("x86/cpu: Support AMD Automatic IBRS") 0125acda7d76b943 ("x86/bugs: Reset speculation control settings on init") 38aaf921e92dc5cf ("perf/x86: Add Meteor Lake support") 5b6fac3fa44bafee ("x86/resctrl: Detect and configure Slow Memory Bandwidth Allocation") dc2a3e857981f859 ("x86/resctrl: Add interface to read mbm_total_bytes_config") Addressing these tools/perf build warnings: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' That makes the beautification scripts to pick some new entries: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after --- before 2023-03-03 18:26:51.766923522 -0300 +++ after 2023-03-03 18:27:09.987415481 -0300 @@ -267,9 +267,11 @@ [0xc000010e - x86_64_specific_MSRs_offset] = "AMD64_LBR_SELECT", [0xc000010f - x86_64_specific_MSRs_offset] = "AMD_DBG_EXTN_CFG", [0xc0000200 - x86_64_specific_MSRs_offset] = "IA32_MBA_BW_BASE", + [0xc0000280 - x86_64_specific_MSRs_offset] = "IA32_SMBA_BW_BASE", [0xc0000300 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS", [0xc0000301 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_CTL", [0xc0000302 - x86_64_specific_MSRs_offset] = "AMD64_PERF_CNTR_GLOBAL_STATUS_CLR", + [0xc0000400 - x86_64_specific_MSRs_offset] = "IA32_EVT_CFG_BASE", }; #define x86_AMD_V_KVM_MSRs_offset 0xc0010000 $ Now one can trace systemwide asking to see backtraces to where that MSR is being read/written, see this example with a previous update: # perf trace -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" ^C# If we use -v (verbose mode) we can see what it does behind the scenes: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr>=IA32_U_CET && msr<=IA32_INT_SSP_TAB" Using CPUID AuthenticAMD-25-21-0 0x6a0 0x6a8 New filter for msr:read_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) 0x6a0 0x6a8 New filter for msr:write_msr: (msr>=0x6a0 && msr<=0x6a8) && (common_pid != 597499 && common_pid != 3313) mmap size 528384B ^C# Example with a frequent msr: # perf trace -v -e msr:*_msr/max-stack=32/ --filter="msr==IA32_SPEC_CTRL" --max-events 2 Using CPUID AuthenticAMD-25-21-0 0x48 New filter for msr:read_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) 0x48 New filter for msr:write_msr: (msr==0x48) && (common_pid != 2612129 && common_pid != 3841) mmap size 528384B Looking at the vmlinux_path (8 entries long) symsrc__init: build id mismatch for vmlinux. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols 0.000 Timer/2525383 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule ([kernel.kallsyms]) futex_wait_queue_me ([kernel.kallsyms]) futex_wait ([kernel.kallsyms]) do_futex ([kernel.kallsyms]) __x64_sys_futex ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) entry_SYSCALL_64_after_hwframe ([kernel.kallsyms]) __futex_abstimed_wait_common64 (/usr/lib64/libpthread-2.33.so) 0.030 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL, val: 2) do_trace_write_msr ([kernel.kallsyms]) do_trace_write_msr ([kernel.kallsyms]) __switch_to_xtra ([kernel.kallsyms]) __switch_to ([kernel.kallsyms]) __schedule ([kernel.kallsyms]) schedule_idle ([kernel.kallsyms]) do_idle ([kernel.kallsyms]) cpu_startup_entry ([kernel.kallsyms]) secondary_startup_64_no_verify ([kernel.kallsyms]) # Cc: Adrian Hunter Cc: Babu Moger Cc: Borislav Petkov (AMD) Cc: Breno Leitao Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Kim Phillips Cc: Namhyung Kim Cc: Nikunj A Dadhania Link: https://lore.kernel.org/lkml/ZAJoaZ41+rU5H0vL@kernel.org [ I had published the perf-tools branch before with the sync with ] [ 8c29f01654053258 ("x86/sev: Add SEV-SNP guest feature negotiation support") ] [ I removed it from this new sync ] Signed-off-by: Arnaldo Carvalho de Melo commit 33c53f9b5ac60c7d5c6acc91a6b6d933e0a417e3 Author: Arnaldo Carvalho de Melo Date: Fri Mar 3 17:26:24 2023 -0300 tools headers kvm: Sync uapi/{asm/linux} kvm.h headers with the kernel sources To pick up the changes in: 89b0e7de3451a17f ("KVM: arm64: nv: Introduce nested virtualization VCPU feature") 14329b825ffb7f27 ("KVM: x86/pmu: Introduce masked events to the pmu event filter") 6213b701a9df0472 ("KVM: x86: Replace 0-length arrays with flexible arrays") 3fd49805d19d1c56 ("KVM: s390: Extend MEM_OP ioctl by storage key checked cmpxchg") 14329b825ffb7f27 ("KVM: x86/pmu: Introduce masked events to the pmu event filter") That don't change functionality in tools/perf, as no new ioctl is added for the 'perf trace' scripts to harvest. This addresses these perf build warnings: Warning: Kernel ABI header at 'tools/include/uapi/linux/kvm.h' differs from latest version at 'include/uapi/linux/kvm.h' diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/kvm.h' differs from latest version at 'arch/x86/include/uapi/asm/kvm.h' diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Warning: Kernel ABI header at 'tools/arch/arm64/include/uapi/asm/kvm.h' differs from latest version at 'arch/arm64/include/uapi/asm/kvm.h' diff -u tools/arch/arm64/include/uapi/asm/kvm.h arch/arm64/include/uapi/asm/kvm.h Cc: Aaron Lewis Cc: Adrian Hunter Cc: Christoffer Dall Cc: Ian Rogers Cc: Janis Schoetterl-Glausch Cc: Janosch Frank Cc: Jiri Olsa Cc: Kees Kook Cc: Namhyung Kim Cc: Oliver Upton Cc: Sean Christopherson Link: https://lore.kernel.org/lkml/ZAJlg7%2FfWDVGX0F3@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 5f800380af3881f1a0528d332838d4619a64593b Author: Arnaldo Carvalho de Melo Date: Fri Mar 3 16:57:50 2023 -0300 tools include UAPI: Synchronize linux/fcntl.h with the kernel sources To pick up the changes in: 6fd7353829cafc40 ("mm/memfd: add F_SEAL_EXEC") That doesn't add or change any perf tools functionality, only addresses these build warnings: Warning: Kernel ABI header at 'tools/include/uapi/linux/fcntl.h' differs from latest version at 'include/uapi/linux/fcntl.h' diff -u tools/include/uapi/linux/fcntl.h include/uapi/linux/fcntl.h Signed-off-by: Arnaldo Carvalho de Melo commit 811f35ff59b6f99ae272d6f5b96bc9e974f88196 Author: Arnaldo Carvalho de Melo Date: Fri Mar 3 16:49:20 2023 -0300 tools headers: Synchronize {linux,vdso}/bits.h with the kernel sources To pick up the changes in this cset: cbdb1f163af2bb90 ("vdso/bits.h: Add BIT_ULL() for the sake of consistency") That just causes perf to rebuild, the macro included doesn't clash with anything in tools/{perf,objtool,bpf}. This addresses this perf build warning: Warning: Kernel ABI header at 'tools/include/linux/bits.h' differs from latest version at 'include/linux/bits.h' diff -u tools/include/linux/bits.h include/linux/bits.h Warning: Kernel ABI header at 'tools/include/vdso/bits.h' differs from latest version at 'include/vdso/bits.h' diff -u tools/include/vdso/bits.h include/vdso/bits.h Signed-off-by: Arnaldo Carvalho de Melo commit df4b933e0e51e43bd27a495dc747db0851e6dd34 Author: Arnaldo Carvalho de Melo Date: Fri Mar 3 11:48:09 2023 -0300 tools headers UAPI: Sync linux/prctl.h with the kernel sources To pick new prctl options introduced in: b507808ebce23561 ("mm: implement memory-deny-write-execute as a prctl") That results in: $ diff -u tools/include/uapi/linux/prctl.h include/uapi/linux/prctl.h --- tools/include/uapi/linux/prctl.h 2022-06-20 17:54:43.884515663 -0300 +++ include/uapi/linux/prctl.h 2023-03-03 11:18:51.090923569 -0300 @@ -281,6 +281,12 @@ # define PR_SME_VL_LEN_MASK 0xffff # define PR_SME_VL_INHERIT (1 << 17) /* inherit across exec */ +/* Memory deny write / execute */ +#define PR_SET_MDWE 65 +# define PR_MDWE_REFUSE_EXEC_GAIN 1 + +#define PR_GET_MDWE 66 + #define PR_SET_VMA 0x53564d41 # define PR_SET_VMA_ANON_NAME 0 $ tools/perf/trace/beauty/prctl_option.sh > before $ cp include/uapi/linux/prctl.h tools/include/uapi/linux/prctl.h $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after --- before 2023-03-03 11:47:43.320013146 -0300 +++ after 2023-03-03 11:47:50.937216229 -0300 @@ -59,6 +59,8 @@ [62] = "SCHED_CORE", [63] = "SME_SET_VL", [64] = "SME_GET_VL", + [65] = "SET_MDWE", + [66] = "GET_MDWE", }; static const char *prctl_set_mm_options[] = { [1] = "START_CODE", $ Now users can do: # perf trace -e syscalls:sys_enter_prctl --filter "option==SET_MDWE||option==GET_MDWE" ^C# # trace -v -e syscalls:sys_enter_prctl --filter "option==SET_MDWE||option==GET_MDWE" New filter for syscalls:sys_enter_prctl: (option==65||option==66) && (common_pid != 5519 && common_pid != 3404) ^C# And when these prctl options appears in a session, they will be translated to the corresponding string. Cc: Adrian Hunter Cc: Andrew Morton Cc: Ian Rogers Cc: Jiri Olsa Cc: Joey Gouly Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZAI%2FAoPXb%2Fsxz1%2Fm@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 31d2e6b5d44e436969c15e4613e6b16c4c032d4d Author: Arnaldo Carvalho de Melo Date: Fri Mar 3 11:05:19 2023 -0300 tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench' We also continue with SYM_TYPED_FUNC_START() in util/include/linux/linkage.h and with an exception in tools/perf/check_headers.sh's diff check to ignore the include cfi_types.h line when checking if the kernel original files drifted from the copies we carry. This is to get the changes from: 69d4c0d3218692ff ("entry, kasan, x86: Disallow overriding mem*() functions") That addresses these perf tools build warning: Warning: Kernel ABI header at 'tools/arch/x86/lib/memcpy_64.S' differs from latest version at 'arch/x86/lib/memcpy_64.S' diff -u tools/arch/x86/lib/memcpy_64.S arch/x86/lib/memcpy_64.S Warning: Kernel ABI header at 'tools/arch/x86/lib/memset_64.S' differs from latest version at 'arch/x86/lib/memset_64.S' diff -u tools/arch/x86/lib/memset_64.S arch/x86/lib/memset_64.S Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/lkml/ZAH%2FjsioJXGIOrkf@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0988a0ea791999ebbf95693f2676381825b05033 Merge: 3162745aad939 13af134bdc6a9 Author: Linus Torvalds Date: Fri Mar 3 16:33:28 2023 -0800 Merge tag 'for-v6.3-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull more power supply updates from Sebastian Reichel: - Fix DT binding for Richtek RT9467 - Fix a NULL pointer check in the power-supply core - Document meaning of absent "present" property * tag 'for-v6.3-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: dt-bindings: power: supply: Revise Richtek RT9467 compatible name ABI: testing: sysfs-class-power: Document absence of "present" property power: supply: fix null pointer check order in __power_supply_register commit 3162745aad939af6b8bc00951d1344ee872526a9 Merge: e778361555713 71562809e401b Author: Linus Torvalds Date: Fri Mar 3 16:26:43 2023 -0800 Merge tag '6.3-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull more cifs updates from Steve French: - xfstest generic/208 fix (memory leak) - minor netfs fix (to address smatch warning) - a DFS fix for stable - a reconnect race fix - two multichannel fixes - RDMA (smbdirect) fix - two additional writeback fixes from David * tag '6.3-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix memory leak in direct I/O cifs: prevent data race in cifs_reconnect_tcon() cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID iov: Fix netfs_extract_user_to_sg() cifs: Fix cifs_write_back_from_locked_folio() cifs: reuse cifs_match_ipaddr for comparison of dstaddr too cifs: match even the scope id for ipv6 addresses cifs: Fix an uninitialised variable cifs: Add some missing xas_retry() calls commit e778361555713826481be6234fd1aa030bdb035e Author: Linus Torvalds Date: Thu Mar 2 15:49:44 2023 -0800 umh: simplify the capability pointer logic The usermodehelper code uses two fake pointers for the two capability cases: CAP_BSET for reading and writing 'usermodehelper_bset', and CAP_PI to read and write 'usermodehelper_inheritable'. This seems to be a completely unnecessary indirection, since we could instead just use the pointers themselves, and never have to do any "if this then that" kind of logic. So just get rid of the fake pointer values, and use the real pointer values instead. Reviewed-by: Luis Chamberlain Cc: Eric Biederman Cc: Peter Zijlstra Cc: Christoph Hellwig Cc: Kees Cook Cc: Iurii Zaikin Signed-off-by: Linus Torvalds commit fb35342f0a6875e52ad2903b215525b24e2f19b3 Merge: 34c108a02c306 2b2d50bdd258f Author: Linus Torvalds Date: Fri Mar 3 15:00:28 2023 -0800 Merge tag 'cocci-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux Pull coccinelle updates from Julia Lawall: "Changes in make coccicheck and improve a semantic patch This makes a couple of changes in make coccicheck related to shell commands. It also updates the api/atomic_as_refcounter semantic patch to include WARNING in the output message, as done in other cases" * tag 'cocci-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux: scripts: coccicheck: Use /usr/bin/env scripts: coccicheck: Avoid warning about spurious escape coccinelle: api/atomic_as_refcounter: include message type in output commit 34c108a02c30627bcd4875e4f32c915acc45305f Merge: 06caa75154551 3098cb655e7c9 Author: Linus Torvalds Date: Fri Mar 3 14:51:15 2023 -0800 Merge tag 'rust-fixes-6.3-rc1' of https://github.com/Rust-for-Linux/linux Pull Rust fix from Miguel Ojeda: "A single build error fix: there was a change during the merge window to a C header parsed by the Rust bindings generator, introducing a type that it does not handle well. The fix tells the generator to treat the type as opaque (for now)" * tag 'rust-fixes-6.3-rc1' of https://github.com/Rust-for-Linux/linux: rust: bindgen: Add `alt_instr` as opaque type commit 06caa751545512fae98c21f282006a7fff852daf Merge: 0a3f9a6b0265b 901b894af5b93 Author: Linus Torvalds Date: Fri Mar 3 14:41:50 2023 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "Updates that missed the first pull, mostly because of needing more soak time. Driver updates (zfcp, ufs, mpi3mr, plus two ipr bug fixes), an enclosure services (ses) update (mostly bug fixes) and other minor bug fixes and changes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (32 commits) scsi: zfcp: Trace when request remove fails after qdio send fails scsi: zfcp: Change the type of all fsf request id fields and variables to u64 scsi: zfcp: Make the type for accessing request hashtable buckets size_t scsi: ufs: core: Simplify ufshcd_execute_start_stop() scsi: ufs: core: Rely on the block layer for setting RQF_PM scsi: core: Extend struct scsi_exec_args scsi: lpfc: Fix double word in comments scsi: core: Remove the /proc/scsi/${proc_name} directory earlier scsi: core: Fix a source code comment scsi: cxgbi: Remove unneeded version.h include scsi: qedi: Remove unneeded version.h include scsi: mpi3mr: Remove unneeded version.h include scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization scsi: mpi3mr: Use number of bits to manage bitmap sizes scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() scsi: mpi3mr: Fix an issue found by KASAN scsi: mpi3mr: Replace 1-element array with flex-array scsi: ipr: Work around fortify-string warning scsi: ipr: Make ipr_probe_ioa_part2() return void ... commit 65609d3206f784489eb1ebd6fce64b84a42cc63c Author: Dan Carpenter Date: Mon Feb 27 13:06:33 2023 +0300 i2c: gxp: fix an error code in probe This is passing IS_ERR() instead of PTR_ERR() so instead of an error code it prints and returns the number 1. Fixes: 4a55ed6f89f5 ("i2c: Add GXP SoC I2C Controller") Signed-off-by: Dan Carpenter Reviewed-by: Nick Hawkins Signed-off-by: Wolfram Sang commit 4b3dfb0ed6336dea4a763ce9fa30a42763eb3800 Author: Wolfram Sang Date: Mon Feb 20 15:40:59 2023 +0100 i2c: gxp: return proper error on address NACK According to Documentation/i2c/fault-codes.rst, NACK after sending an address should be -ENXIO. Signed-off-by: Wolfram Sang commit 1d092308ce223bb1403475737b8fb847e9e8704c Author: Wolfram Sang Date: Fri Feb 17 23:13:30 2023 +0100 i2c: gxp: remove "empty" switch statement There used to be error messages which had to go. Now, it only consists of 'break's, so it can go. Signed-off-by: Wolfram Sang commit a76d19e6acb1ef16561b0682cd1a566463fa3d98 Author: Benjamin Gray Date: Tue Feb 28 10:33:17 2023 +1100 i2c: Disable I2C_APPLE when I2C_PASEMI is a builtin The ppc64le_allmodconfig sets I2C_PASEMI=y and leaves COMPILE_TEST to default to y and I2C_APPLE to default to m, running into a known incompatible configuration that breaks the build [1]. Specifically, a common dependency (i2c-pasemi-core.o in this case) cannot be used by both builtin and module consumers. Disable I2C_APPLE when I2C_PASEMI is a builtin to prevent this. [1]: https://lore.kernel.org/all/202112061809.XT99aPrf-lkp@intel.com Suggested-by: Arnd Bergmann Signed-off-by: Benjamin Gray Acked-by: Arnd Bergmann Acked-by: Sven Peter Signed-off-by: Wolfram Sang commit 52f04f10b9005ac4ce640da14a52ed7a146432fa Author: Srinivas Pandruvada Date: Fri Mar 3 08:19:09 2023 -0800 thermal: intel: int340x: processor_thermal: Fix deadlock When user space updates the trip point there is a deadlock, which results in caller gets blocked forever. Commit 05eeee2b51b4 ("thermal/core: Protect sysfs accesses to thermal operations with thermal zone mutex"), added a mutex for tz->lock in the function trip_point_temp_store(). Hence, trip set callback() can't call any thermal zone API as they are protected with the same mutex lock. The callback here calling thermal_zone_device_enable(), which will result in deadlock. Move the thermal_zone_device_enable() to proc_thermal_pci_probe() to avoid this deadlock. Fixes: 05eeee2b51b4 ("thermal/core: Protect sysfs accesses to thermal operations with thermal zone mutex") Signed-off-by: Srinivas Pandruvada Cc: 6.2+ # 6.2+ Signed-off-by: Rafael J. Wysocki commit 0a3f9a6b0265b64c02226fcabb5e9a958307913b Merge: 44b6f565e7918 1467fb960349d Author: Linus Torvalds Date: Fri Mar 3 10:41:59 2023 -0800 Merge tag 'thermal-6.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more thermal control updates from Rafael Wysocki: "These fix two issues in the Intel thermal control drivers. Specifics: - Fix an error pointer dereference in the quark_dts Intel thermal driver (Dan Carpenter) - Fix the intel_bxt_pmic_thermal driver Kconfig entry to select REGMAP which is not user-visible instead of depending on it (Randy Dunlap)" * tag 'thermal-6.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: intel: BXT_PMIC: select REGMAP instead of depending on it thermal: intel: quark_dts: fix error pointer dereference commit 44b6f565e79188760851d58fa59628b4c2a1b334 Merge: c8b4accf86020 57b76324c2a03 Author: Linus Torvalds Date: Fri Mar 3 10:36:01 2023 -0800 Merge tag 'acpi-6.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These update ACPI quirks for some x86 platforms and add an IRQ override quirk for one more system. Specifics: - Add an ACPI IRQ override quirk for Asus Expertbook B2402FBA (Vojtech Hejsek) - Drop a suspend-to-idle quirk for HP Elitebook G9 that is not needed any more after a firmware update (Mario Limonciello) - Add all Cezanne systems to the list for forcing StorageD3Enable, because they all need the same quirk (Mario Limonciello)" * tag 'acpi-6.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable ACPI: x86: Drop quirk for HP Elitebook ACPI: resource: Skip IRQ override on Asus Expertbook B2402FBA commit c8b4accf860203fcb380f5d15b90a7646912d9c2 Merge: 53ae7e117637f 5719638d368f3 Author: Linus Torvalds Date: Fri Mar 3 10:30:58 2023 -0800 Merge tag 'pm-6.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These update power capping (new hardware support and cleanup) and cpufreq (bug fixes, cleanups and intel_pstate adjustment for a new platform). Specifics: - Fix error handling in the apple-soc cpufreq driver (Dan Carpenter) - Change the log level of a message in the amd-pstate cpufreq driver so it is more visible to users (Kai-Heng Feng) - Adjust the balance_performance EPP value for Sapphire Rapids in the intel_pstate cpufreq driver (Srinivas Pandruvada) - Remove MODULE_LICENSE from 3 pieces of non-modular code (Nick Alcock) - Make a read-only kobj_type structure in the schedutil cpufreq governor constant (Thomas Weißschuh) - Add Add Power Limit4 support for Meteor Lake SoC to the Intel RAPL power capping driver (Sumeet Pawnikar)" * tag 'pm-6.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: apple-soc: Fix an IS_ERR() vs NULL check powercap: remove MODULE_LICENSE in non-modules cpufreq: intel_pstate: remove MODULE_LICENSE in non-modules powercap: RAPL: Add Power Limit4 support for Meteor Lake SoC cpufreq: amd-pstate: remove MODULE_LICENSE in non-modules cpufreq: schedutil: make kobj_type structure constant cpufreq: amd-pstate: Let user know amd-pstate is disabled cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids commit 53ae7e117637ff201fdf038b68e76a7202112dea Merge: 9d0281b56be5d 1947ddf9b3d5b Author: Linus Torvalds Date: Fri Mar 3 10:25:29 2023 -0800 Merge tag 'io_uring-6.3-2023-03-03' of git://git.kernel.dk/linux Pull more io_uring updates from Jens Axboe: "Here's a set of fixes/changes that didn't make the first cut, either because they got queued before I sent the early merge request, or fixes that came in afterwards. In detail: - Don't set MSG_NOSIGNAL on recv/recvmsg opcodes, as AF_PACKET will error out (David) - Fix for spurious poll wakeups (me) - Fix for a file leak for buffered reads in certain conditions (Joseph) - Don't allow registered buffers of mixed types (Pavel) - Improve handling of huge pages for registered buffers (Pavel) - Provided buffer ring size calculation fix (Wojciech) - Minor cleanups (me)" * tag 'io_uring-6.3-2023-03-03' of git://git.kernel.dk/linux: io_uring/poll: don't pass in wake func to io_init_poll_iocb() io_uring: fix fget leak when fs don't support nowait buffered read io_uring/poll: allow some retries for poll triggering spuriously io_uring: remove MSG_NOSIGNAL from recvmsg io_uring/rsrc: always initialize 'folio' to NULL io_uring/rsrc: optimise registered huge pages io_uring/rsrc: optimise single entry advance io_uring/rsrc: disallow multi-source reg buffers io_uring: remove unused wq_list_merge io_uring: fix size calculation when registering buf ring io_uring/rsrc: fix a comment in io_import_fixed() io_uring: rename 'in_idle' to 'in_cancel' io_uring: consolidate the put_ref-and-return section of adding work commit 9d0281b56be5d90117a75065f4edc27b25b14c8c Merge: 1bd1aee6cdb5c 49d24398327e3 Author: Linus Torvalds Date: Fri Mar 3 10:21:39 2023 -0800 Merge tag 'block-6.3-2023-03-03' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Christoph: - Don't access released socket during error recovery (Akinobu Mita) - Bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) - Fix an error code in nvme_auth_process_dhchap_challenge (Dan Carpenter) - Show well known discovery name (Daniel Wagner) - Add a missing endianess conversion in effects masking (Keith Busch) - Fix for a regression introduced in blk-rq-qos during init in this merge window (Breno) - Reorder a few fields in struct blk_mq_tag_set, eliminating a few holes and shrinking it (Christophe) - Remove redundant bdev_get_queue() NULL checks (Juhyung) - Add sed-opal single user mode support flag (Luca) - Remove SQE128 check in ublk as it isn't needed, saving some memory (Ming) - Op specific segment checking for cloned requests (Uday) - Exclusive open partition scan fixes (Yu) - Loop offset/size checking before assigning them in the device (Zhong) - Bio polling fixes (me) * tag 'block-6.3-2023-03-03' of git://git.kernel.dk/linux: blk-mq: enforce op-specific segment limits in blk_insert_cloned_request nvme-fabrics: show well known discovery name nvme-tcp: don't access released socket during error recovery nvme-auth: fix an error code in nvme_auth_process_dhchap_challenge() nvme: bring back auto-removal of deleted namespaces during sequential scan blk-iocost: Pass gendisk to ioc_refresh_params nvme: fix sparse warning on effects masking block: be a bit more careful in checking for NULL bdev while polling block: clear bio->bi_bdev when putting a bio back in the cache loop: loop_set_status_from_info() check before assignment ublk: remove check IO_URING_F_SQE128 in ublk_ch_uring_cmd block: remove more NULL checks after bdev_get_queue() blk-mq: Reorder fields in 'struct blk_mq_tag_set' block: fix scan partition for exclusively open device again block: Revert "block: Do not reread partition table on exclusively open device" sed-opal: add support flag for SUM in status ioctl commit 1bd1aee6cdb5c8cac8234fb72def4474012c2c49 Merge: 0bdf4a8bf0aab 6210038aeaf49 Author: Linus Torvalds Date: Fri Mar 3 10:17:44 2023 -0800 Merge tag 'ata-6.3-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA fix from Damien Le Moal: - Revert commit 104ff59af73a ("ata: ahci: Add Tiger Lake UP{3,4} AHCI controller") as it is causing serious regressions (failure to boot) on some laptops * tag 'ata-6.3-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller" commit 5ec498ba86550909f2611b07087d57a71a78c336 Author: Kalyan Thota Date: Mon Feb 13 03:11:41 2023 -0800 drm/msm/dpu: clear DSPP reservations in rm release Clear DSPP reservations from the global state during rm release Fixes: e47616df008b ("drm/msm/dpu: add support for color processing blocks in dpu driver") Signed-off-by: Kalyan Thota Reviewed-by: Dmitry Baryshkov Reviewed-by: Marijn Suijten Patchwork: https://patchwork.freedesktop.org/patch/522443/ Link: https://lore.kernel.org/r/1676286704-818-2-git-send-email-quic_kalyant@quicinc.com Signed-off-by: Abhinav Kumar commit ce68153edb5b36ddf87a19ed5a85131498690bbf Author: Kuogee Hsieh Date: Mon Feb 27 13:36:40 2023 -0800 drm/msm/disp/dpu: fix sc7280_pp base offset At sc7280, pingpong block is used to management the dither effects to reduce distortion at panel. Currently pingpong-0 base offset is wrongly set at 0x59000. This mistake will not cause system to crash. However it will make dither not work. This patch correct sc7280 ping pong-0 block base offset. Changes in v2: -- add more details info n regrading of pingpong block at commit text Fixes: 591e34a091d1 ("drm/msm/disp/dpu1: add support for display for SC7280 target") Signed-off-by: Kuogee Hsieh Reviewed-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/524332/ Link: https://lore.kernel.org/r/1677533800-3125-1-git-send-email-quic_khsieh@quicinc.com Signed-off-by: Abhinav Kumar commit 1c1ded39bfb89217947affaa79c4cd1c138c5da2 Author: Dmitry Baryshkov Date: Thu Feb 23 12:57:08 2023 +0300 drm/msm/dpu: fix stack smashing in dpu_hw_ctl_setup_blendstage The rewritten dpu_hw_ctl_setup_blendstage() can lightly smash the stack when setting the SSPP_NONE pipe. However it was unnoticed until the kernel was tested under AOSP (with some kind of stack protection/check). This fixes the following backtrace: Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f20003e8 [#1] PREEMPT SMP Hardware name: Thundercomm Dragonboard 845c (DT) pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : dpu_hw_ctl_setup_blendstage+0x26c/0x278 [msm] lr : _dpu_crtc_blend_setup+0x4b4/0x5a0 [msm] sp : ffffffc00bdcb720 x29: ffffffc00bdcb720 x28: ffffff8085debac0 x27: 0000000000000002 x26: ffffffd74af18320 x25: ffffff8083af75a0 x24: ffffffc00bdcb878 x23: 0000000000000001 x22: 0000000000000000 x21: ffffff8085a70000 x20: ffffff8083012dc0 x19: 0000000000000001 x18: 0000000000000000 x17: 000000040044ffff x16: 045000f4b5593519 x15: 0000000000000000 x14: 000000000000000b x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000001 x10: ffffffc00bdcb764 x9 : ffffffd74af06a08 x8 : 0000000000000001 x7 : 0000000000000001 x6 : 0000000000000000 x5 : ffffffc00bdcb878 x4 : 0000000000000002 x3 : ffffffffffffffff x2 : ffffffc00bdcb878 x1 : 0000000000000000 x0 : 0000000000000002 Call trace: dpu_hw_ctl_setup_blendstage+0x26c/0x278 [msm] _dpu_crtc_blend_setup+0x4b4/0x5a0 [msm] dpu_crtc_atomic_begin+0xd8/0x22c [msm] drm_atomic_helper_commit_planes+0x80/0x208 [drm_kms_helper] msm_atomic_commit_tail+0x134/0x6f0 [msm] commit_tail+0xa4/0x1a4 [drm_kms_helper] drm_atomic_helper_commit+0x170/0x184 [drm_kms_helper] drm_atomic_commit+0xac/0xe8 drm_mode_atomic_ioctl+0xbf0/0xdac drm_ioctl_kernel+0xc4/0x178 drm_ioctl+0x2c8/0x608 __arm64_sys_ioctl+0xa8/0xec invoke_syscall+0x44/0x104 el0_svc_common.constprop.0+0x44/0xec do_el0_svc+0x38/0x98 el0_svc+0x2c/0xb4 el0t_64_sync_handler+0xb8/0xbc el0t_64_sync+0x1a0/0x1a4 Code: 52800016 52800017 52800018 17ffffc7 (d4207d00) Fixes: 4488f71f6373 ("drm/msm/dpu: simplify blend configuration") Reported-by: Amit Pundir Signed-off-by: Dmitry Baryshkov Tested-by: Amit Pundir Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/523778/ Link: https://lore.kernel.org/r/20230223095708.3688148-1-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit d6181c18d55cdbbf37baea0fdd0cacf69b84f6b9 Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:22 2023 +0200 drm/msm/dpu: don't use DPU_CLK_CTRL_CURSORn for DMA SSPP clocks DPU driver has been using the DPU_CLK_CTRL_CURSOR prefix for the DMA SSPP blocks used for the cursor planes. This has lead to the confusion at least for the MSM8998 platform. In preparation to supporting the cursor SSPP blocks, use proper enum values to index DMA SSPP clock controls. Reviewed-by: Neil Armstrong Tested-by: Neil Armstrong # on SM8550 on top of next-20230116 Reviewed-by: Marijn Suijten Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/522228/ Link: https://lore.kernel.org/r/20230211231259.1308718-14-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit 0abb6a24aabc1252eae75fe23b0ccd3217c6ee07 Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:21 2023 +0200 drm/msm/dpu: fix clocks settings for msm8998 SSPP blocks DMA2 and DMA3 planes on msm8998 should use corresponding DMA2 and DMA3 clocks rather than CURSOR0/1 clocks (which are used for the CURSOR planes). Correct corresponding SSPP declarations. Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog") Cc: AngeloGioacchino Del Regno Cc: Jami Kettunen Reviewed-by: Marijn Suijten Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522230/ Link: https://lore.kernel.org/r/20230211231259.1308718-13-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit a5045b00a68171de11603812f4304179ef608e60 Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:20 2023 +0200 drm/msm/dpu: drop DPU_DIM_LAYER from MIXER_MSM8998_MASK The msm8998 doesn't seem to support DIM_LAYER, so drop it from the supported features mask. Fixes: 2d8a4edb672d ("drm/msm/dpu: use feature bit for LM combined alpha check") Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522231/ Link: https://lore.kernel.org/r/20230211231259.1308718-12-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit 38164e990a42ca276f72ab89fd24131e6d73b023 Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:19 2023 +0200 drm/msm/dpu: correct sm6115 scaler QSEED4 is a newer variant of QSEED3LITE, which should be used on sm6115. Fix the used feature masks. Signed-off-by: Dmitry Baryshkov Fixes: 3581b7062cec ("drm/msm/disp/dpu1: add support for display on SM6115") Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522219/ Link: https://lore.kernel.org/r/20230211231259.1308718-11-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit 03c0c3cb22a4ff29afba1b43f0330289ea80433f Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:18 2023 +0200 drm/msm/dpu: correct sm8250 and sm8350 scaler QSEED4 is a newer variant of QSEED3LITE, which should be used on sm8250 and sm8350. Fix the DPU caps structure and used feature masks. Fixes: d21fc5dfc3df ("drm/msm/dpu1: add support for qseed3lite used on sm8250") Fixes: 0e91bcbb0016 ("drm/msm/dpu: Add SM8350 to hw catalog") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522229/ Link: https://lore.kernel.org/r/20230211231259.1308718-10-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit c7da17b67847010871f225d7d48a607a8f272aef Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:17 2023 +0200 drm/msm/dpu: correct sm8450 scaler QSEED4 is a newer variant of QSEED3LITE, which should be used on sm8450. Fix the used feature masks. Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522215/ Link: https://lore.kernel.org/r/20230211231259.1308718-9-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit b3587cb645329cab75dc6354a79291a289c7ba33 Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:16 2023 +0200 drm/msm/dpu: correct sc8280xp scaler QSEED4 is a newer variant of QSEED3LITE, which should be used on sc8280xp. Fix the DPU caps structure and used feature masks. Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522217/ Link: https://lore.kernel.org/r/20230211231259.1308718-8-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit d113d267c3bfa07c0c8e9f68068a18fa18970c9c Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:15 2023 +0200 drm/msm/dpu: correct sm8550 scaler QSEED4 is a newer variant of QSEED3LITE, which should be used on sm8550. Fix the DPU caps structure and used feature masks. Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550") Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522213/ Link: https://lore.kernel.org/r/20230211231259.1308718-7-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit da06be8b4fdf3eccf5cf6cbc4a689a43b8ad705b Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:14 2023 +0200 drm/msm/dpu: fix sm6115 and qcm2290 mixer width limits According to vendor DTS files both sm6115 and qcm2290 should have max_mixer_width set to 2048 (DEFAULT_DPU_LINE_WIDTH). Correct it. Fixes: 3581b7062cec ("drm/msm/disp/dpu1: add support for display on SM6115") Fixes: 5334087ee743 ("drm/msm: add support for QCM2290 MDSS") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522212/ Link: https://lore.kernel.org/r/20230211231259.1308718-6-dmitry.baryshkov@linaro.org [quic_abhinavk@quicinc.com: fix minor typo in commit message] Signed-off-by: Abhinav Kumar commit ce6bd00abc220e9edf10986234fadba6462b4abf Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:13 2023 +0200 drm/msm/dpu: fix len of sc7180 ctl blocks Change sc7180's ctl block len to 0x1dc. Fixes: 7bdc0c4b8126 ("msm:disp:dpu1: add support for display for SC7180 target") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522210/ Link: https://lore.kernel.org/r/20230211231259.1308718-5-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit e301195507feb67290ee6c93b7d13e646bb12687 Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:12 2023 +0200 drm/msm/dpu: fix typo in in sm8550's dma_sblk_5 Fix typo in the name of the sblk structure for the sm8550's dma_sblk_5. Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550") Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/522225/ Link: https://lore.kernel.org/r/20230211231259.1308718-4-dmitry.baryshkov@linaro.org [quic_abhinavk@quicinc.com: fix minor typo in commit message] Signed-off-by: Abhinav Kumar commit 57b76324c2a03b7b75d2d93f5c83f4340fd9b621 Merge: 65eb2867f5bf4 e32d546c483a2 e2a56364485e7 Author: Rafael J. Wysocki Date: Fri Mar 3 18:45:53 2023 +0100 Merge branches 'acpi-pm' and 'acpi-x86' Merge additional ACPI quirks for x86 systems: - Drop a suspend-to-idle quirk for HP Elitebook G9 that is not needed any more after a firmware update (Mario Limonciello). - Add all Cezanne systems to the list for forcing StorageD3Enable, because they all need the same quirk (Mario Limonciello). * acpi-pm: ACPI: x86: Drop quirk for HP Elitebook * acpi-x86: ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable commit 0bdf4a8bf0aab64757c23ef3acf8190af2b23797 Merge: bf1a1bad82407 cd57953936f22 Author: Linus Torvalds Date: Fri Mar 3 09:38:01 2023 -0800 Merge tag 's390-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Heiko Carstens: - Add empty command line parameter handling stubs to kernel for all command line parameters which are handled in the decompressor. This avoids invalid "Unknown kernel command line parameters" messages from the kernel, and also avoids that these will be incorrectly passed to user space. This caused already confusion, therefore add the empty stubs - Add missing phys_to_virt() handling to machine check handler - Introduce and use a union to be used for zcrypt inline assemblies. This makes sure that only a register wide member of the union is passed as input and output parameter to inline assemblies, while usual C code uses other members of the union to access bit fields of it - Add and use a READ_ONCE_ALIGNED_128() macro, which can be used to atomically read a 128-bit value from memory. This replaces the (mis-)use of the 128-bit cmpxchg operation to do the same in cpum_sf code. Currently gcc does not generate the used lpq instruction if __READ_ONCE() is used for aligned 128-bit accesses, therefore use this s390 specific helper - Simplify machine check handler code if a task needs to be killed because of e.g. register corruption due to a machine malfunction - Perform CPU reset to clear pending interrupts and TLB entries on an already stopped target CPU before delegating work to it - Generate arch/s390/boot/vmlinux.map link map for the decompressor, when CONFIG_VMLINUX_MAP is enabled for debugging purposes - Fix segment type handling for dcssblk devices. It incorrectly always returned type "READ/WRITE" even for read-only segements, which can result in a kernel panic if somebody tries to write to a read-only device - Sort config S390 select list again - Fix two kprobe reenter bugs revealed by a recently added kprobe kunit test * tag 's390-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/kprobes: fix current_kprobe never cleared after kprobes reenter s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler s390/Kconfig: sort config S390 select list again s390/extmem: return correct segment type in __segment_load() s390/decompressor: add link map saving s390/smp: perform cpu reset before delegating work to target cpu s390/mcck: cleanup user process termination path s390/cpum_sf: use READ_ONCE_ALIGNED_128() instead of 128-bit cmpxchg s390/rwonce: add READ_ONCE_ALIGNED_128() macro s390/ap,zcrypt,vfio: introduce and use ap_queue_status_reg union s390/nmi: fix virtual-physical address confusion s390/setup: do not complain about parameters handled in decompressor commit bf1a1bad82407ad81130c065f6495ec0f939ae60 Merge: 271d89394e33a 61fc1ee8be26b Author: Linus Torvalds Date: Fri Mar 3 09:32:51 2023 -0800 Merge tag 'riscv-for-linus-6.3-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: - Some cleanups and fixes for the Zbb-optimized string routines - Support for custom (vendor or implementation defined) perf events - COMMAND_LINE_SIZE has been increased to 1024 * tag 'riscv-for-linus-6.3-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Bump COMMAND_LINE_SIZE value to 1024 drivers/perf: RISC-V: Allow programming custom firmware events riscv, lib: Fix Zbb strncmp RISC-V: improve string-function assembly commit 5719638d368f35934d53e4a8c3a2f007c32a1ecf Merge: f43523620f646 d25d01b4e59bd Author: Rafael J. Wysocki Date: Fri Mar 3 18:26:43 2023 +0100 Merge branch 'powercap' Merge additional power capping changes for 6.3-rc1: - Remove MODULE_LICENSE from non-modular power capping code (Nick Alcock). - Add Add Power Limit4 support for Meteor Lake SoC to the Intel RAPL power capping driver (Sumeet Pawnikar). * powercap: powercap: remove MODULE_LICENSE in non-modules powercap: RAPL: Add Power Limit4 support for Meteor Lake SoC commit 271d89394e33aae5391fd886c046ce54c8240e5b Merge: 2eb29d59ddf02 3ca04951b004f Author: Linus Torvalds Date: Fri Mar 3 09:15:50 2023 -0800 Merge tag 'rtc-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "A few drivers got some nice cleanups and a new driver are making the bulk of the changes. Subsystem: - allow rtc_read_alarm without read_alarm callback New driver: - NXP BBNSM module RTC Drivers: - use IRQ flags from fwnode when available - abx80x: nvmem support - brcmstb-waketimer: add non-wake alarm support - ingenic: provide CLK32K clock - isl12022: cleanups - moxart: switch to using gpiod API - pcf85363: allow setting quartz load - pm8xxx: cleanups and support for setting time - rv3028, rv3032: add ACPI support" * tag 'rtc-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (64 commits) rtc: pm8xxx: add support for nvmem offset dt-bindings: rtc: qcom-pm8xxx: add nvmem-cell offset rtc: abx80x: Add nvmem support rtc: rx6110: Remove unused of_gpio,h rtc: efi: Avoid spamming the log on RTC read failure rtc: isl12022: sort header inclusion alphabetically rtc: isl12022: Join string literals back rtc: isl12022: Drop unneeded OF guards and of_match_ptr() rtc: isl12022: Explicitly use __le16 type for ISL12022_REG_TEMP_L rtc: isl12022: Get rid of unneeded private struct isl12022 rtc: pcf85363: add support for the quartz-load-femtofarads property dt-bindings: rtc: nxp,pcf8563: move pcf85263/pcf85363 to a dedicated binding rtc: allow rtc_read_alarm without read_alarm callback rtc: rv3032: add ACPI support rtc: rv3028: add ACPI support rtc: bbnsm: Add the bbnsm rtc support rtc: jz4740: Register clock provider for the CLK32K pin rtc: jz4740: Use dev_err_probe() rtc: jz4740: Use readl_poll_timeout dt-bindings: rtc: Add #clock-cells property ... commit d900f3d20cc3169ce42ec72acc850e662a4d4db2 Author: Liu Jian Date: Fri Mar 3 16:09:46 2023 +0800 bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS: 00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180 __sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The logic in tcp_bpf_recvmsg_parser is as follows: msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; } In this case, "copied" always is 0, the infinite loop occurs. According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem. Fixes: 1f5be6b3b063 ("udp: Implement udp_bpf_recvmsg() for sockmap") Fixes: 9825d866ce0d ("af_unix: Implement unix_dgram_bpf_recvmsg()") Fixes: c5d2177a72a1 ("bpf, sockmap: Fix race in ingress receive verdict with redirect to self") Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Liu Jian Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Cc: Jakub Sitnicki Link: https://lore.kernel.org/bpf/20230303080946.1146638-1-liujian56@huawei.com commit 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 Author: Reka Norman Date: Mon Feb 27 13:49:38 2023 +1100 HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails. Signed-off-by: Reka Norman Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit db50f7a3983f0154e730f1147ef729e0c5c2f90c Author: Rafał Szalecki Date: Wed Mar 1 02:23:56 2023 +0100 HID: logitech-hidpp: Add support for Logitech MX Master 3S mouse Add signature for the Logitech MX Master 3S mouse over Bluetooth. Signed-off-by: Rafał Szalecki Reviewed-by: Bastien Nocera Signed-off-by: Jiri Kosina commit a8e98f3448e1a4b6848f213cf51720e29dcc774b Author: Dmitry Fomin Date: Sat Feb 25 21:43:22 2023 +0300 ALSA: ice1712: Delete unreachable code in aureon_add_controls() If the check (id != 0x41) fails, then id == 0x41 and the other check in 'else' branch also fails: id & 0x0F = 0b01000001 & 0b00001111 = 0b00000001. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dmitry Fomin Link: https://lore.kernel.org/r/20230225184322.6286-2-fomindmitriyfoma@mail.ru Signed-off-by: Takashi Iwai commit 951606a14a8901e3551fe4d8d3cedd73fe954ce1 Author: Dmitry Fomin Date: Sat Feb 25 21:43:21 2023 +0300 ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls() If snd_ctl_add() fails in aureon_add_controls(), it immediately returns and leaves ice->gpio_mutex locked. ice->gpio_mutex locks in snd_ice1712_save_gpio_status and unlocks in snd_ice1712_restore_gpio_status(ice). It seems that the mutex is required only for aureon_cs8415_get(), so snd_ice1712_restore_gpio_status(ice) can be placed just after that. Compile tested only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dmitry Fomin Cc: Link: https://lore.kernel.org/r/20230225184322.6286-1-fomindmitriyfoma@mail.ru Signed-off-by: Takashi Iwai commit ea24b9953bcd3889f77a66e7f1d7e86e995dd9c3 Author: Łukasz Stelmach Date: Thu Feb 23 08:47:48 2023 +0100 ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC HP EliteDesk 800 G6 Tower PC (103c:870c) requires a quirk for enabling headset-mic. Signed-off-by: Łukasz Stelmach Cc: Link: https://bugzilla.kernel.org/show_bug.cgi?id=217008 Link: https://lore.kernel.org/r/20230223074749.1026060-1-l.stelmach@samsung.com Signed-off-by: Takashi Iwai commit 5911d78fabbbbc02fb2b3f6907e0b3f6da120781 Author: Jaroslav Kysela Date: Tue Feb 21 11:21:57 2023 +0100 ALSA: hda/realtek: Improve support for Dell Precision 3260 The headset jack works better with model=alc283-dac-wcaps. Without this option, the headset insertion (separate physical jack) may not be handled correctly (re-insertion is required). It seems that it follows the "Intel Reference Board" defaults. Reported-by: steven_wu2@dell.com Signed-off-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20230221102157.515852-1-perex@perex.cz Signed-off-by: Takashi Iwai commit fb2e5fc8c8d9d5f95c7a2e1ed6f45b2b3ba836a8 Merge: 26ed1d29fc44f b56ec2992a2e4 Author: Takashi Iwai Date: Fri Mar 3 14:21:13 2023 +0100 Merge tag 'asoc-fix-v6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.3 Almost all of this is driver specific fixes and new IDs that have come in during the merge window. A good chunk of them are simple ones from me which came about due to a bunch of Mediatek Chromebooks being enabled in KernelCI, there's more where that came from. We do have one small feature added to the PCM core by Claudiu Beznea in order to allow the sequencing required to resolve a noise issue with the Microchip PDMC driver. commit 26ed1d29fc44f3f2f0c396c1392abefac5f0454e Merge: e97fc9cffbb9f 7933b90b42896 Author: Takashi Iwai Date: Fri Mar 3 14:20:56 2023 +0100 Merge branch 'for-next' into for-linus commit 6210038aeaf49c395c2da57572246d93ec67f6d4 Author: Damien Le Moal Date: Fri Mar 3 18:29:07 2023 +0900 ata: ahci: Revert "ata: ahci: Add Tiger Lake UP{3,4} AHCI controller" Commit 104ff59af73a ("ata: ahci: Add Tiger Lake UP{3,4} AHCI controller") enabled low power mode for the Tiger Lake AHIC adapter in the author system but created regressions for others. Revert this patch for now until a better solution is found to make this adapter eco-friendly. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217114 CC: stable@vger.kernel.org Signed-off-by: Damien Le Moal commit 528125268588a18a2f257002af051b62b14bb282 Merge: 84cba1840e684 1cf78d4c4144f Author: David S. Miller Date: Fri Mar 3 08:28:44 2023 +0000 Merge branch 'nfp-ipsec-csum' Simon Horman says: ==================== nfp: fix incorrect IPsec checksum handling this short series resolves two problems with IPsec checksum handling in the nfp driver. * PATCH 1/3, 2/3: Correct setting of checksum flags. One patch for each of the nfd3 and nfdk datapaths. * Patch 3/3: Correct configuration of NETIF_F_CSUM_MASK so that the stack does not unecessarily calculate csums for IPsec offload packets. ==================== Signed-off-by: David S. Miller commit 1cf78d4c4144ffdbc2c9d505db482cb204bb480b Author: Huanhuan Wang Date: Thu Mar 2 10:58:30 2023 +0100 nfp: fix esp-tx-csum-offload doesn't take effect When esp-tx-csum-offload is set to on, the protocol stack shouldn't calculate the IPsec offload packet's csum, but it does. Because the callback `.ndo_features_check` incorrectly masked NETIF_F_CSUM_MASK bit. Fixes: 57f273adbcd4 ("nfp: add framework to support ipsec offloading") Signed-off-by: Huanhuan Wang Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 8b46168ca79c3aad04bc20605e523127266624d4 Author: Huanhuan Wang Date: Thu Mar 2 10:58:29 2023 +0100 nfp: fix incorrectly set csum flag for nfdk path The csum flag of IPsec packet are set repeatedly. Therefore, the csum flag set of IPsec and non-IPsec packet need to be distinguished. As the ipv6 header does not have a csum field, so l3-csum flag is not required to be set for ipv6 case. Fixes: 436396f26d50 ("nfp: support IPsec offloading for NFP3800") Signed-off-by: Huanhuan Wang Reviewed-by: Louis Peens Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 3e04419cbe2d0bc10ffc20c006c6513ffa4b1ca3 Author: Huanhuan Wang Date: Thu Mar 2 10:58:28 2023 +0100 nfp: fix incorrectly set csum flag for nfd3 path The csum flag of IPsec packet are set repeatedly. Therefore, the csum flag set of IPsec and non-IPsec packet need to be distinguished. As the ipv6 header does not have a csum field, so l3-csum flag is not required to be set for ipv6 case. L4-csum flag include the tcp csum flag and udp csum flag, we shouldn't set the udp and tcp csum flag at the same time for one packet, should set l4-csum flag according to the transport layer is tcp or udp. Fixes: 57f273adbcd4 ("nfp: add framework to support ipsec offloading") Signed-off-by: Huanhuan Wang Reviewed-by: Louis Peens Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 84cba1840e68430325ac133a11be06bfb2f7acd8 Author: Petr Oros Date: Wed Mar 1 21:47:07 2023 +0100 ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") In this refactor, ice_get_module_eeprom() reads the eeprom in blocks of size 8. But the condition that should protect the buffer overflow ignores the last block. The last block always contains zeros. Bug uncovered by ethtool upstream commit 9538f384b535 ("netlink: eeprom: Defer page requests to individual parsers") After this commit, ethtool reads a block with length = 1; to read the SFF-8024 identifier value. unpatched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 00 00 00 00 00 00 $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 00 00 00 00 $ $ ethtool -m enp65s0f0np0 Offset Values ------ ------ 0x0000: 11 06 06 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 01 08 00 0x0070: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 patched driver: $ ethtool -m enp65s0f0np0 offset 0x90 length 8 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c $ ethtool -m enp65s0f0np0 offset 0x90 length 12 Offset Values ------ ------ 0x0090: 00 00 01 a0 4d 65 6c 6c 61 6e 6f 78 $ ethtool -m enp65s0f0np0 Identifier : 0x11 (QSFP28) Extended identifier : 0x00 Extended identifier description : 1.5W max. Power consumption Extended identifier description : No CDR in TX, No CDR in RX Extended identifier description : High Power Class (> 3.5 W) not enabled Connector : 0x23 (No separable connector) Transceiver codes : 0x88 0x00 0x00 0x00 0x00 0x00 0x00 0x00 Transceiver type : 40G Ethernet: 40G Base-CR4 Transceiver type : 25G Ethernet: 25G Base-CR CA-N Encoding : 0x05 (64B/66B) BR, Nominal : 25500Mbps Rate identifier : 0x00 Length (SMF,km) : 0km Length (OM3 50um) : 0m Length (OM2 50um) : 0m Length (OM1 62.5um) : 0m Length (Copper or Active cable) : 1m Transmitter technology : 0xa0 (Copper cable unequalized) Attenuation at 2.5GHz : 4db Attenuation at 5.0GHz : 5db Attenuation at 7.0GHz : 7db Attenuation at 12.9GHz : 10db ........ .... Fixes: e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") Signed-off-by: Petr Oros Reviewed-by: Jesse Brandeburg Tested-by: Jesse Brandeburg Signed-off-by: David S. Miller commit 8f632a0a1f6760bb4b1dd7a7e95689df1b5552fb Merge: ad93bab6b8d3b bcec7171eba90 Author: David S. Miller Date: Fri Mar 3 08:22:39 2023 +0000 Merge branch 'net-tools-ynl-fixes' Jakub Kicinski says: ==================== tools: ynl: fix subset use and change default value for attrs/ops Fix a problem in subsetting, which will become apparent when the devlink family comes after the merge window. Even tho none of the existing families need this, we don't want someone to get "inspired" by the current, incorrect code when using specs in other languages. Change the default value for the first attr/op. This is a slight behavior change so needs to go in now. The diffstat of the last patch should serve as the clearest justification there.. ==================== Signed-off-by: David S. Miller commit bcec7171eba901cc5f427ebbad9fe17ed4749b8f Author: Jakub Kicinski Date: Wed Mar 1 10:36:42 2023 -0800 netlink: specs: update for codegen enumerating from 1 Now that the codegen rules had been changed we can update the specs to reflect the new default. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit ad4fafcde5bc1badb8fc2c7f260a5d6b83a038e4 Author: Jakub Kicinski Date: Wed Mar 1 10:36:41 2023 -0800 tools: ynl: use 1 as the default for first entry in attrs/ops Pretty much all families use value: 1 or reserve as unspec the first entry in attribute set and the first operation. Make this the default. Update documentation (the doc for values of operations just refers back to doc for attrs so updating only attrs). Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 7cf93538e087a792cb476008a757ab7c1c23b68c Author: Jakub Kicinski Date: Wed Mar 1 10:36:40 2023 -0800 tools: ynl: fully inherit attrs in subsets To avoid having to repeat the entire definition of an attribute (including the value) use the Attr object from the original set. In fact this is already the documented expectation. Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit ad93bab6b8d3bfeae4a0158eaabd61bb0b2fbb79 Merge: 9781e98a97110 02f18662f6c67 Author: Jakub Kicinski Date: Thu Mar 2 22:25:09 2023 -0800 Merge tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan Stefan Schmidt says: ==================== ieee802154 for net 2023-03-02 Two small fixes this time. Alexander Aring fixed a potential negative array access in the ca8210 driver. Miquel Raynal fixed a crash that could have been triggered through the extended netlink API for 802154. This only came in this merge window. Found by syzkaller. * tag 'ieee802154-for-net-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/wpan/wpan: ieee802154: Prevent user from crashing the host ca8210: fix mac_len negative array access ==================== Link: https://lore.kernel.org/r/20230302153032.1312755-1-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit 9781e98a97110f5e76999058368b4be76a788484 Author: Shigeru Yoshida Date: Thu Mar 2 01:39:13 2023 +0900 net: caif: Fix use-after-free in cfusbl_device_notify() syzbot reported use-after-free in cfusbl_device_notify() [1]. This causes a stack trace like below: BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214 CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 notifier_call_chain+0xb5/0x200 kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/dev.c:10227 [inline] netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341 default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 When unregistering a net device, unregister_netdevice_many_notify() sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers with NETDEV_UNREGISTER, and adds the device to the todo list. Later on, devices in the todo list are processed by netdev_run_todo(). netdev_run_todo() waits devices' reference count become 1 while rebdoadcasting NETDEV_UNREGISTER notification. When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple times, the parent device might be freed. This could cause UAF. Processing NETDEV_UNREGISTER multiple times also causes inbalance of reference count for the module. This patch fixes the issue by accepting only first NETDEV_UNREGISTER notification. Fixes: 7ad65bf68d70 ("caif: Add support for CAIF over CDC NCM USB interface") CC: sjur.brandeland@stericsson.com Reported-by: syzbot+b563d33852b893653a9e@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=c3bfd8e2450adab3bffe4d80821fbbced600407f [1] Signed-off-by: Shigeru Yoshida Link: https://lore.kernel.org/r/20230301163913.391304-1-syoshida@redhat.com Signed-off-by: Jakub Kicinski commit e57cf3639c323eeed05d3725fd82f91b349adca8 Author: Yuiko Oshino Date: Wed Mar 1 08:43:07 2023 -0700 net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver Move the LAN7800 internal phy (phy ID 0x0007c132) specific register accesses to the phy driver (microchip.c). Fix the error reported by Enguerrand de Ribaucourt in December 2022, "Some operations during the cable switch workaround modify the register LAN88XX_INT_MASK of the PHY. However, this register is specific to the LAN8835 PHY. For instance, if a DP8322I PHY is connected to the LAN7801, that register (0x19), corresponds to the LED and MAC address configuration, resulting in unapropriate behavior." I did not test with the DP8322I PHY, but I tested with an EVB-LAN7800 with the internal PHY. Fixes: 14437e3fa284 ("lan78xx: workaround of forced 100 Full/Half duplex mode error") Signed-off-by: Yuiko Oshino Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230301154307.30438-1-yuiko.oshino@microchip.com Signed-off-by: Jakub Kicinski commit ecf1d926661bec4080a79c0ac9dbfe02b31702cf Author: Konrad Dybcio Date: Tue Feb 28 16:33:34 2023 +0100 mailmap: map Dikshita Agarwal's old address to his current one Dikshita's old email is still picked up by the likes of get_maintainer.pl and keeps bouncing. Map it to his current one. Link: https://lkml.kernel.org/r/20230228153335.907164-2-konrad.dybcio@linaro.org Signed-off-by: Konrad Dybcio Cc: Dikshita Agarwal Signed-off-by: Andrew Morton commit 6a41de1eb2168c78079cc5e6bbbec6d1490c54ed Author: Konrad Dybcio Date: Tue Feb 28 16:33:35 2023 +0100 mailmap: map Vikash Garodia's old address to his current one Vikash's old email is still picked up by the likes of get_maintainer.pl and keeps bouncing. Map it to his current one. Link: https://lkml.kernel.org/r/20230228153335.907164-3-konrad.dybcio@linaro.org Signed-off-by: Konrad Dybcio Cc: Vikash Garodia Signed-off-by: Andrew Morton commit 3e35102666f873a135d31a726ac1ec8af4905206 Author: Andrew Morton Date: Sun Feb 26 12:31:11 2023 -0800 fs/cramfs/inode.c: initialize file_ra_state file_ra_state_init() assumes that the file_ra_state has been zeroed out. Fixes a KMSAN used-unintialized issue (at least). Fixes: cf948cbc35e80 ("cramfs: read_mapping_page() is synchronous") Reported-by: syzbot Link: https://lkml.kernel.org/r/0000000000008f74e905f56df987@google.com Cc: Matthew Wilcox Cc: Nicolas Pitre Cc: Signed-off-by: Andrew Morton commit 07db5e247ab5858439b14dd7cc1fe538b9efcf32 Author: Dongliang Mu Date: Sun Feb 26 20:49:47 2023 +0800 fs: hfsplus: fix UAF issue in hfsplus_put_super The current hfsplus_put_super first calls hfs_btree_close on sbi->ext_tree, then invokes iput on sbi->hidden_dir, resulting in an use-after-free issue in hfsplus_release_folio. As shown in hfsplus_fill_super, the error handling code also calls iput before hfs_btree_close. To fix this error, we move all iput calls before hfsplus_btree_close. Note that this patch is tested on Syzbot. Link: https://lkml.kernel.org/r/20230226124948.3175736-1-mudongliangabcd@gmail.com Reported-by: syzbot+57e3e98f7e3b80f64d56@syzkaller.appspotmail.com Tested-by: Dongliang Mu Signed-off-by: Dongliang Mu Cc: Bart Van Assche Cc: Jens Axboe Cc: Muchun Song Cc: Roman Gushchin Cc: "Theodore Ts'o" Cc: Signed-off-by: Andrew Morton commit b905039e428d639adeebb719b76f98865ea38d4d Author: Guilherme G. Piccoli Date: Sun Feb 26 13:08:38 2023 -0300 panic: fix the panic_print NMI backtrace setting Commit 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in panic_print") introduced a setting for the "panic_print" kernel parameter to allow users to request a NMI backtrace on panic. Problem is that the panic_print handling happens after the secondary CPUs are already disabled, hence this option ended-up being kind of a no-op - kernel skips the NMI trace in idling CPUs, which is the case of offline CPUs. Fix it by checking the NMI backtrace bit in the panic_print prior to the CPU disabling function. Link: https://lkml.kernel.org/r/20230226160838.414257-1-gpiccoli@igalia.com Fixes: 8d470a45d1a6 ("panic: add option to dump all CPUs backtraces in panic_print") Signed-off-by: Guilherme G. Piccoli Cc: Cc: Baoquan He Cc: Dave Young Cc: Feng Tang Cc: HATAYAMA Daisuke Cc: Hidehiro Kawai Cc: Kees Cook Cc: Michael Kelley Cc: Petr Mladek Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 359d62559f578dc1ac86fd2d198f1455e9d8ce04 Author: Eric Biggers Date: Thu Feb 23 20:26:18 2023 -0800 lib: parser: update documentation for match_NUMBER functions commit 67222c4ba8af ("lib: parser: optimize match_NUMBER apis to use local array") removed -ENOMEM as a possible return value, so update the comments accordingly. Link: https://lkml.kernel.org/r/20230224042618.9092-1-ebiggers@kernel.org Fixes: 67222c4ba8af ("lib: parser: optimize match_NUMBER apis to use local array") Signed-off-by: Eric Biggers Cc: Li Lingfeng Cc: Tejun Heo Cc: Yu Kuai Signed-off-by: Andrew Morton commit 4ec4190be4cf9cc3e0ccaf5f155a5f9066d18950 Author: Marco Elver Date: Fri Feb 24 09:59:42 2023 +0100 kasan, x86: don't rename memintrinsics in uninstrumented files Now that memcpy/memset/memmove are no longer overridden by KASAN, we can just use the normal symbol names in uninstrumented files. Drop the preprocessor redefinitions. Link: https://lkml.kernel.org/r/20230224085942.1791837-4-elver@google.com Fixes: 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() functions") Signed-off-by: Marco Elver Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Borislav Petkov (AMD) Cc: Dave Hansen Cc: Dmitry Vyukov Cc: Ingo Molnar Cc: Jakub Jelinek Cc: Kees Cook Cc: Linux Kernel Functional Testing Cc: Naresh Kamboju Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra (Intel) Cc: Thomas Gleixner Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 85f195b12d8b769fa14ef37aa8a5e6bd07458122 Author: Marco Elver Date: Fri Feb 24 09:59:41 2023 +0100 kasan: test: fix test for new meminstrinsic instrumentation The tests for memset/memmove have been failing since they haven't been instrumented in 69d4c0d32186. Fix the test to recognize when memintrinsics aren't instrumented, and skip test cases accordingly. We also need to conditionally pass -fno-builtin to the test, otherwise the instrumentation pass won't recognize memintrinsics and end up not instrumenting them either. Link: https://lkml.kernel.org/r/20230224085942.1791837-3-elver@google.com Fixes: 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() functions") Reported-by: Linux Kernel Functional Testing Signed-off-by: Marco Elver Reviewed-by: Andrey Konovalov Tested-by: Linux Kernel Functional Testing Tested-by: Naresh Kamboju Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Borislav Petkov (AMD) Cc: Dave Hansen Cc: Dmitry Vyukov Cc: Ingo Molnar Cc: Jakub Jelinek Cc: Kees Cook Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra (Intel) Cc: Thomas Gleixner Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 36be5cba99f6f9984a9a9f0454f95a38f4184d3e Author: Marco Elver Date: Fri Feb 24 09:59:40 2023 +0100 kasan: treat meminstrinsic as builtins in uninstrumented files Where the compiler instruments meminstrinsics by generating calls to __asan/__hwasan_ prefixed functions, let the compiler consider memintrinsics as builtin again. To do so, never override memset/memmove/memcpy if the compiler does the correct instrumentation - even on !GENERIC_ENTRY architectures. [elver@google.com: powerpc: don't rename memintrinsics if compiler adds prefixes] Link: https://lore.kernel.org/all/20230224085942.1791837-1-elver@google.com/ [1] Link: https://lkml.kernel.org/r/20230227094726.3833247-1-elver@google.com Link: https://lkml.kernel.org/r/20230224085942.1791837-2-elver@google.com Fixes: 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() functions") Signed-off-by: Marco Elver Reviewed-by: Andrey Konovalov Tested-by: Linux Kernel Functional Testing Tested-by: Naresh Kamboju Acked-by: Michael Ellerman (powerpc) Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Borislav Petkov (AMD) Cc: Dave Hansen Cc: Dmitry Vyukov Cc: Ingo Molnar Cc: Jakub Jelinek Cc: Kees Cook Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Peter Zijlstra (Intel) Cc: Thomas Gleixner Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 51287dcb00cc715c27bf6a6b4dbd431621c5b65a Author: Marco Elver Date: Fri Feb 24 09:59:39 2023 +0100 kasan: emit different calls for instrumentable memintrinsics Clang 15 provides an option to prefix memcpy/memset/memmove calls with __asan_/__hwasan_ in instrumented functions: https://reviews.llvm.org/D122724 GCC will add support in future: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108777 Use it to regain KASAN instrumentation of memcpy/memset/memmove on architectures that require noinstr to be really free from instrumented mem*() functions (all GENERIC_ENTRY architectures). Link: https://lkml.kernel.org/r/20230224085942.1791837-1-elver@google.com Fixes: 69d4c0d32186 ("entry, kasan, x86: Disallow overriding mem*() functions") Signed-off-by: Marco Elver Acked-by: Peter Zijlstra (Intel) Reviewed-by: Andrey Konovalov Tested-by: Linux Kernel Functional Testing Tested-by: Naresh Kamboju Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Borislav Petkov (AMD) Cc: Dave Hansen Cc: Dmitry Vyukov Cc: Ingo Molnar Cc: Jakub Jelinek Cc: kasan-dev@googlegroups.com Cc: Kees Cook Cc: Linux Kernel Functional Testing Cc: Nathan Chancellor # build only Cc: Nick Desaulniers Cc: Nicolas Schier Cc: Thomas Gleixner Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 49d24398327e32265eccdeec4baeb5a6a609c0bd Author: Uday Shankar Date: Tue Feb 28 17:06:55 2023 -0700 blk-mq: enforce op-specific segment limits in blk_insert_cloned_request The block layer might merge together discard requests up until the max_discard_segments limit is hit, but blk_insert_cloned_request checks the segment count against max_segments regardless of the req op. This can result in errors like the following when discards are issued through a DM device and max_discard_segments exceeds max_segments for the queue of the chosen underlying device. blk_insert_cloned_request: over max segments limit. (256 > 129) Fix this by looking at the req_op and enforcing the appropriate segment limit - max_discard_segments for REQ_OP_DISCARDs and max_segments for everything else. Signed-off-by: Uday Shankar Reviewed-by: Keith Busch Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20230301000655.48112-1-ushankar@purestorage.com Signed-off-by: Jens Axboe commit 2eb29d59ddf02e39774abfb60b2030b0b7e27c1f Merge: 39ce4395c3ba7 54ceb92724a8c Author: Linus Torvalds Date: Thu Mar 2 15:08:54 2023 -0800 Merge tag 'drm-next-2023-03-03-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "fbdev: - fix uninit var in error path shmem: - revert unGPLing an export i915: - Don't use stolen memory or BAR mappings for ring buffers with LLC - Add inverted backlight quirk for HP 14-r206nv - Fix GSI offset for MCR lookups - GVT fixes (memleak, debugfs attributes, kconfig, typos) amdgpu: - SMU 13 fixes - Enable TMZ for GC 10.3.6 - Misc display fixes - Buddy allocator fixes - GC 11 fixes - S0ix fix - INFO IOCTL queries for GC 11 - VCN harvest fixes for SR-IOV - UMC 8.10 RAS fixes - Don't restrict bpc to 8 - NBIO 7.5 fix - Allow freesync on PCon for more devices amdkfd: - SDMA fix - Illegal memory access fix" * tag 'drm-next-2023-03-03-1' of git://anongit.freedesktop.org/drm/drm: (45 commits) drm/amdgpu/vcn: fix compilation issue with legacy gcc drm/amd/display: Extend Freesync over PCon support for more devices Revert "drm/amd/display: Do not set DRR on pipe commit" drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes drm/amd/display: Ext displays with dock can't recognized after resume drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini drm/amdgpu: remove unused variable ring drm/amd/display: fix dm irq error message in gpu recover drm/amd: Fix initialization for nbio 7.5.1 drm/amd/display: Don't restrict bpc to 8 bpc drm/amdgpu: Make umc_v8_10_convert_error_address static and remove unused variable drm/radeon: Fix eDP for single-display iMac11,2 drm/shmem-helper: Revert accidental non-GPL export drm: omapdrm: Do not use helper unininitialized in omap_fbdev_init() drm/amd/pm: downgrade log level upon SMU IF version mismatch drm/amdgpu: Add ecc info query interface for umc v8_10 drm/amdgpu: Add convert_error_address function for umc v8_10 drm/amdgpu: add bad_page_threshold check in ras_eeprom_check_err drm/amdgpu: change default behavior of bad_page_threshold parameter drm/amdgpu: exclude duplicate pages from UMC RAS UE count ... commit 39ce4395c3ba730341b067e1fb8abbdf9c47ca77 Merge: a9a01e1238cf5 010338d729c10 Author: Linus Torvalds Date: Thu Mar 2 14:57:53 2023 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - In copy_highpage(), only reset the tag of the destination pointer if KASAN_HW_TAGS is enabled so that user-space MTE does not interfere with KASAN_SW_TAGS (which relies on top-byte-ignore). - Remove warning if SME is detected without SVE, the kernel can cope with such configuration (though none in the field currently). - In cfi_handler(), pass the ESR_EL1 value to die() for consistency with other die() callers. - Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP on arm64 since the pte manipulation from the generic vmemmap_remap_pte() does not follow the required ARM break-before-make sequence (clear the pte, flush the TLBs, set the new pte). It may be re-enabled once this sequence is sorted. - Fix possible memory leak in the arm64 ACPI code if the SMCCC version and conduit checks fail. - Forbid CALL_OPS with CC_OPTIMIZE_FOR_SIZE since gcc ignores -falign-functions=N with -Os. - Don't pretend KASLR is enabled if offset < MIN_KIMG_ALIGN as no randomisation would actually take place. * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: kaslr: don't pretend KASLR is enabled if offset < MIN_KIMG_ALIGN arm64: ftrace: forbid CALL_OPS with CC_OPTIMIZE_FOR_SIZE arm64: acpi: Fix possible memory leak of ffh_ctxt arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP arm64: pass ESR_ELx to die() of cfi_handler arm64/fpsimd: Remove warning for SME without SVE arm64: Reset KASAN tag in copy_highpage with HW tags only commit 54ceb92724a8cf5294c284d5e9f770fc763cdab2 Merge: 7b7d2429a1d2f 6bb811d0ee3e1 Author: Dave Airlie Date: Fri Mar 3 08:26:59 2023 +1000 Merge tag 'amd-drm-fixes-6.3-2023-03-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.3-2023-03-02: amdgpu: - SMU 13 fixes - Enable TMZ for GC 10.3.6 - Misc display fixes - Buddy allocator fixes - GC 11 fixes - S0ix fix - INFO IOCTL queries for GC 11 - VCN harvest fixes for SR-IOV - UMC 8.10 RAS fixes - Don't restrict bpc to 8 - NBIO 7.5 fix - Allow freesync on PCon for more devices amdkfd: - SDMA fix - Illegal memory access fix radeon: - Display fix for iMac11,2 UAPI: - Add some additional INFO IOCTL queries for GC 11 fixes Mesa MR: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/21403 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230302051843.7793-1-alexander.deucher@amd.com commit 7b7d2429a1d2f789f4ce34afadbd76510a0236cc Merge: 3d3921d1025e4 5d2fdb255c529 Author: Dave Airlie Date: Fri Mar 3 08:19:35 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-02-27' of git://anongit.freedesktop.org/drm/drm-intel into drm-next drm/i915 fixes for v6.3-rc1: - Don't use stolen memory or BAR mappings for ring buffers with LLC - Add inverted backlight quirk for HP 14-r206nv - Fix GSI offset for MCR lookups - GVT fixes (memleak, debugfs attributes, kconfig, typos) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87cz5v2z0j.fsf@intel.com commit 3d3921d1025e4e1d646f84dcb2ae75edc89f7837 Merge: a48bba98380cb 047a754558d64 Author: Dave Airlie Date: Fri Mar 3 08:18:56 2023 +1000 Merge tag 'drm-misc-next-fixes-2023-02-28' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Short summary of fixes pull: Fixes uninitialized variables in fbdev error paths and reverts an SHMEM-helper symbol back to being exported as GPL. Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/Y/3Fw1HjgPcplo+j@linux-uq9g commit 3098cb655e7c9ea1c2919e61234f63ebaab6bb21 Author: Arnaldo Carvalho de Melo Date: Thu Mar 2 11:16:36 2023 -0300 rust: bindgen: Add `alt_instr` as opaque type To address this build error: BINDGEN rust/bindings/bindings_generated.rs BINDGEN rust/bindings/bindings_helpers_generated.rs EXPORTS rust/exports_core_generated.h RUSTC P rust/libmacros.so RUSTC L rust/compiler_builtins.o RUSTC L rust/alloc.o RUSTC L rust/bindings.o RUSTC L rust/build_error.o EXPORTS rust/exports_alloc_generated.h error[E0588]: packed type cannot transitively contain a `#[repr(align)]` type --> /var/home/acme/git/linux/rust/bindings/bindings_generated.rs:10094:1 | 10094 | / pub struct alt_instr { 10095 | | pub instr_offset: s32, 10096 | | pub repl_offset: s32, 10097 | | pub __bindgen_anon_1: alt_instr__bindgen_ty_1, 10098 | | pub instrlen: u8_, 10099 | | pub replacementlen: u8_, 10100 | | } | |_^ | note: `alt_instr__bindgen_ty_1__bindgen_ty_1` has a `#[repr(align)]` attribute --> /var/home/acme/git/linux/rust/bindings/bindings_generated.rs:10111:1 | 10111 | / pub struct alt_instr__bindgen_ty_1__bindgen_ty_1 { 10112 | | pub _bitfield_1: __BindgenBitfieldUnit<[u8; 4usize], u16>, 10113 | | } | |_^ note: `alt_instr` contains a field of type `alt_instr__bindgen_ty_1` --> /var/home/acme/git/linux/rust/bindings/bindings_generated.rs:10097:9 | 10097 | pub __bindgen_anon_1: alt_instr__bindgen_ty_1, | ^^^^^^^^^^^^^^^^ note: ...which contains a field of type `alt_instr__bindgen_ty_1__bindgen_ty_1` --> /var/home/acme/git/linux/rust/bindings/bindings_generated.rs:10104:9 | 10104 | pub __bindgen_anon_1: alt_instr__bindgen_ty_1__bindgen_ty_1, | ^^^^^^^^^^^^^^^^ error: aborting due to previous error For more information about this error, try `rustc --explain E0588`. make[1]: *** [rust/Makefile:389: rust/bindings.o] Error 1 make: *** [Makefile:1293: prepare] Error 2 Cc: Derek Barbosa Cc: Miguel Ojeda Signed-off-by: Arnaldo Carvalho de Melo Fixes: 5d1dd961e743 ("x86/alternatives: Add alt_instr.flags") Reported-by: kernel test robot Reported-by: Vincenzo Palazzo Reviewed-by: Martin Rodriguez Reboredo Reviewed-by: Vincenzo Palazzo Signed-off-by: Miguel Ojeda commit 25f69c69bc3ca8c781a94473f28d443d745768e3 Author: Changbin Du Date: Thu Mar 2 11:11:44 2023 +0800 perf stat: Fix counting when initial delay configured When creating counters with initial delay configured, the enable_on_exec field is not set. So we need to enable the counters later. The problem is, when a workload is specified the target__none() is true. So we also need to check stat_config.initial_delay. In this change, we add a new field 'initial_delay' for struct target which could be shared by other subcommands. And define target__enable_on_exec() which returns whether enable_on_exec should be set on normal cases. Before this fix the event is not counted: $ ./perf stat -e instructions -D 100 sleep 2 Events disabled Events enabled Performance counter stats for 'sleep 2': instructions 1.901661124 seconds time elapsed 0.001602000 seconds user 0.000000000 seconds sys After fix it works: $ ./perf stat -e instructions -D 100 sleep 2 Events disabled Events enabled Performance counter stats for 'sleep 2': 404,214 instructions 1.901743475 seconds time elapsed 0.001617000 seconds user 0.000000000 seconds sys Fixes: c587e77e100fa40e ("perf stat: Do not delay the workload with --delay") Signed-off-by: Changbin Du Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Hui Wang Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230302031146.2801588-2-changbin.du@huawei.com Signed-off-by: Arnaldo Carvalho de Melo commit a98c0710b47d7dd44a351d08542360ff23f78330 Author: Arnaldo Carvalho de Melo Date: Thu Feb 23 10:54:41 2023 -0300 tools headers svm: Sync svm headers with the kernel sources To pick the changes in: 8c29f01654053258 ("x86/sev: Add SEV-SNP guest feature negotiation support") That triggers: CC /tmp/build/perf-tools/arch/x86/util/kvm-stat.o CC /tmp/build/perf-tools/util/header.o LD /tmp/build/perf-tools/arch/x86/util/perf-in.o LD /tmp/build/perf-tools/arch/x86/perf-in.o LD /tmp/build/perf-tools/arch/perf-in.o LD /tmp/build/perf-tools/util/perf-in.o LD /tmp/build/perf-tools/perf-in.o LINK /tmp/build/perf-tools/perf But this time causes no changes in tooling results, as the introduced SVM_VMGEXIT_TERM_REQUEST exit reason wasn't added to SVM_EXIT_REASONS, that is used in kvm-stat.c. And addresses this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/uapi/asm/svm.h' differs from latest version at 'arch/x86/include/uapi/asm/svm.h' diff -u tools/arch/x86/include/uapi/asm/svm.h arch/x86/include/uapi/asm/svm.h Cc: Adrian Hunter Cc: Borislav Petkov (AMD) Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nikunj A Dadhania Link: http://lore.kernel.org/lkml/ Signed-off-by: Arnaldo Carvalho de Melo commit a9a01e1238cf5b477ec6aa54855356e518998991 Merge: c3f9b9fa10b9f cf3be7e82b129 Author: Linus Torvalds Date: Thu Mar 2 11:12:01 2023 -0800 Merge tag 'linux-watchdog-6.3-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - qcom-wdt dt-bindings improvements and additions (like MSM8994 and MDM9615) - mtk_wdt: Add reset_by_toprgu support - devm_clk_get_enabled() helper changes - Fix kmemleak in watchdog_cdev_register - watchdog sysfs improvements - Other fixes and small improvements * tag 'linux-watchdog-6.3-rc1' of git://www.linux-watchdog.org/linux-watchdog: (52 commits) watchdog: at91rm9200: Only warn once about problems in .remove() watchdog: mt7621-wdt: avoid ralink architecture dependent code watchdog: mt7621-wdt: avoid static global declarations dt-bindings: watchdog: mt7621-wdt: add phandle to access system controller registers watchdog: sbsa_wdog: Make sure the timeout programming is within the limits dt-bindings: watchdog: qcom-wdt: add qcom,apss-wdt-sa8775p compatible watchdog: report options in sysfs watchdog: report fw_version in sysfs dt-bindings: watchdog: fsl-imx: document suspend in wait mode watchdog: imx2_wdg: suspend watchdog in WAIT mode watchdog: pcwd_usb: Fix attempting to access uninitialized memory dt-bindings: watchdog: qcom-wdt: merge MSM timer dt-bindings: watchdog: qcom-wdt: allow interrupts dt-bindings: watchdog: qcom-wdt: add qcom,kpss-wdt-mdm9615 dt-bindings: watchdog: qcom-wdt: fix list of MSM timer compatibles dt-bindings: watchdog: qcom-wdt: do not allow fallback alone dt-bindings: watchdog: qcom-wdt: require fallback for IPQ4019 watchdog: Fix kmemleak in watchdog_cdev_register watchdog: Include when appropriate watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path ... commit c3f9b9fa10b9fb677966bfdab8c00da739c4af1b Merge: 04a357b1f6f0b f7c4d9b133c7a Author: Linus Torvalds Date: Thu Mar 2 10:48:30 2023 -0800 Merge tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "Two small fixes from Xiubo and myself, marked for stable" * tag 'ceph-for-6.3-rc1' of https://github.com/ceph/ceph-client: rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails ceph: update the time stamps and try to drop the suid/sgid commit 04a357b1f6f0b6f7c8689361fa8802e8e35d02ad Merge: 857f1268a5911 1a2c73f4834dd Author: Linus Torvalds Date: Thu Mar 2 10:34:14 2023 -0800 Merge tag 'mips_6.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull more MIPS updates from Thomas Bogendoerfer: "A few more cleanups and fixes" * tag 'mips_6.3_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: Workaround clang inline compat branch issue mips: dts: ralink: mt7621: add phandle to system controller node for watchdog mips: dts: ralink: mt7621: rename watchdog node from 'wdt' into 'watchdog' mips: ralink: make SOC_MT7621 select PINCTRL mips: remove SYS_HAS_CPU_MIPS32_R1 from RALINK MIPS: cevt-r4k: Offset the value used to clear compare interrupt MIPS: smp-cps: Don't rely on CP0_CMGCRBASE MIPS: Remove DMA_PERDEV_COHERENT commit 4d8457fe0eb9c80ff7795cf8a30962128b71d853 Author: Johan Hovold Date: Thu Mar 2 08:47:04 2023 +0100 drm/edid: fix info leak when failing to get panel id Make sure to clear the transfer buffer before fetching the EDID to avoid leaking slab data to the logs on errors that leave the buffer unchanged. Fixes: 69c7717c20cc ("drm/edid: Dump the EDID when drm_edid_get_panel_id() has an error") Cc: stable@vger.kernel.org # 6.2 Cc: Douglas Anderson Signed-off-by: Johan Hovold Reviewed-by: Jani Nikula Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20230302074704.11371-1-johan+linaro@kernel.org commit 857f1268a591147f7be7509f249dbb3aba6fc65c Merge: 6972633c58fd1 00c8f01c4e846 Author: Linus Torvalds Date: Thu Mar 2 09:45:34 2023 -0800 Merge tag 'objtool-core-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molnar: - Shrink 'struct instruction', to improve objtool performance & memory footprint - Other maximum memory usage reductions - this makes the build both faster, and fixes kernel build OOM failures on allyesconfig and similar configs when they try to build the final (large) vmlinux.o - Fix ORC unwinding when a kprobe (INT3) is set on a stack-modifying single-byte instruction (PUSH/POP or LEAVE). This requires the extension of the ORC metadata structure with a 'signal' field - Misc fixes & cleanups * tag 'objtool-core-2023-03-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (22 commits) objtool: Fix ORC 'signal' propagation objtool: Remove instruction::list x86: Fix FILL_RETURN_BUFFER objtool: Fix overlapping alternatives objtool: Union instruction::{call_dest,jump_table} objtool: Remove instruction::reloc objtool: Shrink instruction::{type,visited} objtool: Make instruction::alts a single-linked list objtool: Make instruction::stack_ops a single-linked list objtool: Change arch_decode_instruction() signature x86/entry: Fix unwinding from kprobe on PUSH/POP instruction x86/unwind/orc: Add 'signal' field to ORC metadata objtool: Optimize layout of struct special_alt objtool: Optimize layout of struct symbol objtool: Allocate multiple structures with calloc() objtool: Make struct check_options static objtool: Make struct entries[] static and const objtool: Fix HOSTCC flag usage objtool: Properly support make V=1 objtool: Install libsubcmd in build ... commit 6972633c58fd13c02dcaabcb6be380a98feda9fa Merge: 7c2bc4ed278ee ddf75a86aba2c Author: Linus Torvalds Date: Thu Mar 2 09:37:58 2023 -0800 Merge tag 'auxdisplay-6.3' of https://github.com/ojeda/linux Pull auxdisplay fix from Miguel Ojeda: - hd44780: Fix potential memory leak in hd44780_remove() (Jianglei Nie) * tag 'auxdisplay-6.3' of https://github.com/ojeda/linux: auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() commit caa82ae7ef52b7cf5f80a2b2fbcbdbcfd16426cc Author: Al Viro Date: Mon Jan 30 23:52:40 2023 -0500 openrisc: fix livelock in uaccess openrisc equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Signed-off-by: Al Viro commit e902e508c5b280488c62f119a05ad88f9f7eb1cb Author: Al Viro Date: Mon Jan 30 23:51:40 2023 -0500 nios2: fix livelock in uaccess nios2 equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Signed-off-by: Al Viro commit 7c2bc4ed278ee0ffc0a1a37aaf7f39f1bfe8da4d Merge: 093b2dc4024a9 0c058fb94ae0e Author: Linus Torvalds Date: Thu Mar 2 09:32:34 2023 -0800 Merge tag 'driver-core-6.3-rc1_2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here is another small set of driver core patches. They resolve some reported problems with the previous driver core patches that are in your tree. They solve a problem with the bus_type cleanup as reported and fixed by Geert, and two fw_devlink changes to make debugging problems easier. There is one known outstanding problem with the fw_deflink changes in your tree that is still being worked on, and it looks like a clk core change will be submitted soon for that, probably after 6.3-rc1. All three of these have been in linux-next with no reported problems (only reports that they fixed problems)" * tag 'driver-core-6.3-rc1_2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: driver core: fw_devlink: Print full path and name of fwnode driver core: fw_devlink: Avoid spurious error message driver core: bus: Handle early calls to bus_to_subsys() commit a1179ac743e8f2044b67848b5109614619b65366 Author: Al Viro Date: Mon Jan 30 23:50:22 2023 -0500 microblaze: fix livelock in uaccess microblaze equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Signed-off-by: Al Viro commit d088af1e221c32bd67825c5dccf664f699e827b4 Author: Al Viro Date: Mon Jan 30 23:47:28 2023 -0500 ia64: fix livelock in uaccess ia64 equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Signed-off-by: Al Viro commit 79c54c97c7735e09f9e2193a713f30e56eec00dc Author: Al Viro Date: Tue Jan 31 00:03:40 2023 -0500 sparc: fix livelock in uaccess sparc equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Signed-off-by: Al Viro commit dce45493aff3fdd57fed2a0da264e585dba88433 Author: Al Viro Date: Mon Jan 30 23:34:16 2023 -0500 alpha: fix livelock in uaccess alpha equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Signed-off-by: Al Viro commit 15261678a8c2ff093ffedad730b1646d34a1716a Author: Al Viro Date: Mon Jan 30 23:53:52 2023 -0500 parisc: fix livelock in uaccess parisc equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Tested-by: Helge Deller Signed-off-by: Al Viro commit 0b92ed09cb9ffada29ca05510ef28252b6059d6d Author: Al Viro Date: Mon Jan 30 23:46:10 2023 -0500 hexagon: fix livelock in uaccess hexagon equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Acked-by: Brian Cain Signed-off-by: Al Viro commit d835eb3a57de50d16dd4a6b53f95dbc2bfa8ef48 Author: Al Viro Date: Mon Jan 30 23:55:52 2023 -0500 riscv: fix livelock in uaccess riscv equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Tested-by: Björn Töpel Tested-by: Geert Uytterhoeven Signed-off-by: Al Viro commit bd75497a77ccae9a5e1b0f1a3fa8283d67b21f4c Author: Al Viro Date: Mon Jan 30 23:48:54 2023 -0500 m68k: fix livelock in uaccess m68k equivalent of 26178ec11ef3 "x86: mm: consolidate VM_FAULT_RETRY handling" If e.g. get_user() triggers a page fault and a fatal signal is caught, we might end up with handle_mm_fault() returning VM_FAULT_RETRY and not doing anything to page tables. In such case we must *not* return to the faulting insn - that would repeat the entire thing without making any progress; what we need instead is to treat that as failed (user) memory access. Tested-by: Finn Thain Tested-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Signed-off-by: Al Viro commit 093b2dc4024a9dca9cba539625c32c8056b51fe4 Merge: fd7ee8de984ef 2449d436681d4 Author: Linus Torvalds Date: Thu Mar 2 09:25:38 2023 -0800 Merge tag 'spi-fix-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small set of fixes for SPI drivers, Krishna has been doing a bunch of work on Tegra210 QuadSPI and found a bunch of issues there and there's a couple of small fixes for other drivers too" * tag 'spi-fix-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: tegra210-quad: Fix iterator outside loop spi: tegra210-quad: Fix validate combined sequence spi: tegra210-quad: set half duplex flag spi: spi-sn-f-ospi: fix duplicate flag while assigning to mode_bits spi: cadence-quadspi: Fix cancel the indirect read mask commit fd7ee8de984efcd31b8f5dce9e340ccd59eb436f Merge: ee3f96b164688 80d2c29e09e66 Author: Linus Torvalds Date: Thu Mar 2 09:21:25 2023 -0800 Merge tag 'regulator-fix-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Two fixes here, one driver fix for incorrect error codes and a fix in the core to use ktime_get_boottime() in order to fix accounting of the time regulators have been powered down over suspend. ktime_get() pauses over suspend which is not what we want" * tag 'regulator-fix-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: Use ktime_get_boottime() to determine how long a regulator was off regulator: max597x: Fix error return code in max597x_get_status commit 0fb7fb713461e44b12e72c292bf90ee300f40710 Author: Thomas Gleixner Date: Wed Mar 1 22:07:48 2023 +0100 genirq/msi, platform-msi: Ensure that MSI descriptors are unreferenced Miquel reported a warning in the MSI core which is triggered when interrupts are freed via platform_msi_device_domain_free(). This code got reworked to use core functions for freeing the MSI descriptors, but nothing took care to clear the msi_desc->irq entry, which then triggers the warning in msi_free_msi_desc() which uses desc->irq to validate that the descriptor has been torn down. The same issue exists in msi_domain_populate_irqs(). Up to the point that msi_free_msi_descs() grew a warning for this case, this went un-noticed. Provide the counterpart of msi_domain_populate_irqs() and invoke it in platform_msi_device_domain_free() before freeing the interrupts and MSI descriptors and also in the error path of msi_domain_populate_irqs(). Fixes: 2f2940d16823 ("genirq/msi: Remove filter from msi_free_descs_free_range()") Reported-by: Miquel Raynal Signed-off-by: Thomas Gleixner Tested-by: Miquel Raynal Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/87mt4wkwnv.ffs@tglx commit cd57953936f2213dfaccce10d20f396956222c7d Author: Vasily Gorbik Date: Wed Mar 1 17:58:06 2023 +0100 s390/kprobes: fix current_kprobe never cleared after kprobes reenter Recent test_kprobe_missed kprobes kunit test uncovers the following problem. Once kprobe is triggered from another kprobe (kprobe reenter), all future kprobes on this cpu are considered as kprobe reenter, thus pre_handler and post_handler are not being called and kprobes are counted as "missed". Commit b9599798f953 ("[S390] kprobes: activation and deactivation") introduced a simpler scheme for kprobes (de)activation and status tracking by using push_kprobe/pop_kprobe, which supposed to work for both initial kprobe entry as well as kprobe reentry and helps to avoid handling those two cases differently. The problem is that a sequence of calls in case of kprobes reenter: push_kprobe() <- NULL (current_kprobe) push_kprobe() <- kprobe1 (current_kprobe) pop_kprobe() -> kprobe1 (current_kprobe) pop_kprobe() -> kprobe1 (current_kprobe) leaves "kprobe1" as "current_kprobe" on this cpu, instead of setting it to NULL. In fact push_kprobe/pop_kprobe can only store a single state (there is just one prev_kprobe in kprobe_ctlblk). Which is a hack but sufficient, there is no need to have another prev_kprobe just to store NULL. To make a simple and backportable fix simply reset "prev_kprobe" when kprobe is poped from this "stack". No need to worry about "kprobe_status" in this case, because its value is only checked when current_kprobe != NULL. Cc: stable@vger.kernel.org Fixes: b9599798f953 ("[S390] kprobes: activation and deactivation") Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit 42e19e6f04984088b6f9f0507c4c89a8152d9730 Author: Vasily Gorbik Date: Wed Mar 1 02:23:08 2023 +0100 s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler Recent test_kprobe_missed kprobes kunit test uncovers the following error (reported when CONFIG_DEBUG_ATOMIC_SLEEP is enabled): BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 662, name: kunit_try_catch preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 no locks held by kunit_try_catch/662. irq event stamp: 280 hardirqs last enabled at (279): [<00000003e60a3d42>] __do_pgm_check+0x17a/0x1c0 hardirqs last disabled at (280): [<00000003e3bd774a>] kprobe_exceptions_notify+0x27a/0x318 softirqs last enabled at (0): [<00000003e3c5c890>] copy_process+0x14a8/0x4c80 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 46 PID: 662 Comm: kunit_try_catch Tainted: G N 6.2.0-173644-g44c18d77f0c0 #2 Hardware name: IBM 3931 A01 704 (LPAR) Call Trace: [<00000003e60a3a00>] dump_stack_lvl+0x120/0x198 [<00000003e3d02e82>] __might_resched+0x60a/0x668 [<00000003e60b9908>] __mutex_lock+0xc0/0x14e0 [<00000003e60bad5a>] mutex_lock_nested+0x32/0x40 [<00000003e3f7b460>] unregister_kprobe+0x30/0xd8 [<00000003e51b2602>] test_kprobe_missed+0xf2/0x268 [<00000003e51b5406>] kunit_try_run_case+0x10e/0x290 [<00000003e51b7dfa>] kunit_generic_run_threadfn_adapter+0x62/0xb8 [<00000003e3ce30f8>] kthread+0x2d0/0x398 [<00000003e3b96afa>] __ret_from_fork+0x8a/0xe8 [<00000003e60ccada>] ret_from_fork+0xa/0x40 The reason for this error report is that kprobes handling code failed to restore irqs. The problem is that when kprobe is triggered from another kprobe post_handler current sequence of enable_singlestep / disable_singlestep is the following: enable_singlestep <- original kprobe (saves kprobe_saved_imask) enable_singlestep <- kprobe triggered from post_handler (clobbers kprobe_saved_imask) disable_singlestep <- kprobe triggered from post_handler (restores kprobe_saved_imask) disable_singlestep <- original kprobe (restores wrong clobbered kprobe_saved_imask) There is just one kprobe_ctlblk per cpu and both calls saves and loads irq mask to kprobe_saved_imask. To fix the problem simply move resume_execution (which calls disable_singlestep) before calling post_handler. This also fixes the problem that post_handler is called with pt_regs which were not yet adjusted after single-stepping. Cc: stable@vger.kernel.org Fixes: 4ba069b802c2 ("[S390] add kprobes support.") Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit 02f18662f6c671382345fcb696e808d78f4c194a Author: Miquel Raynal Date: Wed Mar 1 16:44:50 2023 +0100 ieee802154: Prevent user from crashing the host Avoid crashing the machine by checking info->attrs[NL802154_ATTR_SCAN_TYPE] presence before de-referencing it, which was the primary intend of the blamed patch. Reported-by: Sanan Hasanov Suggested-by: Eric Dumazet Fixes: a0b6106672b5 ("ieee802154: Convert scan error messages to extack") Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230301154450.547716-1-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit 6c993779ea1d0cccdb3a5d7d45446dd229e610a3 Author: Alexander Aring Date: Thu Feb 16 23:25:04 2023 -0500 ca8210: fix mac_len negative array access This patch fixes a buffer overflow access of skb->data if ieee802154_hdr_peek_addrs() fails. Reported-by: lianhui tang Signed-off-by: Alexander Aring Link: https://lore.kernel.org/r/20230217042504.3303396-1-aahringo@redhat.com Signed-off-by: Stefan Schmidt commit 5c1ebbfabcd61142a4551bfc0e51840f9bdae7af Author: Brian Vazquez Date: Wed Mar 1 13:32:47 2023 +0000 net: use indirect calls helpers for sk_exit_memory_pressure() Florian reported a regression and sent a patch with the following changelog: There is a noticeable tcp performance regression (loopback or cross-netns), seen with iperf3 -Z (sendfile mode) when generic retpolines are needed. With SK_RECLAIM_THRESHOLD checks gone number of calls to enter/leave memory pressure happen much more often. For TCP indirect calls are used. We can't remove the if-set-return short-circuit check in tcp_enter_memory_pressure because there are callers other than sk_enter_memory_pressure. Doing a check in the sk wrapper too reduces the indirect calls enough to recover some performance. Before, 0.00-60.00 sec 322 GBytes 46.1 Gbits/sec receiver After: 0.00-60.04 sec 359 GBytes 51.4 Gbits/sec receiver "iperf3 -c $peer -t 60 -Z -f g", connected via veth in another netns. It seems we forgot to upstream this indirect call mitigation we had for years, lets do this instead. [edumazet] - It seems we forgot to upstream this indirect call mitigation we had for years, let's do this instead. - Changed to INDIRECT_CALL_INET_1() to avoid bots reports. Fixes: 4890b686f408 ("net: keep sk->sk_forward_alloc as small as possible") Reported-by: Florian Westphal Link: https://lore.kernel.org/netdev/20230227152741.4a53634b@kernel.org/T/ Signed-off-by: Brian Vazquez Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230301133247.2346111-1-edumazet@google.com Signed-off-by: Paolo Abeni commit 044c8bf78db818b8c726eb47c560e05fbc71e128 Merge: f3221361dc85d aabef97a35160 Author: Paolo Abeni Date: Thu Mar 2 11:10:43 2023 +0100 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix bogus error report in selftests/netfilter/nft_nat.sh, from Hangbin Liu. 2) Initialize last and quota expressions from template when expr_ops::clone is called, otherwise, states are not restored accordingly when loading a dynamic set with elements using these two expressions. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_quota: copy content when cloning expression netfilter: nft_last: copy content when cloning expression selftests: nft_nat: ensuring the listening side is up before starting the client ==================== Link: https://lore.kernel.org/r/20230301222021.154670-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 4bb54c2ce48ffb3a06133ac0fb4086f7b48d9109 Author: Thierry Reding Date: Tue Feb 14 15:05:49 2023 +0100 arm64: tegra: Bump CBB ranges property on Tegra194 and Tegra234 Both Xavier (Tegra194) and Orin (Tegra234) support a 40-bit address map, so bump the CBB ranges property to cover all of the 1 TiB address space. This fixes an issue where some of the PCIe regions could not be remapped because of they were outside the memory specified by the CBB's ranges property. Reported-by: Jonathan Hunter Signed-off-by: Thierry Reding commit cf3be7e82b129ed34f811f116f2b113f6299d449 Author: Uwe Kleine-König Date: Fri Feb 17 10:53:17 2023 +0100 watchdog: at91rm9200: Only warn once about problems in .remove() The single difference between returning 0 and returning an error code in a platform remove callback is that in the latter case the platform core emits a warning about the error being ignored. at91wdt_remove() already emits a warning in the error case, so suppress the more generic (and less helpful) one by returning 0. Signed-off-by: Uwe Kleine-König Reviewed-by: Claudiu Beznea Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230217095317.1213387-1-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ff8ec4ac39ad413b580d611dbf68e1d8a82eba56 Author: Sergio Paracuellos Date: Tue Feb 14 11:39:36 2023 +0100 watchdog: mt7621-wdt: avoid ralink architecture dependent code MT7621 SoC has a system controller node. Watchdog need to access to reset status register. Ralink architecture and related driver are old and from the beggining they are using some architecture dependent operations for accessing this shared registers through 'asm/mach-ralink/ralink_regs.h' header file. However this is not ideal from a driver perspective which can just access to the system controller registers in an arch independent way using regmap syscon APIs. Update Kconfig accordingly to select new added dependencies and allow driver to be compile tested. Signed-off-by: Sergio Paracuellos Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230214103936.1061078-6-sergio.paracuellos@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 783c7cb4659b53b5e1b809dac5e8cdf250145919 Author: Sergio Paracuellos Date: Tue Feb 14 11:39:35 2023 +0100 watchdog: mt7621-wdt: avoid static global declarations Instead of using static global definitions in driver code, refactor code introducing a new watchdog driver data structure and use it along the code. Reviewed-by: Guenter Roeck Signed-off-by: Sergio Paracuellos Link: https://lore.kernel.org/r/20230214103936.1061078-5-sergio.paracuellos@gmail.com [groeck: unsigned -> unsigned int] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ff75e4eb71cb1b64da07a5a7e8140e202b365887 Author: Sergio Paracuellos Date: Tue Feb 14 11:39:32 2023 +0100 dt-bindings: watchdog: mt7621-wdt: add phandle to access system controller registers MT7621 SoC provides a system controller node for accessing to some registers. Add a phandle in this node to avoid using MIPS related arch operations and includes in watchdog driver code. Acked-by: Krzysztof Kozlowski Signed-off-by: Sergio Paracuellos Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230214103936.1061078-2-sergio.paracuellos@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f3221361dc85d4de22586ce8441ec2c67b454f5d Author: Jakub Kicinski Date: Tue Feb 28 16:28:57 2023 -0800 net: tls: avoid hanging tasks on the tx_lock syzbot sent a hung task report and Eric explains that adversarial receiver may keep RWIN at 0 for a long time, so we are not guaranteed to make forward progress. Thread which took tx_lock and went to sleep may not release tx_lock for hours. Use interruptible sleep where possible and reschedule the work if it can't take the lock. Testing: existing selftest passes Reported-by: syzbot+9c0268252b8ef967c62e@syzkaller.appspotmail.com Fixes: 79ffe6087e91 ("net/tls: add a TX lock") Link: https://lore.kernel.org/all/000000000000e412e905f5b46201@google.com/ Cc: stable@vger.kernel.org # wait 4 weeks Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230301002857.2101894-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962 Author: Hangyu Hua Date: Tue Feb 28 10:33:44 2023 +0800 net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() ctx->crypto_send.info is not protected by lock_sock in do_tls_getsockopt_conf(). A race condition between do_tls_getsockopt_conf() and error paths of do_tls_setsockopt_conf() may lead to a use-after-free or null-deref. More discussion: https://lore.kernel.org/all/Y/ht6gQL+u6fj3dG@hog/ Fixes: 3c4d7559159b ("tls: kernel TLS support") Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20230228023344.9623-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski commit 6bb811d0ee3e1fe9f22a028c89b3472c999b70bc Author: bobzhou Date: Mon Feb 27 15:30:54 2023 +0800 drm/amdgpu/vcn: fix compilation issue with legacy gcc This patch is used to fix following compilation issue with legacy gcc error: ‘for’ loop initial declarations are only allowed in C99 mode for (int i = 0; i < adev->vcn.num_vcn_inst; ++i) { Signed-off-by: bobzhou Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit a8af68f79d149796609a679b00a34762249c6a5b Author: Sung Joon Kim Date: Fri Feb 10 14:39:49 2023 -0500 drm/amd/display: Extend Freesync over PCon support for more devices [why] More branch devices are able to support Freesync over PCon so include them in the list of supporting devices. [how] Add more compatible PCon devices in the whitelist for Freesync over Pcon. Reviewed-by: Harry Wentland Acked-by: Qingqing Zhuo Signed-off-by: Sung Joon Kim Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1fa0d424a1d50aebbd87d40a0cb41995ba336f27 Author: Aric Cyr Date: Thu Feb 9 20:03:33 2023 -0500 Revert "drm/amd/display: Do not set DRR on pipe commit" This reverts commit 4f1b5e739dfd1edde33329e3f376733a131fb1ff. [Why & How] Original change causes a regression. Revert until fix is available. Reviewed-by: Aric Cyr Acked-by: Qingqing Zhuo Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 031f196d1b1b6d5dfcb0533b431e3ab1750e6189 Author: Alex Hung Date: Wed Jan 11 09:54:11 2023 -0700 drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes [WHY] When PTEBufferSizeInRequests is zero, UBSAN reports the following warning because dml_log2 returns an unexpected negative value: shift exponent 4294966273 is too large for 32-bit type 'int' [HOW] In the case PTEBufferSizeInRequests is zero, skip the dml_log2() and assign the result directly. Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 01a18aa309aec12461fb5e6aecb76f8b33810658 Author: Ryan Lin Date: Tue Feb 7 23:03:48 2023 +0800 drm/amd/display: Ext displays with dock can't recognized after resume [Why] Needs to set the default value of the LTTPR timeout after resume. [How] Set the default (3.2ms) timeout at resuming if the sink supports LTTPR Reviewed-by: Jerry Zuo Acked-by: Qingqing Zhuo Signed-off-by: Ryan Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 23f4a2d29ba57bf88095f817de5809d427fcbe7e Author: Horatio Zhang Date: Fri Feb 24 13:55:44 2023 +0800 drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini The call trace occurs when the amdgpu is removed after the mode1 reset. During mode1 reset, from suspend to resume, there is no need to reinitialize the ta firmware buffer which caused the bo pin_count increase redundantly. [ 489.885525] Call Trace: [ 489.885525] [ 489.885526] amdttm_bo_put+0x34/0x50 [amdttm] [ 489.885529] amdgpu_bo_free_kernel+0xe8/0x130 [amdgpu] [ 489.885620] psp_free_shared_bufs+0xb7/0x150 [amdgpu] [ 489.885720] psp_hw_fini+0xce/0x170 [amdgpu] [ 489.885815] amdgpu_device_fini_hw+0x2ff/0x413 [amdgpu] [ 489.885960] ? blocking_notifier_chain_unregister+0x56/0xb0 [ 489.885962] amdgpu_driver_unload_kms+0x51/0x60 [amdgpu] [ 489.886049] amdgpu_pci_remove+0x5a/0x140 [amdgpu] [ 489.886132] ? __pm_runtime_resume+0x60/0x90 [ 489.886134] pci_device_remove+0x3e/0xb0 [ 489.886135] __device_release_driver+0x1ab/0x2a0 [ 489.886137] driver_detach+0xf3/0x140 [ 489.886138] bus_remove_driver+0x6c/0xf0 [ 489.886140] driver_unregister+0x31/0x60 [ 489.886141] pci_unregister_driver+0x40/0x90 [ 489.886142] amdgpu_exit+0x15/0x451 [amdgpu] Signed-off-by: Horatio Zhang Signed-off-by: longlyao Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit cca3306488f71465f8c5e920e5a4e24fa461c72b Author: Tom Rix Date: Fri Feb 24 11:45:19 2023 -0500 drm/amdgpu: remove unused variable ring building with gcc and W=1 reports drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c:81:29: error: variable ‘ring’ set but not used [-Werror=unused-but-set-variable] 81 | struct amdgpu_ring *ring; | ^~~~ ring is not used so remove it. Signed-off-by: Tom Rix Signed-off-by: Alex Deucher commit ca87c9ae70566c651dcf09c1b080db259e20f9ee Author: tiancyin Date: Wed Feb 8 14:10:04 2023 +0800 drm/amd/display: fix dm irq error message in gpu recover [Why] Variable adev->crtc_irq.num_types was initialized as the value of adev->mode_info.num_crtc at early_init stage, later at hw_init stage, the num_crtc changed due to the display pipe harvest on some SKUs, but the num_types was not updated accordingly, that cause below error in gpu recover. *ERROR* amdgpu_dm_set_crtc_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_crtc_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_crtc_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_pflip_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_pflip_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_pflip_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_pflip_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_vupdate_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_vupdate_irq_state: crtc is NULL at id :3 *ERROR* amdgpu_dm_set_vupdate_irq_state: crtc is NULL at id :3 [How] Defer the initialization of num_types to eliminate the error logs. Signed-off-by: tiancyin Reviewed-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 65a24000808f70ac69bd2a96381fa0c7341f20c0 Author: Mario Limonciello Date: Sun Feb 19 23:04:04 2023 -0600 drm/amd: Fix initialization for nbio 7.5.1 A mistake has been made in the BIOS for some ASICs with NBIO 7.5.1 where some NBIO registers aren't properly setup. Ensure that they're set during initialization. Tested-by: Richard Gong Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit c76e483cd9163138e8fc44d829c986819f072d4f Author: Harry Wentland Date: Mon Dec 12 13:02:25 2022 -0500 drm/amd/display: Don't restrict bpc to 8 bpc This will let us pass the kms_hdr.bpc_switch IGT test. The reason the bpc restriction was required is historical. At one point in time we were not falling back to a lower bpc when we didn't have enough bandwidth for the maximum bpc reported by a display. This meant that we couldn't enable some high refresh modes unless we limitted the bpc. Starting with this patch the issue is fixed: commit cbd14ae7ea93 ("drm/amd/display: Fix incorrectly pruned modes with deep color") This patch implemented a fallback mechanism if mode validation failed at the max bpc. This means users now automatically get all modes that can be supported by at least 6 bpc. The driver will enable the mode with the highest possible bpc that is supported by the display. v2: - explain why this is no longer needed (Michel) - refer to commit that fixed bpc fallback (Michel) Signed-off-by: Harry Wentland Cc: Pekka Paalanen Cc: Sebastian Wick Cc: Vitaly.Prosyak@amd.com Cc: Joshua Ashton Cc: dri-devel@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Cc: Michel Dänzer Reviewed-by: Joshua Ashton Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher commit 1bf56f25258871db5bfad7aebe19e46148eda159 Author: Candice Li Date: Fri Feb 24 12:15:57 2023 +0800 drm/amdgpu: Make umc_v8_10_convert_error_address static and remove unused variable Fixes following warnings: warning: no previous prototype for 'umc_v8_10_convert_error_address' warning: variable 'channel_index' set but not used Reported-by: kernel test robot Signed-off-by: Candice Li Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 05eacc198c68cbb35a7281ce4011f8899ee1cfb8 Author: Mark Hawrylak Date: Sun Feb 19 16:02:00 2023 +1100 drm/radeon: Fix eDP for single-display iMac11,2 Apple iMac11,2 (mid 2010) also with Radeon HD-4670 that has the same issue as iMac10,1 (late 2009) where the internal eDP panel stays dark on driver load. This patch treats iMac11,2 the same as iMac10,1, so the eDP panel stays active. Additional steps: Kernel boot parameter radeon.nomodeset=0 required to keep the eDP panel active. This patch is an extension of commit 564d8a2cf3ab ("drm/radeon: Fix eDP for single-display iMac10,1 (v2)") Link: https://lore.kernel.org/all/lsq.1507553064.833262317@decadent.org.uk/ Signed-off-by: Mark Hawrylak Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 61fc1ee8be26bc192d691932b0a67eabee45d12f Author: Alexandre Ghiti Date: Tue Mar 16 15:34:20 2021 -0400 riscv: Bump COMMAND_LINE_SIZE value to 1024 Increase COMMAND_LINE_SIZE as the current default value is too low for syzbot kernel command line. There has been considerable discussion on this patch that has led to a larger patch set removing COMMAND_LINE_SIZE from the uapi headers on all ports. That's not quite done yet, but it's gotten far enough we're confident this is not a uABI change so this is safe. Reported-by: Dmitry Vyukov Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20210316193420.904-1-alex@ghiti.fr [Palmer: it's not uabi] Link: https://lore.kernel.org/linux-riscv/874b8076-b0d1-4aaa-bcd8-05d523060152@app.fastmail.com/#t Signed-off-by: Palmer Dabbelt commit 71562809e401b2f5ad371d99ce0323e988406fd6 Author: David Howells Date: Tue Feb 28 22:38:38 2023 +0000 cifs: Fix memory leak in direct I/O When __cifs_readv() and __cifs_writev() extract pages from a user-backed iterator into a BVEC-type iterator, they set ->bv_need_unpin to note whether they need to unpin the pages later. However, in both cases they examine the BVEC-type iterator and not the source iterator - and so bv_need_unpin doesn't get set and the pages are leaked. I think this may be responsible for the generic/208 xfstest failing occasionally with: WARNING: CPU: 0 PID: 3064 at mm/gup.c:218 try_grab_page+0x65/0x100 RIP: 0010:try_grab_page+0x65/0x100 follow_page_pte+0x1a7/0x570 __get_user_pages+0x1a2/0x650 __gup_longterm_locked+0xdc/0xb50 internal_get_user_pages_fast+0x17f/0x310 pin_user_pages_fast+0x46/0x60 iov_iter_extract_pages+0xc9/0x510 ? __kmalloc_large_node+0xb1/0x120 ? __kmalloc_node+0xbe/0x130 netfs_extract_user_iter+0xbf/0x200 [netfs] __cifs_writev+0x150/0x330 [cifs] vfs_write+0x2a8/0x3c0 ksys_pwrite64+0x65/0xa0 with the page refcount going negative. This is less unlikely than it seems because the page is being pinned, not simply got, and so the refcount increased by 1024 each time, and so only needs to be called around ~2097152 for the refcount to go negative. Further, the test program (aio-dio-invalidate-failure) uses a 32MiB static buffer and all the PTEs covering it refer to the same page because it's never written to. The warning in try_grab_page(): if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) return -ENOMEM; then trips and prevents us ever using the page again for DIO at least. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Reported-by: Murphy Zhou Link: https://lore.kernel.org/r/CAH2r5mvaTsJ---n=265a4zqRA7pP+o4MJ36WCQUS6oPrOij8cw@mail.gmail.com Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (SUSE) cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 1bcd548d935a33c6fc58331405eb1b82fd6150de Author: Paulo Alcantara Date: Tue Feb 28 19:01:55 2023 -0300 cifs: prevent data race in cifs_reconnect_tcon() Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior to waiting the server to be reconnected in cifs_reconnect_tcon(). It is set in cifs_tcp_ses_needs_reconnect() and protected by TCP_Server_Info::srv_lock. Create a new cifs_wait_for_server_reconnect() helper that can be used by both SMB2+ and CIFS reconnect code. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit b9ee2e307c6b06384b6f9e393a9b8e048e8fc277 Author: Paulo Alcantara Date: Tue Feb 28 19:01:54 2023 -0300 cifs: improve checking of DFS links over STATUS_OBJECT_NAME_INVALID Do not map STATUS_OBJECT_NAME_INVALID to -EREMOTE under non-DFS shares, or 'nodfs' mounts or CONFIG_CIFS_DFS_UPCALL=n builds. Otherwise, in the slow path, get a referral to figure out whether it is an actual DFS link. This could be simply reproduced under a non-DFS share by running the following $ mount.cifs //srv/share /mnt -o ... $ cat /mnt/$(printf '\U110000') cat: '/mnt/'$'\364\220\200\200': Object is remote Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests") CC: stable@vger.kernel.org # 6.2 Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit 4c0421fa6df136ff869a078594b4b7b7637e566a Author: David Howells Date: Mon Feb 27 13:04:54 2023 +0000 iov: Fix netfs_extract_user_to_sg() Fix the loop check in netfs_extract_user_to_sg() for extraction from user-backed iterators to do the body if npages > 0, not if npages < 0 (which it can never be). This isn't currently used by cifs, which only ever extracts data from BVEC, KVEC and XARRAY iterators at this level, user-backed iterators having being decanted into BVEC iterators at a higher level to accommodate the work being done in a kernel thread. Found by smatch: fs/netfs/iterator.c:139 netfs_extract_user_to_sg() warn: unsigned 'npages' is never less than zero. Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302261115.P3TQi1ZO-lkp@intel.com/ Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/Y/yYnAhoAYDBKixX@kili Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: David Howells cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-cachefs@redhat.com Signed-off-by: Steve French commit 0268792f77d2e4ba8e056173bdf2f9af9963be76 Author: David Howells Date: Mon Feb 27 13:04:53 2023 +0000 cifs: Fix cifs_write_back_from_locked_folio() cifs_write_back_from_locked_folio() should return the number of bytes read, but returns the result of ->async_writev(), which will be 0 on success. As it happens, this doesn't prevent cifs_writepages_region() from working as it will then examine and ignore the pages that are no longer dirty rather than just skipping over them. Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Signed-off-by: David Howells cc: Shyam Prasad N cc: Rohith Surabattula cc: Tom Talpey cc: Jeff Layton cc: linux-cifs@vger.kernel.org Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 410612b0726b2ee68808da7bd27103d96b4cf898 Author: Shyam Prasad N Date: Tue Dec 27 14:09:32 2022 +0000 cifs: reuse cifs_match_ipaddr for comparison of dstaddr too We have two pieces of code that does pretty much the same comparison. This change reuses cifs_match_ipaddr within match_address. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit a21be1f5df85831147d5a1cbb5f2a13ec8c6852b Author: Shyam Prasad N Date: Tue Dec 27 14:04:29 2022 +0000 cifs: match even the scope id for ipv6 addresses match_address function matches the scope id for ipv6 addresses, but cifs_match_ipaddr (which is another function used for comparison) does not use scope id. Doing so with this change. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 4bd3e4c7e4e552aa148edd3f2a2326ccc3011122 Author: David Howells Date: Thu Feb 23 08:15:39 2023 +0000 cifs: Fix an uninitialised variable Fix an uninitialised variable introduced in cifs. Fixes: 3d78fe73fa12 ("cifs: Build the RDMA SGE list directly from an iterator") Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (SUSE) cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Tom Talpey cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-rdma@vger.kernel.org Signed-off-by: Steve French commit 1907e0fec10c2498729d27550c460528e49abe1e Author: David Howells Date: Thu Feb 23 08:15:38 2023 +0000 cifs: Add some missing xas_retry() calls The xas_for_each loops added into fs/cifs/file.c need to go round again if indicated by xas_retry(). Fixes: b8713c4dbfa3 ("cifs: Add some helper functions") Signed-off-by: David Howells Reviewed-by: Paulo Alcantara (SUSE) cc: Shyam Prasad N cc: Rohith Surabattula cc: Tom Talpey cc: Jeff Layton cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 9f828bc3fb900c5d39ec13ea150341d28fb1f158 Author: Mayuresh Chitale Date: Wed Feb 8 13:13:14 2023 +0530 drivers/perf: RISC-V: Allow programming custom firmware events Applications need to be able to program the SBI implementation specific or custom firmware events in addition to the standard firmware events. Remove a check in the driver that prohibits the programming of the custom firmware events. Signed-off-by: Mayuresh Chitale Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230208074314.3661406-1-mchitale@ventanamicro.com Signed-off-by: Palmer Dabbelt commit ee3f96b164688dae21e2466a57f2e806b64e8a37 Merge: 92304df83b943 fb5b855d9f349 Author: Linus Torvalds Date: Wed Mar 1 11:03:44 2023 -0800 Merge tag 'nfsd-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Make new GSS Kerberos Kunit tests work on non-x86 platforms * tag 'nfsd-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: SUNRPC: Properly terminate test case arrays SUNRPC: Let Kunit tests run with some enctypes compiled out commit 6ca6b58107a8891e4b08087843188fdc5737ec08 Author: Heiko Carstens Date: Wed Mar 1 09:41:06 2023 +0100 s390/Kconfig: sort config S390 select list again Keep the config S390 select list sorted. Signed-off-by: Heiko Carstens commit 8c42dd78df148c90e48efff204cce38743906a79 Author: Gerald Schaefer Date: Mon Feb 27 20:03:00 2023 +0100 s390/extmem: return correct segment type in __segment_load() Commit f05f62d04271f ("s390/vmem: get rid of memory segment list") reshuffled the call to vmem_add_mapping() in __segment_load(), which now overwrites rc after it was set to contain the segment type code. As result, __segment_load() will now always return 0 on success, which corresponds to the segment type code SEG_TYPE_SW, i.e. a writeable segment. This results in a kernel crash when loading a read-only segment as dcssblk block device, and trying to write to it. Instead of reshuffling code again, make sure to return the segment type on success, and also describe this rather delicate and unexpected logic in the function comment. Also initialize new segtype variable with invalid value, to prevent possible future confusion. Fixes: f05f62d04271 ("s390/vmem: get rid of memory segment list") Cc: # 5.9+ Signed-off-by: Gerald Schaefer Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit 92304df83b943776492309f42452effea0cc1089 Author: Arnd Bergmann Date: Tue Feb 14 14:20:42 2023 +0100 power: supply: qcom_battmgr: remove bogus do_div() The argument to do_div() is a 32-bit integer, and it was read from a 32-bit register so there is no point in doing a 64-bit division on it. On 32-bit arm, do_div() causes a compile-time warning here: include/asm-generic/div64.h:238:22: error: passing argument 1 of '__div64_32' from incompatible pointer type [-Werror=incompatible-pointer-types] 238 | __rem = __div64_32(&(n), __base); \ | ^~~~ | | | unsigned int * drivers/power/supply/qcom_battmgr.c:1130:4: note: in expansion of macro 'do_div' 1130 | do_div(battmgr->status.percent, 100); Signed-off-by: Arnd Bergmann Reviewed-by: Geert Uytterhoeven Acked-by: Sebastian Reichel Reviewed-by: Konrad Dybcio Signed-off-by: Linus Torvalds commit f43523620f646c89ffd8ada840a0068290e51266 Author: Dan Carpenter Date: Mon Feb 27 13:07:09 2023 +0300 cpufreq: apple-soc: Fix an IS_ERR() vs NULL check The of_iomap() function returns NULL if it fails. It never returns error pointers. Fix the check accordingly. Fixes: 6286bbb40576 ("cpufreq: apple-soc: Add new driver to control Apple SoC CPU P-states") Signed-off-by: Dan Carpenter Reviewed-by: Eric Curtin Signed-off-by: Rafael J. Wysocki commit 1467fb960349dfa5e300658f1a409dde2cfb0c51 Author: Randy Dunlap Date: Sat Feb 25 21:39:52 2023 -0800 thermal: intel: BXT_PMIC: select REGMAP instead of depending on it REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it. Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues. Therefore, change the use of "depends on REGMAP" to "select REGMAP". Fixes: b474303ffd57 ("thermal: add Intel BXT WhiskeyCove PMIC thermal driver") Signed-off-by: Randy Dunlap Signed-off-by: Rafael J. Wysocki commit f1b930e740811d416de4d2074da48b6633a672c8 Author: Dan Carpenter Date: Mon Feb 27 13:06:50 2023 +0300 thermal: intel: quark_dts: fix error pointer dereference If alloc_soc_dts() fails, then we can just return. Trying to free "soc_dts" will lead to an Oops. Fixes: 8c1876939663 ("thermal: intel Quark SoC X1000 DTS thermal driver") Signed-off-by: Dan Carpenter Signed-off-by: Rafael J. Wysocki commit fcd9531b305288dc2848d38567d466af4ee147b2 Author: Boris Burkov Date: Wed Feb 15 12:59:49 2023 -0800 btrfs: sysfs: add size class stats Make it possible to see the distribution of size classes for block groups. Helpful for testing and debugging the allocator w.r.t. to size classes. The new stats can be found at the path: /sys/fs/btrfs//allocation//size_class but they will only be non-zero for bg-type = data. Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit e2a56364485e7789e7b8f342637c7f3a219f7ede Author: Mario Limonciello Date: Tue Feb 28 16:11:28 2023 -0600 ACPI: x86: utils: Add Cezanne to the list for forcing StorageD3Enable commit 018d6711c26e4 ("ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable") introduced a quirk to allow a system with ambiguous use of _ADR 0 to force StorageD3Enable. It was reported that several more Dell systems suffered the same symptoms. As the list is continuing to grow but these are all Cezanne systems, instead add Cezanne to the CPU list to apply the StorageD3Enable property and remove the whole list. It was also reported that an HP system only has StorageD3Enable on the ACPI device for the first NVME disk, not the second. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217003 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216773 Reported-by: David Alvarez Lombardi Reported-by: dbilios@stdio.gr Reported-and-tested-by: Elvis Angelaccio Tested-by: victor.bonnelle@proton.me Tested-by: hurricanepootis@protonmail.com Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit f122a08b197d076ccf136c73fae0146875812a88 Author: Linus Torvalds Date: Tue Feb 28 11:39:09 2023 -0800 capability: just use a 'u64' instead of a 'u32[2]' array Back in 2008 we extended the capability bits from 32 to 64, and we did it by extending the single 32-bit capability word from one word to an array of two words. It was then obfuscated by hiding the "2" behind two macro expansions, with the reasoning being that maybe it gets extended further some day. That reasoning may have been valid at the time, but the last thing we want to do is to extend the capability set any more. And the array of values not only causes source code oddities (with loops to deal with it), but also results in worse code generation. It's a lose-lose situation. So just change the 'u32[2]' into a 'u64' and be done with it. We still have to deal with the fact that the user space interface is designed around an array of these 32-bit values, but that was the case before too, since the array layouts were different (ie user space doesn't use an array of 32-bit values for individual capability masks, but an array of 32-bit slices of multiple masks). So that marshalling of data is actually simplified too, even if it does remain somewhat obscure and odd. This was all triggered by my reaction to the new "cap_isidentical()" introduced recently. By just using a saner data structure, it went from unsigned __capi; CAP_FOR_EACH_U32(__capi) { if (a.cap[__capi] != b.cap[__capi]) return false; } return true; to just being return a.val == b.val; instead. Which is rather more obvious both to humans and to compilers. Cc: Mateusz Guzik Cc: Casey Schaufler Cc: Serge Hallyn Cc: Al Viro Cc: Paul Moore Signed-off-by: Linus Torvalds commit 1d2aea1bcf68992c90218f47405bee29efd722cd Merge: a8356cdb5bd5a ff30bd6a6618e Author: Linus Torvalds Date: Wed Mar 1 09:44:22 2023 -0800 Merge tag 'sh-for-v6.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh updates from John Paul Adrian Glaubitz: - regression fix in connection with the rtl8169 driver on SuperH boards that was introduced when the driver was switched to use devm_clk_get_optional_enabled() to simplify the code (Geert Uytterhoeven) - build warning fix to allow the kernel to be built with CONFIG_WERROR enabled (Michael Karcher) * tag 'sh-for-v6.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: clk: Fix clk_enable() to return 0 on NULL clk sh: intc: Avoid spurious sizeof-pointer-div warning commit a8356cdb5bd5abc74f814d76bd37900997fad35d Merge: 64e851689e441 8883bf83127d5 Author: Linus Torvalds Date: Wed Mar 1 09:27:00 2023 -0800 Merge tag 'loongarch-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Make -mstrict-align configurable - Add kernel relocation and KASLR support - Add single kernel image implementation for kdump - Add hardware breakpoints/watchpoints support - Add kprobes/kretprobes/kprobes_on_ftrace support - Add LoongArch support for some selftests. * tag 'loongarch-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (23 commits) selftests/ftrace: Add LoongArch kprobe args string tests support selftests/seccomp: Add LoongArch selftesting support tools: Add LoongArch build infrastructure samples/kprobes: Add LoongArch support LoongArch: Mark some assembler symbols as non-kprobe-able LoongArch: Add kprobes on ftrace support LoongArch: Add kretprobes support LoongArch: Add kprobes support LoongArch: Simulate branch and PC* instructions LoongArch: ptrace: Add hardware single step support LoongArch: ptrace: Add function argument access API LoongArch: ptrace: Expose hardware breakpoints to debuggers LoongArch: Add hardware breakpoints/watchpoints support LoongArch: kdump: Add crashkernel=YM handling LoongArch: kdump: Add single kernel image implementation LoongArch: Add support for kernel address space layout randomization (KASLR) LoongArch: Add support for kernel relocation LoongArch: Add la_abs macro implementation LoongArch: Add JUMP_VIRT_ADDR macro implementation to avoid using la.abs LoongArch: Use la.pcrel instead of la.abs when it's trivially possible ... commit 64e851689e441e66e001ae063d4536602f9f74cb Merge: e31b283a58dfe 04df97e150c83 Author: Linus Torvalds Date: Wed Mar 1 09:13:00 2023 -0800 Merge tag 'uml-for-linus-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML updates from Richard Weinberger: - Add support for rust (yay!) - Add support for LTO - Add platform bus support to virtio-pci - Various virtio fixes - Coding style, spelling cleanups * tag 'uml-for-linus-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (27 commits) Documentation: rust: Fix arch support table uml: vector: Remove unused definitions VECTOR_{WRITE,HEADERS} um: virt-pci: properly remove PCI device from bus um: virtio_uml: move device breaking into workqueue um: virtio_uml: mark device as unregistered when breaking it um: virtio_uml: free command if adding to virtqueue failed UML: define RUNTIME_DISCARD_EXIT virt-pci: add platform bus support um-virt-pci: Make max delay configurable um: virt-pci: implement pcibios_get_phb_of_node() um: Support LTO um: put power options in a menu um: Use CFLAGS_vmlinux um: Prevent building modules incompatible with MODVERSIONS um: Avoid pcap multiple definition errors um: Make the definition of cpu_data more compatible x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list rust: arch/um: Add support for CONFIG_RUST under x86_64 UML rust: arch/um: Disable FP/SIMD instruction to match x86 rust: arch/um: Use 'pie' relocation mode under UML ... commit 1947ddf9b3d5b886ba227bbfd3d6f501af08b5b0 Author: Jens Axboe Date: Mon Feb 27 09:41:20 2023 -0700 io_uring/poll: don't pass in wake func to io_init_poll_iocb() We only use one, and it's io_poll_wake(). Hardwire that in the initial init, as well as in __io_queue_proc() if we're setting up for double poll. Signed-off-by: Jens Axboe commit e31b283a58dfe50ab1641d8fd2ead9b62f9ab256 Merge: 3808330b20ee0 8fcf2d012c864 Author: Linus Torvalds Date: Wed Mar 1 09:06:51 2023 -0800 Merge tag 'ubifs-for-linus-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull jffs2, ubi and ubifs updates from Richard Weinberger: "JFFS2: - Fix memory corruption in error path - Spelling and coding style fixes UBI: - Switch to BLK_MQ_F_BLOCKING in ubiblock - Wire up partent device (for sysfs) - Multiple UAF bugfixes - Fix for an infinite loop in WL error path UBIFS: - Fix for multiple memory leaks in error paths - Fixes for wrong space accounting - Minor cleanups - Spelling and coding style fixes" * tag 'ubifs-for-linus-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: (36 commits) ubi: block: Fix a possible use-after-free bug in ubiblock_create() ubifs: make kobj_type structures constant mtd: ubi: block: wire-up device parent mtd: ubi: wire-up parent MTD device ubi: use correct names in function kernel-doc comments ubi: block: set BLK_MQ_F_BLOCKING jffs2: Fix list_del corruption if compressors initialized failed jffs2: Use function instead of macro when initialize compressors jffs2: fix spelling mistake "neccecary"->"necessary" ubifs: Fix kernel-doc ubifs: Fix some kernel-doc comments UBI: Fastmap: Fix kernel-doc ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process ubifs: ubifs_writepage: Mark page dirty after writing inode failed ubifs: dirty_cow_znode: Fix memleak in error handling path ubifs: Re-statistic cleaned znode count if commit failed ubi: Fix permission display of the debugfs files ... commit 3808330b20ee0b23e1e3c192610c3a2ee65605e9 Merge: 6e110580bc1ab 89c58cb395ec0 Author: Linus Torvalds Date: Wed Mar 1 08:52:49 2023 -0800 Merge tag '9p-6.3-for-linus-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs Pull 9p updates from Eric Van Hensbergen: - some fixes and cleanup setting up for a larger set of performance patches I've been working on - a contributed fixes relating to 9p/rdma - some contributed fixes relating to 9p/xen * tag '9p-6.3-for-linus-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: fs/9p: fix error reporting in v9fs_dir_release net/9p: fix bug in client create for .L 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() 9p/xen: fix connection sequence 9p/xen: fix version parsing fs/9p: Expand setup of writeback cache to all levels net/9p: Adjust maximum MSIZE to account for p9 header commit 6e110580bc1ab84d02509750ce09277914174c6a Merge: e103ecedceb37 fad376fce0af5 Author: Linus Torvalds Date: Wed Mar 1 08:47:19 2023 -0800 Merge tag 'jfs-6.3' of https://github.com/kleikamp/linux-shaggy Pull jfs update from Dave Kleikamp: "Just one simple sanity check" * tag 'jfs-6.3' of https://github.com/kleikamp/linux-shaggy: fs/jfs: fix shift exponent db_agl2size negative commit e103ecedceb37b565962a199c75dd4df57742d50 Merge: c0927a7a5391f d5c514b6a0c0b Author: Linus Torvalds Date: Wed Mar 1 08:42:27 2023 -0800 Merge tag 'exfat-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Handle vendor extension and allocation entries as unrecognized benign secondary entries - Fix wrong ->i_blocks on devices with non-512 byte sector - Add the check to avoid returning -EIO from exfat_readdir() at current position exceeding the directory size - Fix a bug that reach the end of the directory stream at a position not aligned with the dentry size - Redefine DIR_DELETED as 0xFFFFFFF7, the bad cluster number - Two cleanup fixes and fix cluster leakage in error handling * tag 'exfat-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: fix the newly allocated clusters are not freed in error handling exfat: don't print error log in normal case exfat: remove unneeded code from exfat_alloc_cluster() exfat: handle unreconized benign secondary entries exfat: fix inode->i_blocks for non-512 byte sector size device exfat: redefine DIR_DELETED as the bad cluster number exfat: fix reporting fs error when reading dir beyond EOF exfat: fix unexpected EOF while reading dir commit aabef97a35160461e9c576848ded737558d89055 Author: Pablo Neira Ayuso Date: Tue Feb 28 20:43:02 2023 +0100 netfilter: nft_quota: copy content when cloning expression If the ruleset contains consumed quota, restore them accordingly. Otherwise, listing after restoration shows never used items. Restore the user-defined quota and flags too. Fixes: ed0a0c60f0e5 ("netfilter: nft_quota: move stateful fields out of expression data") Signed-off-by: Pablo Neira Ayuso commit 860e874290fb3be08e966c9c8ffc510c5b0f2bd8 Author: Pablo Neira Ayuso Date: Tue Feb 28 17:09:03 2023 +0100 netfilter: nft_last: copy content when cloning expression If the ruleset contains last timestamps, restore them accordingly. Otherwise, listing after restoration shows never used items. Fixes: 33a24de37e81 ("netfilter: nft_last: move stateful fields out of expression data") Signed-off-by: Pablo Neira Ayuso commit 2067e7a00aa604b94de31d64f29b8893b1696f26 Author: Hangbin Liu Date: Mon Feb 27 17:36:46 2023 +0800 selftests: nft_nat: ensuring the listening side is up before starting the client The test_local_dnat_portonly() function initiates the client-side as soon as it sets the listening side to the background. This could lead to a race condition where the server may not be ready to listen. To ensure that the server-side is up and running before initiating the client-side, a delay is introduced to the test_local_dnat_portonly() function. Before the fix: # ./nft_nat.sh PASS: netns routing/connectivity: ns0-rthlYrBU can reach ns1-rthlYrBU and ns2-rthlYrBU PASS: ping to ns1-rthlYrBU was ip NATted to ns2-rthlYrBU PASS: ping to ns1-rthlYrBU OK after ip nat output chain flush PASS: ipv6 ping to ns1-rthlYrBU was ip6 NATted to ns2-rthlYrBU 2023/02/27 04:11:03 socat[6055] E connect(5, AF=2 10.0.1.99:2000, 16): Connection refused ERROR: inet port rewrite After the fix: # ./nft_nat.sh PASS: netns routing/connectivity: ns0-9sPJV6JJ can reach ns1-9sPJV6JJ and ns2-9sPJV6JJ PASS: ping to ns1-9sPJV6JJ was ip NATted to ns2-9sPJV6JJ PASS: ping to ns1-9sPJV6JJ OK after ip nat output chain flush PASS: ipv6 ping to ns1-9sPJV6JJ was ip6 NATted to ns2-9sPJV6JJ PASS: inet port rewrite without l3 address Fixes: 282e5f8fe907 ("netfilter: nat: really support inet nat without l3 address") Signed-off-by: Hangbin Liu Signed-off-by: Pablo Neira Ayuso commit 326ac2c5133e5da7ccdd08d4f9c562f2323021aa Merge: e33b93650fc53 26a57cb35548a Author: Jens Axboe Date: Wed Mar 1 07:49:59 2023 -0700 Merge tag 'nvme-6.3-2022-03-01' of git://git.infradead.org/nvme into for-6.3/block Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.3 - don't access released socket during error recovery (Akinobu Mita) - bring back auto-removal of deleted namespaces during sequential scan (Christoph Hellwig) - fix an error code in nvme_auth_process_dhchap_challenge (Dan Carpenter) - show well known discovery name (Daniel Wagner) - add a missing endianess conversion in effects masking (Keith Busch)" * tag 'nvme-6.3-2022-03-01' of git://git.infradead.org/nvme: nvme-fabrics: show well known discovery name nvme-tcp: don't access released socket during error recovery nvme-auth: fix an error code in nvme_auth_process_dhchap_challenge() nvme: bring back auto-removal of deleted namespaces during sequential scan nvme: fix sparse warning on effects masking commit b56ec2992a2e43bc3e60d6db86849d31640e791f Author: Trevor Wu Date: Wed Mar 1 19:02:00 2023 +0800 ASoC: mediatek: mt8195: add missing initialization In etdm dai driver, dai_etdm_parse_of() function is used to parse dts properties to get parameters. There are two for-loops which are sepearately for all etdm and etdm input only cases. In etdm in only loop, dai_id is not initialized, so it keeps the value intiliazed in another loop. In the patch, add the missing initialization to fix the unexpected parsing problem. Fixes: 1de9a54acafb ("ASoC: mediatek: mt8195: support etdm in platform driver") Signed-off-by: Trevor Wu Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230301110200.26177-3-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 23badca4248a9a467f630adbd1557f664585e1db Author: Trevor Wu Date: Wed Mar 1 19:01:59 2023 +0800 ASoC: mediatek: mt8188: add missing initialization In etdm dai driver, dai_etdm_parse_of() function is used to parse dts properties to get parameters. There are two for-loops which are sepearately for all etdm and etdm input only cases. In etdm in only loop, dai_id is not initialized, so it keeps the value intiliazed in another loop. In the patch, add the missing initialization to fix the unexpected parsing problem. Fixes: 2babb4777489 ("ASoC: mediatek: mt8188: support etdm in platform driver") Signed-off-by: Trevor Wu Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230301110200.26177-2-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 81563d8548b0478075c720666be348d4199b8591 Author: Horatiu Vultur Date: Tue Feb 28 21:47:42 2023 +0100 net: lan966x: Fix port police support using tc-matchall When the police was removed from the port, then it was trying to remove the police from the police id and not from the actual police index. The police id represents the id of the police and police index represents the position in HW where the police is situated. The port police id can be any number while the port police index is a number based on the port chip port. Fix this by deleting the police from HW that is situated at the police index and not police id. Fixes: 5390334b59a3 ("net: lan966x: Add port police support using tc-matchall") Signed-off-by: Horatiu Vultur Reviewed-by: Simon Horman Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit dd093fb08e8f8a958fec4eef36f9f09eac047f60 Author: Tom Lendacky Date: Wed Feb 22 10:39:39 2023 -0600 virt/sev-guest: Return -EIO if certificate buffer is not large enough Commit 47894e0fa6a5 ("virt/sev-guest: Prevent IV reuse in the SNP guest driver") changed the behavior associated with the return value when the caller does not supply a large enough certificate buffer. Prior to the commit a value of -EIO was returned. Now, 0 is returned. This breaks the established ABI with the user. Change the code to detect the buffer size error and return -EIO. Fixes: 47894e0fa6a5 ("virt/sev-guest: Prevent IV reuse in the SNP guest driver") Reported-by: Larry Dewey Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Tested-by: Larry Dewey Cc: Link: https://lore.kernel.org/r/2afbcae6daf13f7ad5a4296692e0a0fe1bc1e4ee.1677083979.git.thomas.lendacky@amd.com commit dfd2f0eb2347dbdf391fd5b8255fefc58a745472 Author: Eric Dumazet Date: Mon Feb 27 18:44:36 2023 +0000 net/sched: flower: fix fl_change() error recovery path The two "goto errout;" paths in fl_change() became wrong after cited commit. Indeed we only must not call __fl_put() until the net pointer has been set in tcf_exts_init_ex() This is a minimal fix. We might in the future validate TCA_FLOWER_FLAGS before we allocate @fnew. BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:72 [inline] BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline] BUG: KASAN: null-ptr-deref in refcount_read include/linux/refcount.h:147 [inline] BUG: KASAN: null-ptr-deref in __refcount_add_not_zero include/linux/refcount.h:152 [inline] BUG: KASAN: null-ptr-deref in __refcount_inc_not_zero include/linux/refcount.h:227 [inline] BUG: KASAN: null-ptr-deref in refcount_inc_not_zero include/linux/refcount.h:245 [inline] BUG: KASAN: null-ptr-deref in maybe_get_net include/net/net_namespace.h:269 [inline] BUG: KASAN: null-ptr-deref in tcf_exts_get_net include/net/pkt_cls.h:260 [inline] BUG: KASAN: null-ptr-deref in __fl_put net/sched/cls_flower.c:513 [inline] BUG: KASAN: null-ptr-deref in __fl_put+0x13e/0x3b0 net/sched/cls_flower.c:508 Read of size 4 at addr 000000000000014c by task syz-executor548/5082 CPU: 0 PID: 5082 Comm: syz-executor548 Not tainted 6.2.0-syzkaller-05251-g5b7c4cabbb65 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_report mm/kasan/report.c:420 [inline] kasan_report+0xec/0x130 mm/kasan/report.c:517 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x141/0x190 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:72 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline] refcount_read include/linux/refcount.h:147 [inline] __refcount_add_not_zero include/linux/refcount.h:152 [inline] __refcount_inc_not_zero include/linux/refcount.h:227 [inline] refcount_inc_not_zero include/linux/refcount.h:245 [inline] maybe_get_net include/net/net_namespace.h:269 [inline] tcf_exts_get_net include/net/pkt_cls.h:260 [inline] __fl_put net/sched/cls_flower.c:513 [inline] __fl_put+0x13e/0x3b0 net/sched/cls_flower.c:508 fl_change+0x101b/0x4ab0 net/sched/cls_flower.c:2341 tc_new_tfilter+0x97c/0x2290 net/sched/cls_api.c:2310 rtnetlink_rcv_msg+0x996/0xd50 net/core/rtnetlink.c:6165 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2574 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745 ____sys_sendmsg+0x334/0x900 net/socket.c:2504 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2558 __sys_sendmmsg+0x18f/0x460 net/socket.c:2644 __do_sys_sendmmsg net/socket.c:2673 [inline] __se_sys_sendmmsg net/socket.c:2670 [inline] __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2670 Fixes: 08a0063df3ae ("net/sched: flower: Move filter handle initialization earlier") Reported-by: syzbot+baabf3efa7c1e57d28b2@syzkaller.appspotmail.com Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Paul Blakey Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 693aa2c0d9b6d5b1f2745d31b6e70d09dbbaf06e Author: Eric Dumazet Date: Mon Feb 27 15:30:24 2023 +0000 ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() ila_xlat_nl_cmd_get_mapping() generates an empty skb, triggerring a recent sanity check [1]. Instead, return an error code, so that user space can get it. [1] skb_assert_len WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 skb_assert_len include/linux/skbuff.h:2527 [inline] WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 Modules linked in: CPU: 0 PID: 5923 Comm: syz-executor269 Not tainted 6.2.0-syzkaller-18300-g2ebd1fbb946d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_assert_len include/linux/skbuff.h:2527 [inline] pc : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 lr : skb_assert_len include/linux/skbuff.h:2527 [inline] lr : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 sp : ffff80001e0d6c40 x29: ffff80001e0d6e60 x28: dfff800000000000 x27: ffff0000c86328c0 x26: dfff800000000000 x25: ffff0000c8632990 x24: ffff0000c8632a00 x23: 0000000000000000 x22: 1fffe000190c6542 x21: ffff0000c8632a10 x20: ffff0000c8632a00 x19: ffff80001856e000 x18: ffff80001e0d5fc0 x17: 0000000000000000 x16: ffff80001235d16c x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001 x11: ff80800008353a30 x10: 0000000000000000 x9 : 21567eaf25bfb600 x8 : 21567eaf25bfb600 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80001e0d6558 x4 : ffff800015c74760 x3 : ffff800008596744 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000000e Call trace: skb_assert_len include/linux/skbuff.h:2527 [inline] __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156 dev_queue_xmit include/linux/netdevice.h:3033 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline] __netlink_deliver_tap+0x45c/0x6f8 net/netlink/af_netlink.c:325 netlink_deliver_tap+0xf4/0x174 net/netlink/af_netlink.c:338 __netlink_sendskb net/netlink/af_netlink.c:1283 [inline] netlink_sendskb+0x6c/0x154 net/netlink/af_netlink.c:1292 netlink_unicast+0x334/0x8d4 net/netlink/af_netlink.c:1380 nlmsg_unicast include/net/netlink.h:1099 [inline] genlmsg_unicast include/net/genetlink.h:433 [inline] genlmsg_reply include/net/genetlink.h:443 [inline] ila_xlat_nl_cmd_get_mapping+0x620/0x7d0 net/ipv6/ila/ila_xlat.c:493 genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x938/0xc1c net/netlink/genetlink.c:1065 netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2574 genl_rcv+0x38/0x50 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x660/0x8d4 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x800/0xae0 net/netlink/af_netlink.c:1942 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x558/0x844 net/socket.c:2479 ___sys_sendmsg net/socket.c:2533 [inline] __sys_sendmsg+0x26c/0x33c net/socket.c:2562 __do_sys_sendmsg net/socket.c:2571 [inline] __se_sys_sendmsg net/socket.c:2569 [inline] __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2569 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 irq event stamp: 136484 hardirqs last enabled at (136483): [] __up_console_sem+0x60/0xb4 kernel/printk/printk.c:345 hardirqs last disabled at (136484): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (136418): [] softirq_handle_end kernel/softirq.c:414 [inline] softirqs last enabled at (136418): [] __do_softirq+0xd4c/0xfa4 kernel/softirq.c:600 softirqs last disabled at (136371): [] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 ---[ end trace 0000000000000000 ]--- skb len=0 headroom=0 headlen=0 tailroom=192 mac=(0,0) net=(0,-1) trans=-1 shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0)) csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0) hash(0x0 sw=0 l4=0) proto=0x0010 pkttype=6 iif=0 dev name=nlmon0 feat=0x0000000000005861 Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit fb07390463c95e6eef254044d6dde050bfb9807a Author: Pedro Tammela Date: Mon Feb 27 12:23:52 2023 -0300 net/sched: act_connmark: handle errno on tcf_idr_check_alloc Smatch reports that 'ci' can be used uninitialized. The current code ignores errno coming from tcf_idr_check_alloc, which will lead to the incorrect usage of 'ci'. Handle the errno as it should. Fixes: 288864effe33 ("net/sched: act_connmark: transition to percpu stats and rcu") Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 880ce5f20033cd6ecb2c0edfe0376c9e45220012 Author: Eric Dumazet Date: Mon Feb 27 14:17:06 2023 +0000 net: avoid skb end_offset change in __skb_unclone_keeptruesize() Once initial skb->head has been allocated from skb_small_head_cache, we need to make sure to use the same strategy whenever skb->head has to be re-allocated, as found by syzbot [1] This means kmalloc_reserve() can not fallback from using skb_small_head_cache to generic (power-of-two) kmem caches. It seems that we probably want to rework things in the future, to partially revert following patch, because we no longer use ksize() for skb allocated in TX path. 2b88cba55883 ("net: preserve skb_end_offset() in skb_unclone_keeptruesize()") Ideally, TCP stack should never put payload in skb->head, this effort has to be completed. In the mean time, add a sanity check. [1] BUG: KASAN: invalid-free in slab_free mm/slub.c:3787 [inline] BUG: KASAN: invalid-free in kmem_cache_free+0xee/0x5c0 mm/slub.c:3809 Free of addr ffff88806cdee800 by task syz-executor239/5189 CPU: 0 PID: 5189 Comm: syz-executor239 Not tainted 6.2.0-rc8-syzkaller-02400-gd1fabc68f8e0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report_invalid_free+0x9b/0x1b0 mm/kasan/report.c:482 ____kasan_slab_free+0x1a5/0x1c0 mm/kasan/common.c:216 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] kmem_cache_free+0xee/0x5c0 mm/slub.c:3809 skb_kfree_head net/core/skbuff.c:857 [inline] skb_kfree_head net/core/skbuff.c:853 [inline] skb_free_head+0x16f/0x1a0 net/core/skbuff.c:872 skb_release_data+0x57a/0x820 net/core/skbuff.c:901 skb_release_all net/core/skbuff.c:966 [inline] __kfree_skb+0x4f/0x70 net/core/skbuff.c:980 tcp_wmem_free_skb include/net/tcp.h:302 [inline] tcp_rtx_queue_purge net/ipv4/tcp.c:3061 [inline] tcp_write_queue_purge+0x617/0xcf0 net/ipv4/tcp.c:3074 tcp_v4_destroy_sock+0x125/0x810 net/ipv4/tcp_ipv4.c:2302 inet_csk_destroy_sock+0x19a/0x440 net/ipv4/inet_connection_sock.c:1195 __tcp_close+0xb96/0xf50 net/ipv4/tcp.c:3021 tcp_close+0x2d/0xc0 net/ipv4/tcp.c:3033 inet_release+0x132/0x270 net/ipv4/af_inet.c:426 __sock_release+0xcd/0x280 net/socket.c:651 sock_close+0x1c/0x20 net/socket.c:1393 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f2511f546c3 Code: c7 c2 c0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 RSP: 002b:00007ffef0103d48 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f2511f546c3 RDX: 0000000000000978 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000002 R09: 0000000000003434 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef0103d6c R13: 00007ffef0103d80 R14: 00007ffef0103dc0 R15: 0000000000000003 Allocated by task 5189: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] ____kasan_kmalloc mm/kasan/common.c:333 [inline] __kasan_kmalloc+0xa5/0xb0 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc_node_track_caller+0x5b/0xc0 mm/slab_common.c:988 kmalloc_reserve+0xf1/0x230 net/core/skbuff.c:539 pskb_expand_head+0x237/0x1160 net/core/skbuff.c:1995 __skb_unclone_keeptruesize+0x93/0x220 net/core/skbuff.c:2094 skb_unclone_keeptruesize include/linux/skbuff.h:1910 [inline] skb_prepare_for_shift net/core/skbuff.c:3804 [inline] skb_shift+0xef8/0x1e20 net/core/skbuff.c:3877 tcp_skb_shift net/ipv4/tcp_input.c:1538 [inline] tcp_shift_skb_data net/ipv4/tcp_input.c:1646 [inline] tcp_sacktag_walk+0x93b/0x18a0 net/ipv4/tcp_input.c:1713 tcp_sacktag_write_queue+0x1599/0x31d0 net/ipv4/tcp_input.c:1974 tcp_ack+0x2e9f/0x5a10 net/ipv4/tcp_input.c:3847 tcp_rcv_established+0x667/0x2230 net/ipv4/tcp_input.c:6006 tcp_v4_do_rcv+0x670/0x9b0 net/ipv4/tcp_ipv4.c:1721 sk_backlog_rcv include/net/sock.h:1113 [inline] __release_sock+0x133/0x3b0 net/core/sock.c:2921 release_sock+0x58/0x1b0 net/core/sock.c:3488 tcp_sendmsg+0x3a/0x50 net/ipv4/tcp.c:1485 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745 sock_write_iter+0x295/0x3d0 net/socket.c:1136 call_write_iter include/linux/fs.h:2189 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x9ed/0xdd0 fs/read_write.c:584 ksys_write+0x1ec/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88806cdee800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 0 bytes inside of 1024-byte region [ffff88806cdee800, ffff88806cdeec00) The buggy address belongs to the physical page: page:ffffea0001b37a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6cde8 head:ffffea0001b37a00 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffff888012441dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1f2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_MEMALLOC|__GFP_HARDWALL), pid 75, tgid 75 (kworker/u4:4), ts 96369578780, free_ts 26734162530 prep_new_page mm/page_alloc.c:2531 [inline] get_page_from_freelist+0x119c/0x2ce0 mm/page_alloc.c:4283 __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5549 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2287 alloc_slab_page mm/slub.c:1851 [inline] allocate_slab+0x25f/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3292 __slab_alloc_node mm/slub.c:3345 [inline] slab_alloc_node mm/slub.c:3442 [inline] __kmem_cache_alloc_node+0x1a4/0x430 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc_node_track_caller+0x4b/0xc0 mm/slab_common.c:988 kmalloc_reserve+0xf1/0x230 net/core/skbuff.c:539 __alloc_skb+0x129/0x330 net/core/skbuff.c:608 __netdev_alloc_skb+0x74/0x410 net/core/skbuff.c:672 __netdev_alloc_skb_ip_align include/linux/skbuff.h:3203 [inline] netdev_alloc_skb_ip_align include/linux/skbuff.h:3213 [inline] batadv_iv_ogm_aggregate_new+0x106/0x4e0 net/batman-adv/bat_iv_ogm.c:558 batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:670 [inline] batadv_iv_ogm_schedule_buff+0xe6b/0x1450 net/batman-adv/bat_iv_ogm.c:849 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:868 [inline] batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:861 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x744/0x910 net/batman-adv/bat_iv_ogm.c:1712 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1446 [inline] free_pcp_prepare+0x66a/0xc20 mm/page_alloc.c:1496 free_unref_page_prepare mm/page_alloc.c:3369 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3464 free_contig_range+0xb5/0x180 mm/page_alloc.c:9488 destroy_args+0xa8/0x64c mm/debug_vm_pgtable.c:998 debug_vm_pgtable+0x28de/0x296f mm/debug_vm_pgtable.c:1318 do_one_initcall+0x141/0x790 init/main.c:1306 do_initcall_level init/main.c:1379 [inline] do_initcalls init/main.c:1395 [inline] do_basic_setup init/main.c:1414 [inline] kernel_init_freeable+0x6f9/0x782 init/main.c:1634 kernel_init+0x1e/0x1d0 init/main.c:1522 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Memory state around the buggy address: ffff88806cdee700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88806cdee780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88806cdee800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff88806cdee880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Fixes: bf9f1baa279f ("net: add dedicated kmem_cache for typical/small skb->head") Reported-by: syzbot Signed-off-by: Eric Dumazet Tested-by: Christoph Paasch Signed-off-by: David S. Miller commit 81a1dd10b072fd432f37cd5dc9eb3ed6ec5d386e Author: Björn Töpel Date: Tue Feb 28 19:42:10 2023 +0100 riscv, lib: Fix Zbb strncmp The Zbb optimized strncmp has two parts; a fast path that does XLEN/8B per iteration, and a slow that does one byte per iteration. The idea is to compare aligned XLEN chunks for most of strings, and do the remainder tail in the slow path. The Zbb strncmp has two issues in the fast path: Incorrect remainder handling (wrong compare): Assume that the string length is 9. On 64b systems, the fast path should do one iteration, and one iteration in the slow path. Instead, both were done in the fast path, which lead to incorrect results. An example: strncmp("/dev/vda", "/dev/", 5); Correct by changing "bgt" to "bge". Missing NULL checks in the second string: This could lead to incorrect results for: strncmp("/dev/vda", "/dev/vda\0", 8); Correct by adding an additional check. Fixes: b6fcdb191e36 ("RISC-V: add zbb support to string functions") Suggested-by: Heiko Stuebner Signed-off-by: Björn Töpel Tested-by: Conor Dooley Tested-by: Guenter Roeck Link: https://lore.kernel.org/r/20230228184211.1585641-1-bjorn@kernel.org Signed-off-by: Palmer Dabbelt commit c0927a7a5391f7d8e593e5e50ead7505a23cadf9 Merge: 1899946aaf256 6e2985c938e8b Author: Linus Torvalds Date: Tue Feb 28 16:08:30 2023 -0800 Merge tag 'xfs-6.3-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull moar xfs updates from Darrick Wong: "This contains a fix for a deadlock in the allocator. It continues the slow march towards being able to offline AGs, and it refactors the interface to the xfs allocator to be less indirection happy. Summary: - Fix a deadlock in the free space allocator due to the AG-walking algorithm forgetting to follow AG-order locking rules - Make the inode allocator prefer existing free inodes instead of failing to allocate new inode chunks when free space is low - Set minleft correctly when setting allocator parameters for bmap changes - Fix uninitialized variable access in the getfsmap code - Make a distinction between active and passive per-AG structure references. For now, active references are taken to perform some work in an AG on behalf of a high level operation; passive references are used by lower level code to finish operations started by other threads. Eventually this will become part of online shrink - Split out all the different allocator strategies into separate functions to move us away from design antipattern of filling out a huge structure for various differentish things and issuing a single function multiplexing call - Various cleanups in the filestreams allocator code, which we might very well want to deprecate instead of continuing - Fix a bug with the agi rotor code that was introduced earlier in this series" * tag 'xfs-6.3-merge-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (44 commits) xfs: restore old agirotor behavior xfs: fix uninitialized variable access xfs: refactor the filestreams allocator pick functions xfs: return a referenced perag from filestreams allocator xfs: pass perag to filestreams tracing xfs: use for_each_perag_wrap in xfs_filestream_pick_ag xfs: track an active perag reference in filestreams xfs: factor out MRU hit case in xfs_filestream_select_ag xfs: remove xfs_filestream_select_ag() longest extent check xfs: merge new filestream AG selection into xfs_filestream_select_ag() xfs: merge filestream AG lookup into xfs_filestream_select_ag() xfs: move xfs_bmap_btalloc_filestreams() to xfs_filestreams.c xfs: use xfs_bmap_longest_free_extent() in filestreams xfs: get rid of notinit from xfs_bmap_longest_free_extent xfs: factor out filestreams from xfs_bmap_btalloc_nullfb xfs: convert trim to use for_each_perag_range xfs: convert xfs_alloc_vextent_iterate_ags() to use perag walker xfs: move the minimum agno checks into xfs_alloc_vextent_check_args xfs: fold xfs_alloc_ag_vextent() into callers xfs: move allocation accounting to xfs_alloc_vextent_set_fsbno() ... commit 1899946aaf2566c577683ebe510a83c930cd3751 Merge: b1f1382a110bc 510d2358c466b Author: Linus Torvalds Date: Tue Feb 28 16:05:01 2023 -0800 Merge tag 'i3c/for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "Subsystem: - transfer pid from boardinfo to device info Drivers: - dw-i3c-master: stop hardcoding initial speed" * tag 'i3c/for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: dw: stop hardcoding initial speed i3c: transfer pid from boardinfo to device info commit b1f1382a110bca1ef52234e889246a90f9a0d69b Merge: e492250d52526 901578a45950b Author: Linus Torvalds Date: Tue Feb 28 16:01:08 2023 -0800 Merge tag 'docs-6.3-2' of git://git.lwn.net/linux Pull Documentation stragglers from Jonathan Corbet: "A handful of documentation patches that were ready before the merge window, but which I didn't get merged for the first round: - A recommendation from Thorsten (also akpm) on use of Link tags to point out problem reports - Some front-page formatting tweaks - Another Spanish translation - One typo(ish) fix" * tag 'docs-6.3-2' of git://git.lwn.net/linux: docs: recommend using Link: whenever using Reported-by: Documentation: front page: use recommended heading adornments docs/sp_SP: Add process programming-language translation docs: locking: refer to the actual existing config names commit 510d2358c466bf6588034f0d3b2266eed2bc0a51 Author: Jack Chen Date: Thu Feb 16 10:10:57 2023 -0500 i3c: master: dw: stop hardcoding initial speed Bus-speed could be default(12.5MHz) or defined by users in dts. Dw-i3c-master should not hard-code the initial speed to be I3C_BUS_TYP_I3C_SCL_RATE (12.5MHz) And because of Synopsys's I3C controller limit (hcnt/lcnt register length) and core-clk provided, there is a limit to bus speed, too. For example, when core-clk is 250 MHz, the bus speed cannot be lowered below 1MHz. Tested: tested with an i3c sensor and captured with a logic analyzer. Signed-off-by: Jack Chen Link: https://lore.kernel.org/r/20230216151057.293764-1-zenghuchen@google.com Signed-off-by: Alexandre Belloni commit a2a448b4d9bcb5bff0e0f687b7932a7be9ca898a Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:11 2023 +0200 drm/msm/dpu: disable features unsupported by QCM2290 QCM2290 doesn't seem to support reg-dma, UBWC and CSC. Drop corresponding features being incorrectly enabled for qcm2290. Cc: Loic Poulain Fixes: 5334087ee743 ("drm/msm: add support for QCM2290 MDSS") Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/522209/ Link: https://lore.kernel.org/r/20230211231259.1308718-3-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit 0df979f4b93569dfb908d195f8e7d4c3cef4eaeb Author: Dmitry Baryshkov Date: Sun Feb 12 01:12:10 2023 +0200 drm/msm/dpu: set DPU_MDP_PERIPH_0_REMOVED for sc8280xp The SC8280XP also has a black hole at the top of MDP_TOP region. Set corresponding bit to disable access to that region. Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP") Reviewed-by: Abhinav Kumar Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/522207/ Link: https://lore.kernel.org/r/20230211231259.1308718-2-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit 4d42cd6bc2ac1b9be50ade13771daec90c9d18b1 Author: Jakub Kicinski Date: Mon Feb 27 10:12:01 2023 -0800 tls: rx: fix return value for async crypto Gaurav reports that TLS Rx is broken with async crypto accelerators. The commit under fixes missed updating the retval byte counting logic when updating how records are stored. Even tho both before and after the change 'decrypted' was updated inside the main loop, it was completely overwritten when processing the async completions. Now that the rx_list only holds non-zero-copy records we need to add, not overwrite. Reported-and-bisected-by: Gaurav Jain Fixes: cbbdee9918a2 ("tls: rx: async: don't put async zc on the list") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217064 Tested-by: Gaurav Jain Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230227181201.1793772-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ca643ccf933a10732d29f77089736334179577a5 Merge: 8f9850dd8d23c 8b322f9fdb35e Author: Jakub Kicinski Date: Tue Feb 28 14:13:33 2023 -0800 Merge branch 'freescale-t1040rdb-dts-updates' Vladimir Oltean says: ==================== Freescale T1040RDB DTS updates This contains a fix for the new device tree for the T1040RDB rev A board, which never worked, and an update to enable multiple CPU port support for all revisions of the T1040RDB. ==================== Link: https://lore.kernel.org/r/20230224155941.514638-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 8b322f9fdb35ecee0d4a40de8af923444bd624ea Author: Vladimir Oltean Date: Fri Feb 24 17:59:40 2023 +0200 powerpc: dts: t1040rdb: enable both CPU ports Since commit eca70102cfb1 ("net: dsa: felix: add support for changing DSA master") included in kernel v6.1, the driver supports 2 CPU ports, and they can be put in a LAG, for example (see Documentation/networking/dsa/configuration.rst for more details). Defining the second CPU port in the device tree should not cause any compatibility issue, because the default CPU port was &seville_port8 before this change, and still is &seville_port8 now (the numerically first CPU port is used by default). Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit ae44f1c9d1fc54aeceb335fedb1e73b2c3ee4561 Author: Vladimir Oltean Date: Fri Feb 24 17:59:39 2023 +0200 powerpc: dts: t1040rdb: fix compatible string for Rev A boards It looks like U-Boot fails to start the kernel properly when the compatible string of the board isn't fsl,T1040RDB, so stop overriding it from the rev-a.dts. Fixes: 5ebb74749202 ("powerpc: dts: t1040rdb: fix ports names for Seville Ethernet switch") Signed-off-by: Vladimir Oltean Signed-off-by: Jakub Kicinski commit 1a2c73f4834dd79e4f2c590ac75358fb44137650 Author: Jiaxun Yang Date: Tue Feb 28 19:34:59 2023 +0000 MIPS: Workaround clang inline compat branch issue Clang is unable to handle the situation that a chunk of inline assembly ends with a compat branch instruction and then compiler generates another control transfer instruction immediately after this compat branch. The later instruction will end up in forbidden slot and cause exception. Workaround by add a option to control the use of compact branch. Currently it's selected by CC_IS_CLANG and hopefully we can change it to a version check in future if clang manages to fix it. Fix boot on boston board. Link: https://github.com/llvm/llvm-project/issues/61045 Signed-off-by: Jiaxun Yang Acked-by: Nathan Chancellor Acked-by: Nick Desaulniers Signed-off-by: Thomas Bogendoerfer commit 70f864d1084734f8816a247c24e6876d2dfb5f89 Author: Sergio Paracuellos Date: Tue Feb 14 11:39:34 2023 +0100 mips: dts: ralink: mt7621: add phandle to system controller node for watchdog To allow to access system controller registers from watchdog driver code add a phandle in the watchdog 'wdt' node. This avoid using arch dependent operations in driver code. Reviewed-by: Arınç ÜNAL Signed-off-by: Sergio Paracuellos Acked-by: Guenter Roeck Signed-off-by: Thomas Bogendoerfer commit 79f76e574c3690261d6165f008b7054e54c6dca9 Author: Sergio Paracuellos Date: Tue Feb 14 11:39:33 2023 +0100 mips: dts: ralink: mt7621: rename watchdog node from 'wdt' into 'watchdog' Watchdog nodes must use 'watchdog' for node name. When a 'make dtbs_check' is performed the following warning appears: wdt@100: $nodename:0: 'wdt@100' does not match '^watchdog(@.*|-[0-9a-f])?$' Fix this warning up properly renaming the node into 'watchdog'. Reviewed-by: Arınç ÜNAL Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Sergio Paracuellos Acked-by: Guenter Roeck Signed-off-by: Thomas Bogendoerfer commit d25d01b4e59bde815df52a333f9b0f7558cc3281 Author: Nick Alcock Date: Tue Feb 28 13:02:01 2023 +0000 powercap: remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Rafael J. Wysocki commit 5bd289f69bc145fa10927a6883502a0e7cbcb811 Author: Nick Alcock Date: Fri Feb 24 15:07:49 2023 +0000 cpufreq: intel_pstate: remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in the files in this commit, none of which can be built as modules. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain Signed-off-by: Rafael J. Wysocki commit e32d546c483a2a0f607687f5b521c2a2f942ffbe Author: Mario Limonciello Date: Thu Feb 23 14:26:22 2023 -0600 ACPI: x86: Drop quirk for HP Elitebook There was a quirk in `acpi/x86/s2idle.c` for an HP Elitebook G9 platforms to force AMD GUID codepath instead of Microsoft codepath. This was due to a bug with WCN6855 WLAN firmware interaction with the system. This bug is fixed by WCN6855 firmware: WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23 Remove the quirk as it's no longer necessary with this firmware. Link: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=c7a57ef688f7d99d8338a5d8edddc8836ff0e6de Tested-by: Anson Tsao Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit e48223e36001980318ed886b2fdc1157009d280b Merge: 11d4e474861aa 18f51ed09888c Author: Mark Brown Date: Tue Feb 28 17:59:21 2023 +0000 ASoC: mt8183: Fixes from an initial glance at a Merge series from Mark Brown : This is a collection of fixes I came up after glancing through an initial test run with the snappily named Kukui Jacuzzi SKU16 Chromebook on KernelCI. There are more issues flagged, this is just what I fixed thus far. commit 11d4e474861aa3443e52251660e5928103380715 Merge: b201929904a59 c5682e2ba1327 Author: Mark Brown Date: Tue Feb 28 17:59:15 2023 +0000 ASoC: mchp-pdmc: fix poc noises when starting Merge series from Claudiu Beznea : To start capture on Microchip PDMC the enable bits for each supported microphone need to be set. After this bit is set the PDMC starts to receive data from microphones and it considers this data as valid data. Thus if microphones are not ready the PDMC captures anyway data from its lines. This data is interpreted by the human ear as poc noises. To avoid this the following software workaround need to be applied when starting capture: 1/ enable PDMC channel 2/ wait 150ms 3/ execute 16 dummy reads from RHR 4/ clear interrupts 5/ enable interrupts 6/ enable DMA channel For this workaround to work step 6 need to be executed at the end. For step 6 was added patch 1/3 from this series. With this, component DAI driver sets its struct snd_soc_component_driver::start_dma_last = 1 and proper action is taken based on this flag when starting DAI trigger vs DMA. commit b201929904a5907fa2d533b80fecd5666a239570 Merge: e3e3299316305 8cbd7273a724d Author: Mark Brown Date: Tue Feb 28 17:59:09 2023 +0000 ASoC: mt6358: Fixes from an initial glance at a Merge series from Mark Brown : This is a collection of fixes I came up after glancing through an initial test run with the snappily named Kukui Jacuzzi SKU16 Chromebook on KernelCI. There are more issues flagged, this is just what I fixed thus far. commit e3e32993163056f1c4715fee2dad77c632a2394e Merge: d52279d5c9204 ce40d93b062c0 Author: Mark Brown Date: Tue Feb 28 17:59:03 2023 +0000 ASoC: mt8192: Fixes from initial glance at kselftest Merge series from Mark Brown : This is a collection of fixes I came up after glancing through an initial test run with the Spherion Chromebook on KernelCI. There are more issues flagged, this is just what I fixed thus far - the volume controls on the MT6359 have issues for example, and a lot of controls aren't marked as Switches like they should be. commit f8502fba45bd30e1a6a354d9d898bc99d1a11e6d Author: Rijo Thomas Date: Tue Feb 28 15:11:20 2023 +0530 tee: amdtee: fix race condition in amdtee_open_session There is a potential race condition in amdtee_open_session that may lead to use-after-free. For instance, in amdtee_open_session() after sess->sess_mask is set, and before setting: sess->session_info[i] = session_info; if amdtee_close_session() closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed within amdtee_open_session(). The solution is to set the bit sess->sess_mask as the last step in amdtee_open_session(). Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Cc: stable@vger.kernel.org Signed-off-by: Rijo Thomas Acked-by: Sumit Garg Signed-off-by: Jens Wiklander commit e492250d5252635b6c97d52eddf2792ec26f1ec1 Merge: b07ce43db665a cf70d01a62c71 Author: Linus Torvalds Date: Tue Feb 28 09:12:47 2023 -0800 Merge tag 'pwm/for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "This rather small set of changes includes some minor fixes and improvements. The AB8500 driver gained support for reading the initial hardware state and the Synopsys DesignWare driver received some work to prepare for device tree and platform support" * tag 'pwm/for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: dwc: Use devm_pwmchip_add() pwm: dwc: Move memory allocation to own function pwm: dwc: Change &pci->dev to dev in probe dt-bindings: pwm: Document Synopsys DesignWare snps,pwm-dw-apb-timers-pwm2 pwm: iqs620a: Replace one remaining instance of regmap_update_bits() pwm: ab8500: Implement .get_state() pwm: ab8500: Fix calculation of duty and period pwm: lp3943: Drop unused i2c include dt-bindings: pwm: mediatek: Convert pwm-mediatek to DT schema pwm: stm32-lp: fix the check on arr and cmp registers update pwm: Move pwm_capture() dummy to restore order pwm: sifive: Always let the first pwm_apply_state succeed commit b07ce43db665a6b5a622d5bb1447950d7e1e3fb1 Merge: ae3419fbac845 e3645d72f8865 Author: Linus Torvalds Date: Tue Feb 28 09:05:47 2023 -0800 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Improve performance for ext4 by allowing multiple process to perform direct I/O writes to preallocated blocks by using a shared inode lock instead of taking an exclusive lock. In addition, multiple bug fixes and cleanups" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix incorrect options show of original mount_opt and extend mount_opt2 ext4: Fix possible corruption when moving a directory ext4: init error handle resource before init group descriptors ext4: fix task hung in ext4_xattr_delete_inode jbd2: fix data missing when reusing bh which is ready to be checkpointed ext4: update s_journal_inum if it changes after journal replay ext4: fail ext4_iget if special inode unallocated ext4: fix function prototype mismatch for ext4_feat_ktype ext4: remove unnecessary variable initialization ext4: fix inode tree inconsistency caused by ENOMEM ext4: refuse to create ea block when umounted ext4: optimize ea_inode block expansion ext4: remove dead code in updating backup sb ext4: dio take shared inode lock when overwriting preallocated blocks ext4: don't show commit interval if it is zero ext4: use ext4_fc_tl_mem in fast-commit replay path ext4: improve xattr consistency checking and error reporting commit 6934cf8a3e0b4a8318ce8f1342348e967e29192f Author: Heiko Stuebner Date: Wed Feb 8 23:53:28 2023 +0100 RISC-V: improve string-function assembly Adapt the suggestions for the assembly string functions that Andrew suggested but that I didn't manage to include into the series that got applied. This includes improvements to two comments, removal of unneeded labels and moving one instruction slightly higher to contradict an explanatory comment. Suggested-by: Andrew Jones Signed-off-by: Heiko Stuebner Reviewed-by: Andrew Jones Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230208225328.1636017-3-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit d52279d5c9204a041e9ba02a66a353573b2f96e4 Author: Duc Anh Le Date: Tue Feb 28 00:49:21 2023 +0100 ASoC: amd: yc: Add DMI entries to support HP OMEN 16-n0xxx (8A43) This model requires an additional detection quirk to enable the internal microphone. Signed-off-by: Duc Anh Le Link: https://lore.kernel.org/r/20230227234921.7784-1-lub.the.studio@gmail.com Signed-off-by: Mark Brown commit 2449d436681d40bc63ec2c766fd51b632270d8a7 Author: Krishna Yarlagadda Date: Tue Feb 28 01:34:28 2023 +0530 spi: tegra210-quad: Fix iterator outside loop Fix warn: iterator used outside loop: 'xfer'. 'xfer' variable contain invalid value in few conditions. Complete transfer within DATA phase in successful case and at the end for failed transfer. Reported-by: Dan Carpenter Link:https://lore.kernel.org/all/202210191211.46FkzKmv-lkp@intel.com/ Fixes: 8777dd9dff40 ("spi: tegra210-quad: Fix combined sequence") Signed-off-by: Krishna Yarlagadda Link: https://lore.kernel.org/r/20230227200428.45832-1-kyarlagadda@nvidia.com Signed-off-by: Mark Brown commit 0de2cc3707b6b6e2ad40bd24ce09a5c1f65d01e1 Author: Arnd Bergmann Date: Mon Feb 27 09:58:26 2023 +0100 ASoC: zl38060 add gpiolib dependency Without gpiolib, this driver fails to link: arm-linux-gnueabi-ld: sound/soc/codecs/zl38060.o: in function `chip_gpio_get': zl38060.c:(.text+0x30): undefined reference to `gpiochip_get_data' arm-linux-gnueabi-ld: sound/soc/codecs/zl38060.o: in function `zl38_spi_probe': zl38060.c:(.text+0xa18): undefined reference to `devm_gpiochip_add_data_with_key' This appears to have been in the driver since the start, but is hard to hit in randconfig testing since gpiolib is almost always selected by something else. Fixes: 52e8a94baf90 ("ASoC: Add initial ZL38060 driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230227085850.2503725-1-arnd@kernel.org Signed-off-by: Mark Brown commit c769fb6bcc485d752d492064a9005525a8d5fa24 Author: Mark Brown Date: Sat Feb 25 21:48:13 2023 +0000 ASoC: sam9g20ek: Disable capture unless building with microphone input Without modification the AT91SAM9G20-EK has no capture support, none of the inputs of the CODEC are wired to anything to useful and there are no paths supporting loopback. Since the audio is clocked from the CODEC and the DAPM inputs are marked as unusable this means that capture will fail to transfer any data as the ADC path can't be powered up. Flag this in the device description so apps don't see unusable capture support, guarded with the existing optional define for mic input. Reviewed-by: Claudiu Beznea Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230225-asoc-sam9g20ek-v1-1-9baeb4893142@kernel.org Signed-off-by: Mark Brown commit ce40d93b062c0bdcd29218c12ab1dba544382dd8 Author: Mark Brown Date: Fri Feb 24 14:03:58 2023 +0000 ASoC: mt8192: Fix range for sidetone positive gain The Sidetone_Positive_Gain_dB control reports a range of 0..100 as valid but the put() function rejects anything larger than 24. Fix this. There are numerous other problems with this control, the name is very non idiomatic and it should be a TLV, but it's ABI so probably we should leave those alone. Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230223-asoc-mt8192-quick-fixes-v1-4-9a85f90368e1@kernel.org Signed-off-by: Mark Brown commit 05437a91173b8780692ac35313f98cac68be7c42 Author: Mark Brown Date: Fri Feb 24 14:03:57 2023 +0000 ASoC: mt8192: Report an error if when an invalid sidetone gain is written Reporting an error on invalid values is optional but helpful to userspace so do so. Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230223-asoc-mt8192-quick-fixes-v1-3-9a85f90368e1@kernel.org Signed-off-by: Mark Brown commit b373076f609993d333dbbc3283b65320c7a41834 Author: Mark Brown Date: Fri Feb 24 14:03:56 2023 +0000 ASoC: mt8192: Fix event generation for controls ALSA controls put() operations should return 1 if the value changed and 0 if it remains the same, fix the mt8192 driver to do so. Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230223-asoc-mt8192-quick-fixes-v1-2-9a85f90368e1@kernel.org Signed-off-by: Mark Brown commit 5df1a5d28449f2b98ff84f69dea74b06f9b8e362 Author: Mark Brown Date: Fri Feb 24 14:03:55 2023 +0000 ASoC: mt8192: Remove spammy log messages There are a lot of info level log messages in the mt8192 ADDA driver which are trivially triggerable from userspace, many in normal operation. Remove these to avoid spamming the console. Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230223-asoc-mt8192-quick-fixes-v1-1-9a85f90368e1@kernel.org Signed-off-by: Mark Brown commit c5682e2ba1327d08987a7cabc7b5b40bf3bc131f Author: Claudiu Beznea Date: Tue Feb 28 13:01:45 2023 +0200 ASoC: mchp-pdmc: fix poc noise at capture startup Microchip PDMC IP doesn't filter microphone noises on startup. By default, it captures data received from digital microphones after the MCHP_PDMC_MR.EN bits are set. Thus when enable is set on PDMC side the digital microphones might not be ready yet and PDMC captures data from then in this time. This data captured is poc noise. To avoid this the software workaround is to the following: 1/ enable PDMC channel 2/ wait 150ms (on SAMA7G5-EK setup) 3/ execute 16 dummy reads from RHR 4/ clear interrupts 5/ enable interrupts 6/ enable DMA channel Fixes: 50291652af52 ("ASoC: atmel: mchp-pdmc: add PDMC driver") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230228110145.3770525-4-claudiu.beznea@microchip.com Signed-off-by: Mark Brown commit 143a2f011c4471511887807822d3fd71f25f5169 Author: Claudiu Beznea Date: Tue Feb 28 13:01:44 2023 +0200 ASoC: dt-bindings: sama7g5-pdmc: add microchip,startup-delay-us binding PDMC can work with different types of microphones, thus different boards could have different microphones. Depending on microphone type the PDMC would need to wait longer or shorter period (at startup) than the default chosen one to filter unwanted noise. Thus add microchip,startup-delay-us binding to let PDMC users to specify startup delay. Signed-off-by: Claudiu Beznea Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230228110145.3770525-3-claudiu.beznea@microchip.com Signed-off-by: Mark Brown commit 54fc4b72b630e1cb92a21140084c6852babbb234 Author: Claudiu Beznea Date: Tue Feb 28 13:01:43 2023 +0200 ASoC: soc-pcm: add option to start DMA after DAI Add option to start DMA component after DAI trigger. This is done by filling the new struct snd_soc_component_driver::start_dma_last. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230228110145.3770525-2-claudiu.beznea@microchip.com Signed-off-by: Mark Brown commit 18f51ed09888c8e48bd377d1715d4ff807b4c805 Author: Mark Brown Date: Sun Feb 26 12:49:57 2023 +0000 ASoC: mt8183: Fix event generation for I2S DAI operations ALSA control put() operations should return 0 if the value changed so that events can be generated appropriately for userspace but the custom control in the MT8183 I2S DAI driver doesn't do that, fix it. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230224-asoc-mt8183-quick-fixes-v1-2-041f29419ed5@kernel.org Signed-off-by: Mark Brown commit d71ed1c8f0f458ae6852fdab055790fe1d9d19b6 Author: Mark Brown Date: Sun Feb 26 12:49:56 2023 +0000 ASoC: mt8183: Remove spammy logging from I2S DAI driver There is a lot of dev_info() logging in normal operation in the I2S DAI driver, remove it to avoid spamming the console. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230224-asoc-mt8183-quick-fixes-v1-1-041f29419ed5@kernel.org Signed-off-by: Mark Brown commit 8cbd7273a724d4e9615b26d696bb1221a8a48e4c Author: Mark Brown Date: Sun Feb 26 12:47:58 2023 +0000 ASoC: mt6358: Remove undefined HPx Mux enumeration values The HPx Mux enumerations define values 5, 6 and 7 but describe them as "undefined" and map them to the value 0 on writing. Given the descriptions and behaviour it seems that these values are invalid and should not be present in the register, the current behaviour is detected as problematic by mixer-test: # # HPL Mux.0 expected 5 but read 0, is_volatile 0 # # HPL Mux.0 expected 6 but read 0, is_volatile 0 # # HPL Mux.0 expected 7 but read 0, is_volatile 0 Remove the values from the enumeration, this will prevent userspace setting them. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230224-asoc-mt6358-quick-fixes-v1-3-747d9186be4b@kernel.org Signed-off-by: Mark Brown commit 8e847a43c28fca0aaa11fba8f91da7dfd9d6936f Author: Mark Brown Date: Sun Feb 26 12:47:57 2023 +0000 ASoC: mt6358: Validate Wake on Voice 2 writes Currently the Wake on Voice 2 control accepts and stores any value written but it reports that only 0 and 1 are valid values. Reject any out of range values written by userspace. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230224-asoc-mt6358-quick-fixes-v1-2-747d9186be4b@kernel.org Signed-off-by: Mark Brown commit 3425ddaea57af77ca96a59a5b8eaa2f9e1b021ba Author: Mark Brown Date: Sun Feb 26 12:47:56 2023 +0000 ASoC: mt6358: Fix event generation for wake on voice stage 2 switch ALSA control put() operations should return 0 if the value changed so that events can be generated appropriately for userspace but the custom control for wake on voice stage 2 doesn't do this, fix it. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230224-asoc-mt6358-quick-fixes-v1-1-747d9186be4b@kernel.org Signed-off-by: Mark Brown commit 26a57cb35548ae67c14871cccbf50da3edb01ea4 Author: Daniel Wagner Date: Tue Feb 21 17:51:06 2023 +0100 nvme-fabrics: show well known discovery name The kernel always logs the unique subsystem name for a discovery controller, even in the case user space asked for the well known. This has lead to confusion as the logs of nvme-cli and the kernel logs didn't match. First, nvme-cli connects to the well known discovery controller to figure out if it supports TP8013. If so then nvme-cli disconnects and connects to the unique discovery controller. Currently, the kernel show that user space connected twice to the unique one. To avoid further confusion, show the well known discovery controller if user space asked for it: $ nvme connect-all -v -t tcp -a 192.168.0.1 nvme0: nqn.2014-08.org.nvmexpress.discovery connected nvme0: nqn.2014-08.org.nvmexpress.discovery disconnected nvme0: nqn.discovery connected kernel log: nvme nvme0: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 192.168.0.1:8009 nvme nvme0: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" nvme nvme0: new ctrl: NQN "nqn.discovery", addr 192.168.0.1:8009 Fixes: e5ea42faa773 ("nvme: display correct subsystem NQN") Signed-off-by: Daniel Wagner Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 76d54bf20cdcc1ed7569a89885e09636e9a8d71d Author: Akinobu Mita Date: Sun Feb 26 21:42:54 2023 +0900 nvme-tcp: don't access released socket during error recovery While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL pointer dereference by calling getsockname() with a released socket. During error recovery work, the nvme tcp socket is released and a new one created, so it is not safe to access the socket without proper check. Signed-off-by: Akinobu Mita Fixes: 02c57a82c008 ("nvme-tcp: print actual source IP address through sysfs "address" attr") Reviewed-by: Martin Belanger Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 51d24f701f453c18cb5f4596d8bbe8034e5d3fb4 Author: Dan Carpenter Date: Thu Feb 16 15:14:49 2023 +0300 nvme-auth: fix an error code in nvme_auth_process_dhchap_challenge() This function was transitioned from returning NVMe status codes to returning traditional kernel error codes. However, this particular return now accidentally returns positive error codes like ENOMEM instead of negative -ENOMEM. Fixes: b0ef1b11d390 ("nvme-auth: don't use NVMe status codes") Signed-off-by: Dan Carpenter Signed-off-by: Christoph Hellwig commit 0dd6fff2aad4e35633fef1ea72838bec5b47559a Author: Christoph Hellwig Date: Tue Feb 21 14:02:25 2023 -0800 nvme: bring back auto-removal of deleted namespaces during sequential scan Bring back the check of the Identify Namespace return value for the legacy NVMe 1.0-style sequential scanning. While NVMe 1.0 does not support namespace management, there are "modern" cloud solutions like Google Cloud Platform that claim the obsolete 1.0 compliance for no good reason while supporting proprietary sideband namespace management. Fixes: 1a893c2bfef4 ("nvme: refactor namespace probing") Reported-by: Nils Hanke Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Tested-by: Nils Hanke commit 54aa7f2330b82884f4a1afce0220add6e8312f8b Author: Joseph Qi Date: Tue Feb 28 12:54:59 2023 +0800 io_uring: fix fget leak when fs don't support nowait buffered read Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1] Do the following steps can reproduce this BUG: mount -t ocfs2 /dev/vdc /mnt/ocfs2 cp testfile /mnt/ocfs2/ ./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 umount /mnt/ocfs2 Then umount will fail, and it outputs: umount: /mnt/ocfs2: target is busy. While tracing umount, it blames mnt_get_count() not return as expected. Do a deep investigation for fget()/fput() on related code flow, I've finally found that fget() leaks since ocfs2 doesn't support nowait buffered read. io_issue_sqe |-io_assign_file // do fget() first |-io_read |-io_iter_do_read |-ocfs2_file_read_iter // return -EOPNOTSUPP |-kiocb_done |-io_rw_done |-__io_complete_rw_common // set REQ_F_REISSUE |-io_resubmit_prep |-io_req_prep_async // override req->file, leak happens This was introduced by commit a196c78b5443 in v5.18. Fix it by don't re-assign req->file if it has already been assigned. [1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t Fixes: a196c78b5443 ("io_uring: assign non-fixed early for async work") Cc: Reported-by: Heming Zhao Signed-off-by: Joseph Qi Cc: Xiaoguang Wang Link: https://lore.kernel.org/r/20230228045459.13524-1-joseph.qi@linux.alibaba.com Signed-off-by: Jens Axboe commit e33b93650fc5364f773985a3e961e24349330d97 Author: Breno Leitao Date: Tue Feb 28 03:16:54 2023 -0800 blk-iocost: Pass gendisk to ioc_refresh_params Current kernel (d2980d8d826554fa6981d621e569a453787472f8) crashes when blk_iocost_init for `nvme1` disk. BUG: kernel NULL pointer dereference, address: 0000000000000050 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page blk_iocost_init (include/asm-generic/qspinlock.h:128 include/linux/spinlock.h:203 include/linux/spinlock_api_smp.h:158 include/linux/spinlock.h:400 block/blk-iocost.c:2884) ioc_qos_write (block/blk-iocost.c:3198) ? kretprobe_perf_func (kernel/trace/trace_kprobe.c:1566) ? kernfs_fop_write_iter (include/linux/slab.h:584 fs/kernfs/file.c:311) ? __kmem_cache_alloc_node (mm/slab.h:? mm/slub.c:3452 mm/slub.c:3491) ? _copy_from_iter (arch/x86/include/asm/uaccess_64.h:46 arch/x86/include/asm/uaccess_64.h:52 lib/iov_iter.c:183 lib/iov_iter.c:628) ? kretprobe_dispatcher (kernel/trace/trace_kprobe.c:1693) cgroup_file_write (kernel/cgroup/cgroup.c:4061) kernfs_fop_write_iter (fs/kernfs/file.c:334) vfs_write (include/linux/fs.h:1849 fs/read_write.c:491 fs/read_write.c:584) ksys_write (fs/read_write.c:637) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) This happens because ioc_refresh_params() is being called without a properly initialized ioc->rqos, which is happening later in the callee side. ioc_refresh_params() -> ioc_autop_idx() tries to access ioc->rqos.disk->queue but ioc->rqos.disk is NULL, causing the BUG above. Create function, called ioc_refresh_params_disk(), that is similar to ioc_refresh_params() but where the "struct gendisk" could be passed as an explicit argument. This function will be called when ioc->rqos.disk is not initialized. Fixes: ce57b558604e ("blk-rq-qos: make rq_qos_add and rq_qos_del more useful") Signed-off-by: Breno Leitao Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20230228111654.1778120-1-leitao@debian.org Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 9b5c37bbf659fe4edb4804bc0aa99840d6798878 Author: Vasily Gorbik Date: Wed Sep 16 13:00:18 2020 +0200 s390/decompressor: add link map saving Produce arch/s390/boot/vmlinux.map link map for the decompressor, when CONFIG_VMLINUX_MAP option is enabled. Link map is quite useful during making kernel changes related to how the decompressor is composed and debugging linker scripts. Acked-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit e688c6255b742428ea8fa7e4fb8181a6135205e9 Author: Heiko Carstens Date: Mon Feb 27 18:56:10 2023 +0100 s390/smp: perform cpu reset before delegating work to target cpu Clear CPU state (e.g. all TLB entries, prefetched instructions, etc.) of the target CPU, however without clearing register contents before starting any work on it. This puts the target CPU in a more defined state compared to the current Stop + Restart sigp orders. Signed-off-by: Heiko Carstens commit e7ec1d2eac9cad57ff615ef6cc3e324ab7238b82 Author: Alexander Gordeev Date: Sat Dec 17 11:01:16 2022 +0100 s390/mcck: cleanup user process termination path If a machine check interrupt hits while user process is running __s390_handle_mcck() helper function is called directly from the interrupt handler and terminates the current process by calling make_task_dead() routine. The make_task_dead() is not allowed to be called from interrupt context which forces the machine check handler switch to the kernel stack and enable local interrupts first. The __s390_handle_mcck() could also be called to service pending work, but this time from the external interrupts handler. It is the machine check handler that establishes the work and schedules the external interrupt, therefore the machine check interrupt itself should be disabled while reading out the corresponding variable: local_mcck_disable(); mcck = *this_cpu_ptr(&cpu_mcck); memset(this_cpu_ptr(&cpu_mcck), 0, sizeof(mcck)); local_mcck_enable(); However, local_mcck_disable() does not have effect when __s390_handle_mcck() is called directly form the machine check handler, since the machine check interrupt is still disabled. Therefore, it is not the opening bracket to the following local_mcck_enable() function. Simplify the user process termination flow by scheduling the external interrupt and killing the affected process from the interrupt context. Assume a kernel-generated signal is always delivered and ignore a value returned by do_send_sig_info() funciton. Reviewed-by: Heiko Carstens Reviewed-by: Sven Schnelle Signed-off-by: Alexander Gordeev Signed-off-by: Heiko Carstens commit 5e02c74905cb00184b6c5ae70b1c1bfae5b3bd17 Author: Heiko Carstens Date: Fri Feb 24 11:02:37 2023 +0100 s390/cpum_sf: use READ_ONCE_ALIGNED_128() instead of 128-bit cmpxchg Use READ_ONCE_ALIGNED_128() to read the previous value in front of a 128-bit cmpxchg loop, instead of (mis-)using a 128-bit cmpxchg operation to do the same. This makes the code more readable and is faster. Link: https://lore.kernel.org/r/20230224100237.3247871-3-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit 434b26605f6cc500c1a995587e5c4bc4bc1693c6 Author: Heiko Carstens Date: Fri Feb 24 11:02:36 2023 +0100 s390/rwonce: add READ_ONCE_ALIGNED_128() macro Add an s390 specific READ_ONCE_ALIGNED_128() helper, which can be used for fast block concurrent (atomic) 128-bit accesses. The used lpq instruction requires 128-bit alignment. This is also the reason why the compiler doesn't emit this instruction if __READ_ONCE() is used for 128-bit accesses. Link: https://lore.kernel.org/r/20230224100237.3247871-2-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit 8f9850dd8d23c1290cb642ce9548a440da5771ec Author: Dan Carpenter Date: Mon Feb 27 13:03:22 2023 +0300 net: phy: unlock on error in phy_probe() If genphy_c45_read_eee_adv() fails then we need to do a reset and unlock the &phydev->lock mutex before returning. Fixes: 3eeca4e199ce ("net: phy: do not force EEE support") Signed-off-by: Dan Carpenter Reviewed-by: Oleksij Rempel Link: https://lore.kernel.org/r/Y/x/6kHCjnQHqOpF@kili Signed-off-by: Paolo Abeni commit 010338d729c1090036eb40d2a60b7b7bce2445b8 Author: Ard Biesheuvel Date: Thu Feb 23 21:41:01 2023 +0100 arm64: kaslr: don't pretend KASLR is enabled if offset < MIN_KIMG_ALIGN Our virtual KASLR displacement is a randomly chosen multiple of 2 MiB plus an offset that is equal to the physical placement modulo 2 MiB. This arrangement ensures that we can always use 2 MiB block mappings (or contiguous PTE mappings for 16k or 64k pages) to map the kernel. This means that a KASLR offset of less than 2 MiB is simply the product of this physical displacement, and no randomization has actually taken place. Currently, we use 'kaslr_offset() > 0' to decide whether or not randomization has occurred, and so we misidentify this case. If the kernel image placement is not randomized, modules are allocated from a dedicated region below the kernel mapping, which is only used for modules and not for other vmalloc() or vmap() calls. When randomization is enabled, the kernel image is vmap()'ed randomly inside the vmalloc region, and modules are allocated in the vicinity of this mapping to ensure that relative references are always in range. However, unlike the dedicated module region below the vmalloc region, this region is not reserved exclusively for modules, and so ordinary vmalloc() calls may end up overlapping with it. This should rarely happen, given that vmalloc allocates bottom up, although it cannot be ruled out entirely. The misidentified case results in a placement of the kernel image within 2 MiB of its default address. However, the logic that randomizes the module region is still invoked, and this could result in the module region overlapping with the start of the vmalloc region, instead of using the dedicated region below it. If this happens, a single large vmalloc() or vmap() call will use up the entire region, and leave no space for loading modules after that. Since commit 82046702e288 ("efi/libstub/arm64: Replace 'preferred' offset with alignment check"), this is much more likely to occur on systems that boot via EFI but lack an implementation of the EFI RNG protocol, as in that case, the EFI stub will decide to leave the image where it found it, and the EFI firmware uses 64k alignment only. Fix this, by correctly identifying the case where the virtual displacement is a result of the physical displacement only. Signed-off-by: Ard Biesheuvel Reviewed-by: Mark Brown Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20230223204101.1500373-1-ardb@kernel.org Signed-off-by: Catalin Marinas commit d5c514b6a0c0b77ed7e5ef2484e8b20eb09c5f27 Author: Yuezhang Mo Date: Fri Feb 10 13:33:44 2023 +0800 exfat: fix the newly allocated clusters are not freed in error handling In error handling 'free_cluster', before num_alloc clusters allocated, p_chain->size will not updated and always 0, thus the newly allocated clusters are not freed. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 3ce937cb8ca9becec406611c6072e93030fdde76 Author: Yuezhang Mo Date: Thu Feb 9 17:44:50 2023 +0800 exfat: don't print error log in normal case When allocating a new cluster, exFAT first allocates from the next cluster of the last cluster of the file. If the last cluster of the file is the last cluster of the volume, allocate from the first cluster. This is a normal case, but the following error log will be printed. It makes users confused, so this commit removes the error log. [1960905.181545] exFAT-fs (sdb1): hint_cluster is invalid (262130) Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 8d2909eeca5ef41f64365f700b1fdde361086609 Author: Yuezhang Mo Date: Mon Feb 6 18:25:20 2023 +0800 exfat: remove unneeded code from exfat_alloc_cluster() In the removed code, num_clusters is 0, nothing is done in exfat_chain_cont_cluster(), so it is unneeded, remove it. Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 11f180a5d62a51b484e9648f9b310e1bd50b1a57 Author: Kang Chen Date: Mon Feb 27 17:30:37 2023 +0800 nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause out-of-bounds write in device_property_read_u8_array later. Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver") Signed-off-by: Kang Chen Reviewed-by: Krzysztof Kozlowski Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230227093037.907654-1-void0red@gmail.com Signed-off-by: Paolo Abeni commit f99e6d7c4ed3be2531bd576425a5bd07fb133bd7 Author: Rafał Miłecki Date: Mon Feb 27 10:11:56 2023 +0100 bgmac: fix *initial* chip reset to support BCM5358 While bringing hardware up we should perform a full reset including the switch bit (BGMAC_BCMA_IOCTL_SW_RESET aka SICF_SWRST). It's what specification says and what reference driver does. This seems to be critical for the BCM5358. Without this hardware doesn't get initialized properly and doesn't seem to transmit or receive any packets. Originally bgmac was calling bgmac_chip_reset() before setting "has_robosw" property which resulted in expected behaviour. That has changed as a side effect of adding platform device support which regressed BCM5358 support. Fixes: f6a95a24957a ("net: ethernet: bgmac: Add platform device support") Cc: Jon Mason Signed-off-by: Rafał Miłecki Reviewed-by: Leon Romanovsky Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230227091156.19509-1-zajec5@gmail.com Signed-off-by: Paolo Abeni commit b3f11af9b2ce14d4662753d097a21e1d37a06fda Author: Mark Rutland Date: Mon Feb 27 11:58:19 2023 +0000 arm64: ftrace: forbid CALL_OPS with CC_OPTIMIZE_FOR_SIZE Florian reports that when building with CONFIG_CC_OPTIMIZE_FOR_SIZE=y, he sees "Misaligned patch-site" warnings at boot, e.g. | Misaligned patch-site bcm2836_arm_irqchip_handle_irq+0x0/0x88 | WARNING: CPU: 0 PID: 0 at arch/arm64/kernel/ftrace.c:120 ftrace_call_adjust+0x4c/0x70 This is because GCC will silently ignore `-falign-functions=N` when passed `-Os`, resulting in functions not being aligned as we expect. This is a known issue, and to account for this we modified the kernel to avoid `-Os` generally. Unfortunately we forgot to account for CONFIG_CC_OPTIMIZE_FOR_SIZE. Forbid the use of CALL_OPS with CONFIG_CC_OPTIMIZE_FOR_SIZE=y to prevent this issue. All exising ftrace features will work as before, though without the performance benefit of CALL_OPS. Reported-by: Florian Fainelli Link: http://lore.kernel.org/linux-arm-kernel/2d9284c3-3805-402b-5423-520ced56d047@gmail.com Signed-off-by: Mark Rutland Cc: Marc Zyngier Cc: Stefan Wahren Cc: Steven Rostedt Cc: Will Deacon Tested-by: Florian Fainelli Link: https://lore.kernel.org/r/20230227115819.365630-1-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit 047a754558d640eaa080fce3b22ca9f3d4e04626 Author: Asahi Lina Date: Mon Feb 27 18:04:21 2023 +0900 drm/shmem-helper: Revert accidental non-GPL export The referenced commit added a wrapper for drm_gem_shmem_get_pages_sgt(), but in the process it accidentally changed the export type from GPL to non-GPL. Switch it back to GPL. Reported-by: Dmitry Osipenko Fixes: ddddedaa0db9 ("drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()") Signed-off-by: Asahi Lina Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230227-shmem-export-fix-v1-1-8880b2c25e81@asahilina.net commit c176060a4c76ed0043cb9c10435af04ed1ad0560 Author: Nathan Chancellor Date: Fri Feb 24 10:25:12 2023 -0700 drm: omapdrm: Do not use helper unininitialized in omap_fbdev_init() Clang warns (or errors with CONFIG_WERROR): ../drivers/gpu/drm/omapdrm/omap_fbdev.c:235:6: error: variable 'helper' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] if (!fbdev) ^~~~~~ ../drivers/gpu/drm/omapdrm/omap_fbdev.c:259:26: note: uninitialized use occurs here drm_fb_helper_unprepare(helper); ^~~~~~ ../drivers/gpu/drm/omapdrm/omap_fbdev.c:235:2: note: remove the 'if' if its condition is always false if (!fbdev) ^~~~~~~~~~~ ../drivers/gpu/drm/omapdrm/omap_fbdev.c:228:30: note: initialize the variable 'helper' to silence this warning struct drm_fb_helper *helper; ^ = NULL 1 error generated. Return early, as there is nothing for the function to do if memory cannot be allocated. There is no point in adding another label to just emit the warning at the end of the function in this case, as memory allocation failures are already logged. Fixes: 3fb1f62f80a1 ("drm/fb-helper: Remove drm_fb_helper_unprepare() from drm_fb_helper_fini()") Link: https://github.com/ClangBuiltLinux/linux/issues/1809 Link: https://lore.kernel.org/oe-kbuild-all/202302250058.fYTe9aTP-lkp@intel.com/ Reported-by: kernel test robot Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230224-omapdrm-wsometimes-uninitialized-v1-1-3fec8906ee3a@kernel.org commit 660ca9470f9c613fa2c71a123a9469c80a697ee4 Author: Herbert Xu Date: Mon Feb 27 16:25:58 2023 +0800 crypto: caam - Fix edesc/iv ordering mixup The attempt to add DMA alignment padding by moving IV to the front of edesc was completely broken as it didn't change the places where edesc was freed. It's also wrong as the IV may still share a cache-line with the edesc. Fix this by restoring the original layout and simply reserving enough memmory so that the IV is on a DMA cache-line by itself. Reported-by: Meenakshi Aggarwal Fixes: 199354d7fb6e ("crypto: caam - Remove GFP_DMA and add DMA alignment padding") Signed-off-by: Herbert Xu commit 77bc762451c2dc72bdbea07b857c916c9e7f4952 Author: Dan Carpenter Date: Mon Feb 27 13:33:30 2023 +0300 fbdev: chipsfb: Fix error codes in chipsfb_pci_init() The error codes are not set on these error paths. Fixes: 145eed48de27 ("fbdev: Remove conflicting devices on PCI bus") Signed-off-by: Dan Carpenter Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/Y/yG+sm2mhdJeTZW@kili commit f8b2336f15f3bc30e37ce5c052cde5b6319bb6df Author: Michael Ellerman Date: Wed Feb 22 00:03:31 2023 +1100 powerpc: Avoid dead code/data elimination when using recordmcount Although powerpc now has objtool mcount support, it's not enabled in all configurations due to dependencies. On those configurations, with some linkers (binutils 2.37 at least), it's still possible to hit the dreaded "recordmcount bug", eg. errors such as: CC kernel/kexec_file.o Cannot find symbol for section 10: .text.unlikely. kernel/kexec_file.o: failed make[1]: *** [scripts/Makefile.build:287 : kernel/kexec_file.o] Error 1 Those errors are much more prevalent when building with CONFIG_LD_DEAD_CODE_DATA_ELIMINATION, because it places every function in a separate section. CONFIG_LD_DEAD_CODE_DATA_ELIMINATION is marked experimental and is not enabled in any powerpc defconfigs or by major distros. Although it does have at least some users on 32-bit where kernel size tends to be more important. Avoid the build errors by blocking CONFIG_LD_DEAD_CODE_DATA_ELIMINATION when the build is using recordmcount, rather than objtool. In practice that means for 64-bit big endian builds, or 64-bit clang builds - both because they lack CONFIG_MPROFILE_KERNEL. On 32-bit objtool is always used, so CONFIG_LD_DEAD_CODE_DATA_ELIMINATION is still available there. Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230221130331.2714199-1-mpe@ellerman.id.au commit acd35dbab871d61021284ff06daccdc0ebb51e61 Author: Michael Ellerman Date: Wed Feb 22 17:00:37 2023 +1100 powerpc/vmlinux.lds: Add .text.asan/tsan sections When KASAN/KCSAN are enabled clang generates .text.asan/tsan sections. Because they are not mentioned in the linker script warnings are generated, and when orphan handling is set to error that becomes a build error, eg: ld.lld: error: vmlinux.a(init/main.o):(.text.tsan.module_ctor) is being placed in '.text.tsan.module_ctor' ld.lld: error: vmlinux.a(init/version.o):(.text.tsan.module_ctor) is being placed in '.text.tsan.module_ctor' Fix it by adding the sections to our linker script, similar to the generic change made in 848378812e40 ("vmlinux.lds.h: Handle clang's module.{c,d}tor sections"). Reviewed-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230222060037.2897169-1-mpe@ellerman.id.au commit d8c32853ebc4f3a49f1658ddfe0a9a42e19fc658 Author: Michael Ellerman Date: Tue Feb 21 21:19:52 2023 +1100 powerpc: Drop orphaned VAS MAINTAINERS entry The MAINTAINERS entry for VAS (Virtual Accelerator Switchboard) no longer has any maintainers, it just points to linuxppc-dev, since commit 60496069d0ae ("powerpc: Update MAINTAINERS for ibmvnic and VAS"). So just drop the VAS entry, all the paths are already covered by the main powerpc entry, ie. the output of get_maintainer.pl is unchanged. Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230221101952.2697101-1-mpe@ellerman.id.au commit ae3419fbac845b4d3f3a9fae4cc80c68d82cdf6e Author: Thomas Weißschuh Date: Mon Feb 20 06:46:12 2023 +0000 vc_screen: don't clobber return value in vcs_read Commit 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") moved the call to vcs_vc() into the loop. While doing this it also moved the unconditional assignment of ret = -ENXIO; This unconditional assignment was valid outside the loop but within it it clobbers the actual value of ret. To avoid this only assign "ret = -ENXIO" when actually needed. [ Also, the 'goto unlock_out" needs to be just a "break", so that it does the right thing when it exits on later iterations when partial success has happened - Linus ] Reported-by: Storm Dragon Link: https://lore.kernel.org/lkml/Y%2FKS6vdql2pIsCiI@hotmail.com/ Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/lkml/64981d94-d00c-4b31-9063-43ad0a384bde@t-8ch.de/ Signed-off-by: Linus Torvalds commit 236b9254f8d1edc273ad88b420aa85fbd84f492d Author: Heming Zhao via Ocfs2-devel Date: Mon Feb 20 13:05:26 2023 +0800 ocfs2: fix non-auto defrag path not working issue This fixes three issues on move extents ioctl without auto defrag: a) In ocfs2_find_victim_alloc_group(), we have to convert bits to block first in case of global bitmap. b) In ocfs2_probe_alloc_group(), when finding enough bits in block group bitmap, we have to back off move_len to start pos as well, otherwise it may corrupt filesystem. c) In ocfs2_ioctl_move_extents(), set me_threshold both for non-auto and auto defrag paths. Otherwise it will set move_max_hop to 0 and finally cause unexpectedly ENOSPC error. Currently there are no tools triggering the above issues since defragfs.ocfs2 enables auto defrag by default. Tested with manually changing defragfs.ocfs2 to run non auto defrag path. Link: https://lkml.kernel.org/r/20230220050526.22020-1-heming.zhao@suse.com Signed-off-by: Heming Zhao Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 60eed1e3d45045623e46944ebc7c42c30a4350f0 Author: Heming Zhao via Ocfs2-devel Date: Fri Feb 17 08:37:17 2023 +0800 ocfs2: fix defrag path triggering jbd2 ASSERT code path: ocfs2_ioctl_move_extents ocfs2_move_extents ocfs2_defrag_extent __ocfs2_move_extent + ocfs2_journal_access_di + ocfs2_split_extent //sub-paths call jbd2_journal_restart + ocfs2_journal_dirty //crash by jbs2 ASSERT crash stacks: PID: 11297 TASK: ffff974a676dcd00 CPU: 67 COMMAND: "defragfs.ocfs2" #0 [ffffb25d8dad3900] machine_kexec at ffffffff8386fe01 #1 [ffffb25d8dad3958] __crash_kexec at ffffffff8395959d #2 [ffffb25d8dad3a20] crash_kexec at ffffffff8395a45d #3 [ffffb25d8dad3a38] oops_end at ffffffff83836d3f #4 [ffffb25d8dad3a58] do_trap at ffffffff83833205 #5 [ffffb25d8dad3aa0] do_invalid_op at ffffffff83833aa6 #6 [ffffb25d8dad3ac0] invalid_op at ffffffff84200d18 [exception RIP: jbd2_journal_dirty_metadata+0x2ba] RIP: ffffffffc09ca54a RSP: ffffb25d8dad3b70 RFLAGS: 00010207 RAX: 0000000000000000 RBX: ffff9706eedc5248 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffff97337029ea28 RDI: ffff9706eedc5250 RBP: ffff9703c3520200 R8: 000000000f46b0b2 R9: 0000000000000000 R10: 0000000000000001 R11: 00000001000000fe R12: ffff97337029ea28 R13: 0000000000000000 R14: ffff9703de59bf60 R15: ffff9706eedc5250 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffb25d8dad3ba8] ocfs2_journal_dirty at ffffffffc137fb95 [ocfs2] #8 [ffffb25d8dad3be8] __ocfs2_move_extent at ffffffffc139a950 [ocfs2] #9 [ffffb25d8dad3c80] ocfs2_defrag_extent at ffffffffc139b2d2 [ocfs2] Analysis This bug has the same root cause of 'commit 7f27ec978b0e ("ocfs2: call ocfs2_journal_access_di() before ocfs2_journal_dirty() in ocfs2_write_end_nolock()")'. For this bug, jbd2_journal_restart() is called by ocfs2_split_extent() during defragmenting. How to fix For ocfs2_split_extent() can handle journal operations totally by itself. Caller doesn't need to call journal access/dirty pair, and caller only needs to call journal start/stop pair. The fix method is to remove journal access/dirty from __ocfs2_move_extent(). The discussion for this patch: https://oss.oracle.com/pipermail/ocfs2-devel/2023-February/000647.html Link: https://lkml.kernel.org/r/20230217003717.32469-1-heming.zhao@suse.com Signed-off-by: Heming Zhao Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit d49b497060387545ca10210590adef6edb296583 Author: Konrad Dybcio Date: Fri Feb 17 21:35:16 2023 +0100 mailmap: map Georgi Djakov's old Linaro address to his current one Georgi's old email is still picked up by the likes of get_maintainer.pl and it keeps bouncing every time one submits an interconnect patch. Map it to his current @kernel.org one. Link: https://lkml.kernel.org/r/20230217203516.826424-1-konrad.dybcio@linaro.org Signed-off-by: Konrad Dybcio Acked-by: Georgi Djakov Cc: Arnd Bergmann Cc: Baolin Wang Cc: Colin Ian King Cc: Kirill Tkhai Cc: Qais Yousef Cc: Vasily Averin Signed-off-by: Andrew Morton commit 6da6b1d4a7df8c35770186b53ef65d388398e139 Author: Naoya Horiguchi Date: Tue Feb 21 17:59:05 2023 +0900 mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON After a memory error happens on a clean folio, a process unexpectedly receives SIGBUS when it accesses the error page. This SIGBUS killing is pointless and simply degrades the level of RAS of the system, because the clean folio can be dropped without any data lost on memory error handling as we do for a clean pagecache. When memory_failure() is called on a clean folio, try_to_unmap() is called twice (one from split_huge_page() and one from hwpoison_user_mappings()). The root cause of the issue is that pte conversion to hwpoisoned entry is now done in the first call of try_to_unmap() because PageHWPoison is already set at this point, while it's actually expected to be done in the second call. This behavior disturbs the error handling operation like removing pagecache, which results in the malfunction described above. So convert TTU_IGNORE_HWPOISON into TTU_HWPOISON and set TTU_HWPOISON only when we really intend to convert pte to hwpoison entry. This can prevent other callers of try_to_unmap() from accidentally converting to hwpoison entries. Link: https://lkml.kernel.org/r/20230221085905.1465385-1-naoya.horiguchi@linux.dev Fixes: a42634a6c07d ("readahead: Use a folio in read_pages()") Signed-off-by: Naoya Horiguchi Cc: David Hildenbrand Cc: Hugh Dickins Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Minchan Kim Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 1c0a0af511effbd75beffa6c5e54fd64d3563860 Author: Mikhail Zaslonko Date: Tue Feb 21 14:16:17 2023 +0100 lib/zlib: DFLTCC deflate does not write all available bits for Z_NO_FLUSH DFLTCC deflate with Z_NO_FLUSH might generate a corrupted stream when the output buffer is not large enough to fit all the deflate output at once. The problem takes place on closing the deflate block since flush_pending() might leave some output bits not written. Similar problem for software deflate with Z_BLOCK flush option (not supported by kernel zlib deflate) has been fixed a while ago in userspace zlib but the fix never got to the kernel. Now flush_pending() flushes the bit buffer before copying out the byte buffer, in order to really flush as much as possible. Currently there are no users of DFLTCC deflate with Z_NO_FLUSH option in the kernel so the problem remained hidden for a while. This commit is based on the old zlib commit: https://github.com/madler/zlib/commit/0b828b4 Link: https://lkml.kernel.org/r/20230221131617.3369978-2-zaslonko@linux.ibm.com Signed-off-by: Mikhail Zaslonko Acked-by: Ilya Leoshkevich Cc: Heiko Carstens Cc: Vasily Gorbik Signed-off-by: Andrew Morton commit 3f98c9a62c338bbe06a215c9491e6166ea39bf82 Author: andrew.yang Date: Wed Feb 22 14:42:20 2023 +0800 mm/damon/paddr: fix missing folio_put() damon_get_folio() would always increase folio _refcount and folio_isolate_lru() would increase folio _refcount if the folio's lru flag is set. If an unevictable folio isolated successfully, there will be two more _refcount. The one from folio_isolate_lru() will be decreased in folio_puback_lru(), but the other one from damon_get_folio() will be left behind. This causes a pin page. Whatever the case, the _refcount from damon_get_folio() should be decreased. Link: https://lkml.kernel.org/r/20230222064223.6735-1-andrew.yang@mediatek.com Fixes: 57223ac29584 ("mm/damon/paddr: support the pageout scheme") Signed-off-by: andrew.yang Reviewed-by: SeongJae Park Cc: [5.16.x] Signed-off-by: Andrew Morton commit 4c6759967826b87f56c73e0f1deb7b76379ccd23 Author: Vlastimil Babka Date: Mon Feb 27 17:00:14 2023 -0800 mm/mremap: fix dup_anon_vma() in vma_merge() case 4 In case 4, we are shrinking 'prev' (PPPP in the comment) and expanding 'mid' (NNNN). So we need to make sure 'mid' clones the anon_vma from 'prev', if it doesn't have any. After commit 0503ea8f5ba7 ("mm/mmap: remove __vma_adjust()") we can fail to do that due to wrong parameters for dup_anon_vma(). The call is a no-op because res == next, adjust == mid and mid == next. Fix it. Link: https://lkml.kernel.org/r/ad91d62b-37eb-4b73-707a-3c45c9e16256@suse.cz Fixes: 0503ea8f5ba7 ("mm/mmap: remove __vma_adjust()") Signed-off-by: Vlastimil Babka Reviewed-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 981ee95cc1f5905ae4936b0dd501085909cdc14f Author: Mateusz Guzik Date: Wed Jan 25 16:55:57 2023 +0100 vfs: avoid duplicating creds in faccessat if possible access(2) remains commonly used, for example on exec: access("/etc/ld.so.preload", R_OK) or when running gcc: strace -c gcc empty.c % time seconds usecs/call calls errors syscall ------ ----------- ----------- --------- --------- ---------------- 0.00 0.000000 0 42 26 access It falls down to do_faccessat without the AT_EACCESS flag, which in turn results in allocation of new creds in order to modify fsuid/fsgid and caps. This is a very expensive process single-threaded and most notably multi-threaded, with numerous structures getting refed and unrefed on imminent new cred destruction. Turns out for typical consumers the resulting creds would be identical and this can be checked upfront, avoiding the hard work. An access benchmark plugged into will-it-scale running on Cascade Lake shows: test proc before after access1 1 1310582 2908735 (+121%) # distinct files access1 24 4716491 63822173 (+1353%) # distinct files access2 24 2378041 5370335 (+125%) # same file The above benchmarks are not integrated into will-it-scale, but can be found in a pull request: https://github.com/antonblanchard/will-it-scale/pull/36/files Signed-off-by: Mateusz Guzik Cc: Al Viro Signed-off-by: Linus Torvalds commit a4eecbae092759537748360299de03e434c9a956 Author: Mateusz Guzik Date: Wed Jan 25 16:55:56 2023 +0100 capability: add cap_isidentical Signed-off-by: Mateusz Guzik Reviewed-by: Serge Hallyn Cc: Al Viro Signed-off-by: Linus Torvalds commit 103830683cfc8f43b15158b0a48014b6d6e83633 Merge: 46d733d0efc79 ddf1eca4fc5a4 Author: Linus Torvalds Date: Mon Feb 27 16:18:51 2023 -0800 Merge tag 'f2fs-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've got a huge number of patches that improve code readability along with minor bug fixes, while we've mainly fixed some critical issues in recently-added per-block age-based extent_cache, atomic write support, and some folio cases. Enhancements: - add sysfs nodes to set last_age_weight and manage discard_io_aware_gran - show ipu policy in debugfs - reduce stack memory cost by using bitfield in struct f2fs_io_info - introduce trace_f2fs_replace_atomic_write_block - enhance iostat support and adds flush commands Bug fixes: - revert "f2fs: truncate blocks in batch in __complete_revoke_list()" - fix kernel crash on the atomic write abort flow - call clear_page_private_reference in .{release,invalid}_folio - support .migrate_folio for compressed inode - fix cgroup writeback accounting with fs-layer encryption - retry to update the inode page given data corruption - fix kernel crash due to NULL io->bio - fix some bugs in per-block age-based extent_cache: - wrong calculation of block age - update age extent in f2fs_do_zero_range() - update age extent correctly during truncation" * tag 'f2fs-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (81 commits) f2fs: drop unnecessary arg for f2fs_ioc_*() f2fs: Revert "f2fs: truncate blocks in batch in __complete_revoke_list()" f2fs: synchronize atomic write aborts f2fs: fix wrong segment count f2fs: replace si->sbi w/ sbi in stat_show() f2fs: export ipu policy in debugfs f2fs: make kobj_type structures constant f2fs: fix to do sanity check on extent cache correctly f2fs: add missing description for ipu_policy node f2fs: fix to set ipu policy f2fs: fix typos in comments f2fs: fix kernel crash due to null io->bio f2fs: use iostat_lat_type directly as a parameter in the iostat_update_and_unbind_ctx() f2fs: add sysfs nodes to set last_age_weight f2fs: fix f2fs_show_options to show nogc_merge mount option f2fs: fix cgroup writeback accounting with fs-layer encryption f2fs: fix wrong calculation of block age f2fs: fix to update age extent in f2fs_do_zero_range() f2fs: fix to update age extent correctly during truncation f2fs: fix to avoid potential memory corruption in __update_iostat_latency() ... commit 46d733d0efc79bc8430d63b57ab88011806d5180 Author: George Kennedy Date: Mon Feb 27 15:21:41 2023 -0500 vc_screen: modify vcs_size() handling in vcs_read() Restore the vcs_size() handling in vcs_read() to what it had been in previous version. Fixes: 226fae124b2d ("vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF") Suggested-by: Jiri Slaby Signed-off-by: George Kennedy Signed-off-by: Linus Torvalds commit 32ff6831cdecd828bd8be9cdfb6c4a3d1feb8f8a Author: David Gow Date: Sat Feb 25 09:45:30 2023 +0800 kunit: Fix 'hooks.o' build by recursing into kunit KUnit's 'hooks.o' file need to be built-in whenever KUnit is enabled (even if CONFIG_KUNIT=m). We'd previously attemtped to do this by adding 'kunit/hooks.o' to obj-y in lib/Makefile, but this caused hooks.c to be rebuilt even when it was unchanged. Instead, always recurse into lib/kunit using obj-y when KUnit is enabled, and add the hooks there. Fixes: 7170b7ed6acb ("kunit: Add "hooks" to call into KUnit when it's built as a module"). Reported-by: Linus Torvalds Link: https://lore.kernel.org/linux-kselftest/CAHk-=wiEf7irTKwPJ0jTMOF3CS-13UXmF6Fns3wuWpOZ_wGyZQ@mail.gmail.com/ Signed-off-by: David Gow Reviewed-by: Brendan Higgins Signed-off-by: Linus Torvalds commit 27fd82726995bd75b68df9ce6a1eda8f6b3ad498 Author: Arınç ÜNAL Date: Tue Feb 21 12:24:35 2023 +0300 mips: ralink: make SOC_MT7621 select PINCTRL Currently, out of every Ralink SoC, only the dt-binding of the MT7621 SoC uses pinctrl. Because of this, PINCTRL is not selected at all. Make SOC_MT7621 select PINCTRL. Remove PINCTRL_MT7621, enabling it for the MT7621 SoC will be handled under the PINCTRL_MT7621 option. Signed-off-by: Arınç ÜNAL Acked-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit f2b95d7a9fa43bd72d442a9df01e29274b1769b2 Author: Arınç ÜNAL Date: Tue Feb 21 12:24:34 2023 +0300 mips: remove SYS_HAS_CPU_MIPS32_R1 from RALINK All MIPS processors on the Ralink SoCs implement the MIPS32 Release 2 Architecture. Remove SYS_HAS_CPU_MIPS32_R1. Signed-off-by: Arınç ÜNAL Acked-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 5ae7e037de566c3106c0fa951bbf35fd6370fdf6 Author: Jiaxun Yang Date: Mon Feb 27 18:46:14 2023 +0000 MIPS: cevt-r4k: Offset the value used to clear compare interrupt In c0_compare_int_usable we clear compare interrupt by write value just read out from counter to compare register. However sometimes if those all instructions are graduated together then it's possible that at the time compare register is written, the counter haven't progressed, thus the interrupt is triggered again. It also applies to QEMU that instructions is executed significantly faster then counter. Offset the value used to clear interrupt by one to prevent that happen. Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit fea8826d5fdc4ff5c93e883a738597129614039c Author: Jiaxun Yang Date: Mon Feb 27 18:46:13 2023 +0000 MIPS: smp-cps: Don't rely on CP0_CMGCRBASE CP0_CMGCRBASE is not always available on CPS enabled system such as early proAptiv. For early SMP bring up where we can't safely access memeory, we patch the entry of CPS NMI vector to inject CMGCR address directly into register during early core bringup. For VPE bringup as the core is already coherenct at that point we just read the variable to obtain the address. Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 5ca26d6039a6b42341f7f5cc8d10d30ca1561a7b Merge: 982818426a0ff 580f98cc33a26 Author: Linus Torvalds Date: Mon Feb 27 14:05:08 2023 -0800 Merge tag 'net-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless and netfilter. The notable fixes here are the EEE fix which restores boot for many embedded platforms (real and QEMU); WiFi warning suppression and the ICE Kconfig cleanup. Current release - regressions: - phy: multiple fixes for EEE rework - wifi: wext: warn about usage only once - wifi: ath11k: allow system suspend to survive ath11k Current release - new code bugs: - mlx5: Fix memory leak in IPsec RoCE creation - ibmvnic: assign XPS map to correct queue index Previous releases - regressions: - netfilter: ip6t_rpfilter: Fix regression with VRF interfaces - netfilter: ctnetlink: make event listener tracking global - nf_tables: allow to fetch set elements when table has an owner - mlx5: - fix skb leak while fifo resync and push - fix possible ptp queue fifo use-after-free Previous releases - always broken: - sched: fix action bind logic - ptp: vclock: use mutex to fix "sleep on atomic" bug if driver also uses a mutex - netfilter: conntrack: fix rmmod double-free race - netfilter: xt_length: use skb len to match in length_mt6, avoid issues with BIG TCP Misc: - ice: remove unnecessary CONFIG_ICE_GNSS - mlx5e: remove hairpin write debugfs files - sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy" * tag 'net-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (53 commits) tcp: tcp_check_req() can be called from process context net: phy: c45: fix network interface initialization failures on xtensa, arm:cubieboard xen-netback: remove unused variables pending_idx and index net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy net: dsa: ocelot_ext: remove unnecessary phylink.h include net: mscc: ocelot: fix duplicate driver name error net: dsa: felix: fix internal MDIO controller resource length net: dsa: seville: ignore mscc-miim read errors from Lynx PCS net/sched: act_sample: fix action bind logic net/sched: act_mpls: fix action bind logic net/sched: act_pedit: fix action bind logic wifi: wext: warn about usage only once wifi: mt76: usb: fix use-after-free in mt76u_free_rx_queue qede: avoid uninitialized entries in coal_entry array nfc: fix memory leak of se_io context in nfc_genl_se_io ice: remove unnecessary CONFIG_ICE_GNSS net/sched: cls_api: Move call to tcf_exts_miss_cookie_base_destroy() ibmvnic: Assign XPS map to correct queue index docs: net: fix inaccuracies in msg_zerocopy.rst tools: net: add __pycache__ to gitignore ... commit fb5b855d9f34927579baa0a20b4d0d8ea3740abd Author: Chuck Lever Date: Mon Feb 27 11:52:59 2023 -0500 SUNRPC: Properly terminate test case arrays Unable to handle kernel paging request at virtual address 73657420 when execute [73657420] *pgd=00000000 Internal error: Oops: 80000005 [#1] ARM CPU: 0 PID: 1 Comm: swapper Tainted: G N 6.2.0-rc7-00133-g373f26a81164-dirty #9 Hardware name: Generic DT based system PC is at 0x73657420 LR is at kunit_run_tests+0x3e0/0x5f4 On x86 with GCC 12, the missing array terminators did not seem to matter. Other platforms appear to be more picky. Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Chuck Lever commit fe90151c3cc6dbc0836723995f65d371ef4ad514 Author: Chuck Lever Date: Mon Feb 27 10:58:34 2023 -0500 SUNRPC: Let Kunit tests run with some enctypes compiled out Allow the new GSS Kerberos encryption type test suites to run outside of the kunit infrastructure. Replace the assertion that fires when lookup_enctype() so that the case is skipped instead of failing outright. Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Chuck Lever commit 2d311f480b52eeb2e1fd432d64b78d82952c3808 Author: Randy Dunlap Date: Sun Feb 26 23:20:16 2023 -0800 riscv, bpf: Fix patch_text implicit declaration bpf_jit_comp64.c uses patch_text(), so add to it to prevent the build error: ../arch/riscv/net/bpf_jit_comp64.c: In function 'bpf_arch_text_poke': ../arch/riscv/net/bpf_jit_comp64.c:691:23: error: implicit declaration of function 'patch_text'; did you mean 'path_get'? [-Werror=implicit-function-declaration] 691 | ret = patch_text(ip, new_insns, ninsns); | ^~~~~~~~~~ Fixes: 596f2e6f9cf4 ("riscv, bpf: Add bpf_arch_text_poke support for RV64") Reported-by: kernel test robot Signed-off-by: Randy Dunlap Signed-off-by: Daniel Borkmann Acked-by: Pu Lehui Acked-by: Björn Töpel Link: https://lore.kernel.org/r/202302271000.Aj4nMXbZ-lkp@intel.com Link: https://lore.kernel.org/bpf/20230227072016.14618-1-rdunlap@infradead.org commit a07484c083eabc809e45a198bd639bfd37ac70b6 Author: Bagas Sanjaya Date: Wed Feb 22 15:35:30 2023 +0700 bpf, docs: Fix link to BTF doc Ross reported broken link to BTF documentation (Documentation/bpf/btf.rst) in Documentation/bpf/bpf_devel_QA.rst. The link in question is written using external link syntax, with the target refers to BTF doc in reST source (btf.rst), which doesn't exist in resulting HTML output. Fix the link by replacing external link syntax with simply writing out the target doc, which the link will be generated to the correct HTML doc target. Fixes: 6736aa793c2b5f ("selftests/bpf: Add general instructions for test execution") Reported-by: Ross Zwisler Signed-off-by: Bagas Sanjaya Signed-off-by: Daniel Borkmann Acked-by: Ross Zwisler Link: https://lore.kernel.org/linux-doc/Y++09LKx25dtR4Ow@google.com/ Link: https://lore.kernel.org/bpf/20230222083530.26136-1-bagasdotme@gmail.com commit 580f98cc33a260bb8c6a39ae2921b29586b84fdf Author: Eric Dumazet Date: Mon Feb 27 08:33:36 2023 +0000 tcp: tcp_check_req() can be called from process context This is a follow up of commit 0a375c822497 ("tcp: tcp_rtx_synack() can be called from process context"). Frederick Lawler reported another "__this_cpu_add() in preemptible" warning caused by the same reason. In my former patch I took care of tcp_rtx_synack() but forgot that tcp_check_req() also contained some SNMP updates. Note that some parts of tcp_check_req() always run in BH context, I added a comment to clarify this. Fixes: 8336886f786f ("tcp: TCP Fast Open Server - support TFO listeners") Link: https://lore.kernel.org/netdev/8cd33923-a21d-397c-e46b-2a068c287b03@cloudflare.com/T/ Signed-off-by: Eric Dumazet Reported-by: Frederick Lawler Tested-by: Frederick Lawler Link: https://lore.kernel.org/r/20230227083336.4153089-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 972074ea88402e9b1b29c3a8d3d6d1aadaff624e Author: Oleksij Rempel Date: Sat Feb 25 08:16:44 2023 +0100 net: phy: c45: fix network interface initialization failures on xtensa, arm:cubieboard Without proper initialization, "changed" returned random numbers and caused interface initialization failures. Fixes: 022c3f87f88e ("net: phy: add genphy_c45_ethtool_get/set_eee() support") Reported-by: Guenter Roeck Tested-by: Guenter Roeck Signed-off-by: Oleksij Rempel Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230225071644.2754893-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit ccf8f7d71424ce37394c8333482853dba4f33978 Author: Tom Rix Date: Sun Feb 26 11:34:29 2023 -0500 xen-netback: remove unused variables pending_idx and index building with gcc and W=1 reports drivers/net/xen-netback/netback.c:886:21: error: variable ‘pending_idx’ set but not used [-Werror=unused-but-set-variable] 886 | u16 pending_idx; | ^~~~~~~~~~~ pending_idx is not used so remove it. Since index was only used to set pending_idx, remove index as well. Signed-off-by: Tom Rix Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230226163429.2351600-1-trix@redhat.com Signed-off-by: Jakub Kicinski commit 4db692d68256d860c9d35140b1de7324b432082b Merge: 923b2e30dc9cd 52fd90638a726 Author: Jakub Kicinski Date: Mon Feb 27 10:36:36 2023 -0800 Merge tag 'wireless-2023-02-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.3 First set of fixes for v6.3. We have only three oneliners. The most important one is the patch reducing warnings about the Wireless Extensions usage, reported by Linus. * tag 'wireless-2023-02-27' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: wext: warn about usage only once wifi: mt76: usb: fix use-after-free in mt76u_free_rx_queue wifi: ath11k: allow system suspend to survive ath11k ==================== Link: https://lore.kernel.org/r/20230227131053.BD779C433D2@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 982818426a0ffaf93b0621826ed39a84be3d7d62 Merge: 11c70529983e8 9f79762ef8d90 Author: Linus Torvalds Date: Mon Feb 27 10:09:40 2023 -0800 Merge tag 'arm-fixes-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "A few bugfixes already came up during the merge window. Samsung, ASpeed, Spear have minor DT changes, in case of Samsung this fixes a regression compared to earlier versions. Bartosz takes over as the primary maintainer for the TI DaVinci platform, and we get a few last minute defconfig changes" * tag 'arm-fixes-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: dts: spear320-hmi: correct STMPE GPIO compatible ARM: dts: aspeed: p10bmc: Update battery node name arm64: defconfig: Add IOSCHED_BFQ to the default configs arm64: defconfig: Fix unintentional disablement of PCI on i.MX ARM: dts: exynos: correct TMU phandle in Odroid XU3 family ARM: dts: exynos: correct TMU phandle in Odroid HC1 ARM: dts: exynos: correct TMU phandle in Odroid XU ARM: dts: exynos: correct TMU phandle in Exynos5250 ARM: dts: exynos: correct TMU phandle in Exynos4210 ARM: dts: exynos: correct TMU phandle in Exynos4 MAINTAINERS: make me the maintainer of DaVinci platforms commit 11c70529983e8136ea1bd5c32e4f9cd14503c644 Merge: d40b2f4c94f22 524af30c93138 Author: Linus Torvalds Date: Mon Feb 27 10:04:49 2023 -0800 Merge tag 'soc-drivers-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC driver updates from Arnd Bergmann: "As usual, there are lots of minor driver changes across SoC platforms from NXP, Amlogic, AMD Zynq, Mediatek, Qualcomm, Apple and Samsung. These usually add support for additional chip variations in existing drivers, but also add features or bugfixes. The SCMI firmware subsystem gains a unified raw userspace interface through debugfs, which can be used for validation purposes. Newly added drivers include: - New power management drivers for StarFive JH7110, Allwinner D1 and Renesas RZ/V2M - A driver for Qualcomm battery and power supply status - A SoC device driver for identifying Nuvoton WPCM450 chips - A regulator coupler driver for Mediatek MT81xxv" * tag 'soc-drivers-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (165 commits) power: supply: Introduce Qualcomm PMIC GLINK power supply soc: apple: rtkit: Do not copy the reg state structure to the stack soc: sunxi: SUN20I_PPU should depend on PM memory: renesas-rpc-if: Remove redundant division of dummy soc: qcom: socinfo: Add IDs for IPQ5332 and its variant dt-bindings: arm: qcom,ids: Add IDs for IPQ5332 and its variant dt-bindings: power: qcom,rpmpd: add RPMH_REGULATOR_LEVEL_LOW_SVS_L1 firmware: qcom_scm: Move qcom_scm.h to include/linux/firmware/qcom/ MAINTAINERS: Update qcom CPR maintainer entry dt-bindings: firmware: document Qualcomm SM8550 SCM dt-bindings: firmware: qcom,scm: add qcom,scm-sa8775p compatible soc: qcom: socinfo: Add Soc IDs for IPQ8064 and variants dt-bindings: arm: qcom,ids: Add Soc IDs for IPQ8064 and variants soc: qcom: socinfo: Add support for new field in revision 17 soc: qcom: smd-rpm: Add IPQ9574 compatible soc: qcom: pmic_glink: remove redundant calculation of svid soc: qcom: stats: Populate all subsystem debugfs files dt-bindings: soc: qcom,rpmh-rsc: Update to allow for generic nodes soc: qcom: pmic_glink: add CONFIG_NET/CONFIG_OF dependencies soc: qcom: pmic_glink: Introduce altmode support ... commit e02b50ca442e88122e1302d4dbc1b71a4808c13f Author: KP Singh Date: Mon Feb 27 07:05:41 2023 +0100 Documentation/hw-vuln: Document the interaction between IBRS and STIBP Explain why STIBP is needed with legacy IBRS as currently implemented (KERNEL_IBRS) and why STIBP is not needed when enhanced IBRS is enabled. Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Signed-off-by: KP Singh Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230227060541.1939092-2-kpsingh@kernel.org commit 6921ed9049bc7457f66c1596c5b78aec0dae4a9d Author: KP Singh Date: Mon Feb 27 07:05:40 2023 +0100 x86/speculation: Allow enabling STIBP with legacy IBRS When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation() determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. Exclude IBRS from the spectre_v2_in_ibrs_mode() check to allow for enabling STIBP (through seccomp/prctl() by default or always-on, if selected by spectre_v2_user kernel cmdline parameter). [ bp: Massage. ] Fixes: 7c693f54c873 ("x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS") Reported-by: José Oliveira Reported-by: Rodrigo Branco Signed-off-by: KP Singh Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230220120127.1975241-1-kpsingh@kernel.org Link: https://lore.kernel.org/r/20230221184908.2349578-1-kpsingh@kernel.org commit d40b2f4c94f221bd5aab205f945e6f88d3df0929 Merge: da15efe1a8513 1cc4606d19e37 Author: Linus Torvalds Date: Mon Feb 27 09:53:58 2023 -0800 Merge tag 'fuse-update-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Fix regression in fileattr permission checking - Fix possible hang during PID namespace destruction - Add generic support for request extensions - Add supplementary group list extension - Add limited support for supplying supplementary groups in create requests - Documentation fixes * tag 'fuse-update-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: add inode/permission checks to fileattr_get/fileattr_set fuse: fix all W=1 kernel-doc warnings fuse: in fuse_flush only wait if someone wants the return code fuse: optional supplementary group in create requests fuse: add request extension commit da15efe1a8513e0a949f429338155a56667dc9c6 Merge: 6ffb575bebb98 571f235163ac8 Author: Linus Torvalds Date: Mon Feb 27 09:47:26 2023 -0800 Merge tag 'mmc-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Extend slot-gpio to be used for host specific card detect interrupts - Align to common busy polling behaviour for mmc ioctls - Suggest the BFQ I/O scheduler to be built along with MMC/SD support - Add devm_mmc_alloc_host() to enable further cleanups in host drivers MMC host: - atmel-mci: Fix race condition when stopping/starting a command - dw_mmc-starfive: Add new driver to support the StarFive JH7110 variant - dw_mmc-rockchip: Add support for the RK3588 variant - jz4740: Add support for the vqmmc power supply - meson-gx: Convert the DT bindings to the dt-schema - meson-gx: Enable the platform interrupt to be used for card detect - moxart: Set the supported maximum request/block/segment sizes - renesas,sdhi: Add support for the RZ/V2M variants - sdhci: Rework code to drop SDHCI_QUIRK_MISSING_CAPS - sdhci-esdhc-imx: Improve tuning logic support - sdhci-msm: Add support for the IPQ5332 and the IPQ9574 variants - sdhci-of-dwcmshc: Add the missing device table IDs for acpi - sdhci-of-dwcmshc: Improve clock support for the Rockchip variant - sdhci-of-dwcmshc: Enable support of V4 host for the BlueField-3 variant - sdhci-pxav2: Add support for the PXA168 V1 variant - sdhci-pxav2: Add support for SDIO IRQs for the PXA168 V1 variant - uniphier-sd: Add support for SD UHS-I speed modes" * tag 'mmc-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (59 commits) mmc: meson-gx: Use devm_platform_get_and_ioremap_resource() mmc: meson-gx: constify member data of struct meson_host mmc: meson-gx: use devm_clk_get_enabled() for core clock mmc: core: fix return value check in devm_mmc_alloc_host() dt-bindings: mmc: meson-gx: fix interrupt binding mmc: meson-gx: support platform interrupt as card detect interrupt dt-bindings: mmc: meson-gx: support specifying cd interrupt mmc: core: support setting card detect interrupt from drivers mmc: starfive: Add sdio/emmc driver support dt-bindings: mmc: Add StarFive MMC module dt-bindings: mmc: sdhci-msm: Allow 1 icc path dt-bindings: mmc: rockchip-dw-mshc: Add RK3588 compatible string mmc: core: Align to common busy polling behaviour for mmc ioctls dt-bindings: mmc: Add resets property to cadence SDHCI binding mmc: meson-gx: remove meson_mmc_get_cd mmc: moxart: set maximum request/block/segment sizes mmc: sdhci-brcmstb: Use devm_platform_get_and_ioremap_resource() mmc: sdhci-of-dwcmshc: add the missing device table IDs for acpi mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform mmc: jz4740: Add support for vqmmc power supply ... commit 6ffb575bebb983b982240372ecf976188451dd1c Merge: 5a6d92493bb2e 9b07d27d0fbb7 Author: Linus Torvalds Date: Mon Feb 27 09:38:51 2023 -0800 Merge tag 'dma-mapping-6.3-2022-02-27' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - remove a not very useful and now unused swiotlb API (Christoph Hellwig) - fix a section mismatch (Randy Dunlap) * tag 'dma-mapping-6.3-2022-02-27' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: mark swiotlb_memblock_alloc() as __init swiotlb: remove swiotlb_max_segment commit 5a6d92493bb2e6e0a2fbb4a8b2c7ed97b4a5652b Merge: 02a737f4bb22f 2fe03412e2e1b Author: Linus Torvalds Date: Mon Feb 27 09:34:53 2023 -0800 Merge tag 'memblock-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: "Small optimizations: - fix off-by-one in the check whether memblock_add_range() should reallocate memory to accommodate newly inserted range - check only for relevant regions in memblock_merge_regions() rather than swipe over the entire array" * tag 'memblock-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: Avoid useless checks in memblock_merge_regions(). memblock: Make a boundary tighter in memblock_add_range(). commit 02a737f4bb22fd72bffb5b4008bbcb773218b5dd Merge: b6cc7a0436906 5aa52ccf692bf Author: Linus Torvalds Date: Mon Feb 27 09:31:02 2023 -0800 Merge tag 'm68knommu-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: - spelling fixes * tag 'm68knommu-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: nommu: Fix misspellings of "DragonEngine" m68k: nommu: Fix misspellings of "uCdimm" commit b6cc7a0436906b18f51c3e6b1f41d648bf645bd7 Merge: f3a2439f20d91 4a3ec00957fdf Author: Linus Torvalds Date: Mon Feb 27 09:27:31 2023 -0800 Merge tag 'csky-for-linus-6.3' of https://github.com/c-sky/csky-linux Pull csky update from Guo Ren: - Optimize delay accuracy * tag 'csky-for-linus-6.3' of https://github.com/c-sky/csky-linux: csky: delay: Add function alignment commit 6e2985c938e8b765b3de299c561d87f98330c546 Author: Darrick J. Wong Date: Fri Feb 17 15:44:25 2023 -0800 xfs: restore old agirotor behavior Prior to the removal of xfs_ialloc_next_ag, we would increment the agi rotor and return the *old* value. atomic_inc_return returns the new value, which causes mkfs to allocate the root directory in AG 1. Put back the old behavior (at least for mkfs) by subtracting 1 here. Fixes: 20a5eab49d35 ("xfs: convert xfs_ialloc_next_ag() to an atomic") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit ebf95e884694b2c796ecb53d80d2b4cff8990d2f Author: Harald Freudenberger Date: Fri Feb 17 12:05:36 2023 +0100 s390/ap,zcrypt,vfio: introduce and use ap_queue_status_reg union Introduce a new ap queue status register wrapper union to access register wide values. So the inline assembler only sees register wide values but the surrounding code may use a more structured view of the same value and a reader of the code (and the compiler) gets a clear understanding about the mapping between fields and register values. All the changes to access the ap queue status are local to the inline functions within ap.h. However, the struct ap_qirq_ctrl has been replaces by a union for same reason and this needed slight adaptions in the calling code. Suggested-by: Halil Pasic Suggested-by: Andreas Arnez Signed-off-by: Harald Freudenberger Acked-by: Heiko Carstens Reviewed-by: Holger Dengler Signed-off-by: Heiko Carstens commit ae4b60f6b7a8d25c7253cab104468d22efcecf1a Author: Nico Boehr Date: Thu Feb 16 13:12:08 2023 +0100 s390/nmi: fix virtual-physical address confusion When a machine check is received while in SIE, it is reinjected into the guest in some cases. The respective code needs to access the sie_block, which is taken from the backed up R14. Since reinjection only occurs while we are in SIE (i.e. between the labels sie_entry and sie_leave in entry.S and thus if CIF_MCCK_GUEST is set), the backed up R14 will always contain a physical address in s390_backup_mcck_info. This currently works, because virtual and physical addresses are the same. Add phys_to_virt() to resolve the virtual-physical confusion. Signed-off-by: Nico Boehr Reviewed-by: Claudio Imbrenda Reviewed-by: Alexander Gordeev Link: https://lore.kernel.org/r/20230216121208.4390-2-nrb@linux.ibm.com Signed-off-by: Janosch Frank Signed-off-by: Heiko Carstens commit 8ee0d2fb4dfa3465ea2030dec59a6f6fe3005804 Author: Vasily Gorbik Date: Fri Feb 17 14:00:54 2023 +0100 s390/setup: do not complain about parameters handled in decompressor Currently there are several kernel command line parameters which are only parsed and handled in decompressor and not known to the kernel. This leads to the following error message during kernel boot: Unknown kernel command line parameters "mem=3G nokaslr", will be passed to user space. To avoid confusion, register those parameters with an empty stub so that kernel does not complain about them. Reported-by: Gerald Schaefer Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit c0c33b94cfc23d21f67c7569a8785b33c74d6e3d Author: Keith Busch Date: Fri Feb 24 07:34:24 2023 -0800 nvme: fix sparse warning on effects masking The log entries are stored in le32, so use appropriate byte swapping macros. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302242222.PevBhzvC-lkp@intel.com/ Signed-off-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 9f79762ef8d90a6fab85e4ac0d153bdd8b4868ca Merge: 33a0c1b850c8c a3583e92d188e Author: Arnd Bergmann Date: Mon Feb 27 14:46:59 2023 +0100 Merge tag 'samsung-dt-fixes-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/fixes Fixes for Samsung DTS ARM for v6.3 Thermal framework commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization") merged in v6.1-rc1, exposed misconfiguration of Exynos Thermal Monitoring Unit (TMU) thermal-sensors property in DTS. This misconfiguration in DTS was working fine before that Thermal commit, but now all thermal zones fail to register except the first one (CPU). This can lead to missing cooling of a board and eventually either emergency shutdown or damaged board. * tag 'samsung-dt-fixes-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: exynos: correct TMU phandle in Odroid XU3 family ARM: dts: exynos: correct TMU phandle in Odroid HC1 ARM: dts: exynos: correct TMU phandle in Odroid XU ARM: dts: exynos: correct TMU phandle in Exynos5250 ARM: dts: exynos: correct TMU phandle in Exynos4210 ARM: dts: exynos: correct TMU phandle in Exynos4 Link: https://lore.kernel.org/r/20230221095337.9453-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 33a0c1b850c8c85f400531dab3a0b022cdb164b1 Author: Krzysztof Kozlowski Date: Sat Feb 25 17:22:37 2023 +0100 ARM: dts: spear320-hmi: correct STMPE GPIO compatible The compatible is st,stmpe-gpio. Fixes: e2eb69183ec4 ("ARM: SPEAr320: DT: Add SPEAr 320 HMI board support") Signed-off-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20230225162237.40242-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit a8cef541dd5ef9445130660008c029205c4c5aa5 Author: Eddie James Date: Tue Feb 21 11:03:52 2023 +1030 ARM: dts: aspeed: p10bmc: Update battery node name The ADC sensor for the battery needs to be named "iio-hwmon" for compatibility with user space applications. Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20230202152759.67069-1-eajames@linux.ibm.com Fixes: bf1914e2cfed ("ARM: dts: aspeed: p10bmc: Fix ADC iio-hwmon battery node name") Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20230221003352.1218797-1-joel@jms.id.au Signed-off-by: Arnd Bergmann commit e505e6bf4205255bf6e0daba9ea0f80b6391b936 Author: Linus Walleij Date: Fri Feb 24 14:52:30 2023 +0100 arm64: defconfig: Add IOSCHED_BFQ to the default configs ARM64 systems are often memory constrained and more often than not use slow single-channel storage such as flash memory or MMC/SD-cards. For any interactive systems (such as mobile phones, tablets, chromebooks...) the BFQ I/O scheduler will be desireable. Make sure the BFQ I/O scheduler is available on these systems. ARM (32), Loongarch, MIPS, m68k, UM and S390 has also enabled BFQ in their defconfigs, cf commit b495dfed706c4c5873c0dab8930ad6eb1d276a6c "um: Cleanup CONFIG_IOSCHED_CFQ" where the motivation is that it replaces the former CFQ scheduler. Cc: linux-arm-kernel@lists.infradead.org Cc: Catalin Marinas Cc: Will Deacon Cc: Paolo Valente Cc: Krzysztof Kozlowski Cc: Ulf Hansson Cc: Arnd Bergmann Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230224135230.2295826-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 0cd5780eb625cc4e49cf65df9ad29a6591658b74 Author: Mark Brown Date: Mon Feb 20 19:09:45 2023 +0000 arm64: defconfig: Fix unintentional disablement of PCI on i.MX A recent update to support PCI endpoint mode on i.MX platforms unintentionally disabled PCI host support for i.MX in defconfig. The existing PCI_IMX6 was made a hidden option, selected by new options PCI_IMX6_HOST (for the existing support) and PCI_IMX6_EP (for the endpoint mode), but there has been no corresponding update to defconfig so the PCI_IMX6 ends up getting disabled. Switch defconfig to PCI_IMX6_HOST to preserve the existing functionality. Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") Reported-by: "kernelci.org bot" Signed-off-by: Mark Brown Reviewed-by: Richard Zhu Link: https://lore.kernel.org/r/20230220-imx-pci-defconfig-v1-1-2210cf08340e@kernel.org Signed-off-by: Arnd Bergmann commit 923b2e30dc9cd05931da0f64e2e23d040865c035 Author: Pedro Tammela Date: Fri Feb 24 14:56:01 2023 -0300 net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy TCA_EXT_WARN_MSG is currently sitting outside of the expected hierarchy for the tc actions code. It should sit within TCA_ACT_TAB. Fixes: 0349b8779cc9 ("sched: add new attr TCA_EXT_WARN_MSG to report tc extact message") Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 8258ef28001ad30c074e823124e10b9c75a965ff Author: Namjae Jeon Date: Sat Jan 14 13:09:48 2023 +0900 exfat: handle unreconized benign secondary entries Sony PXW-Z280 camera add vendor allocation entries to directory of pictures. Currently, linux exfat does not support it and the file is not visible. This patch handle vendor extension and allocation entries as unreconized benign secondary entries. As described in the specification, it is recognized but ignored, and when deleting directory entry set, the associated clusters allocation are removed as well as benign secondary directory entries. Reported-by: Barócsi Dénes Reviewed-by: Sungjong Seo Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 39c1ce8eafc0ff64fb9e28536ccc7df6a8e2999d Author: Yuezhang Mo Date: Wed Jan 4 14:37:47 2023 +0800 exfat: fix inode->i_blocks for non-512 byte sector size device inode->i_blocks is not real number of blocks, but 512 byte ones. Fixes: 98d917047e8b ("exfat: add file operations") Cc: stable@vger.kernel.org # v5.7+ Reported-by: Wang Yugui Tested-by: Wang Yugui Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Signed-off-by: Namjae Jeon commit bdaadfd343e3cba49ad0b009ff4b148dad0fa404 Author: Sungjong Seo Date: Thu Dec 29 20:52:38 2022 +0900 exfat: redefine DIR_DELETED as the bad cluster number When a file or a directory is deleted, the hint for the cluster of its parent directory in its in-memory inode is set as DIR_DELETED. Therefore, DIR_DELETED must be one of invalid cluster numbers. According to the exFAT specification, a volume can have at most 2^32-11 clusters. However, DIR_DELETED is wrongly defined as 0xFFFF0321, which could be a valid cluster number. To fix it, let's redefine DIR_DELETED as 0xFFFFFFF7, the bad cluster number. Fixes: 1acf1a564b60 ("exfat: add in-memory and on-disk structures and headers") Cc: stable@vger.kernel.org # v5.7+ Reported-by: Yuezhang Mo Signed-off-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 706fdcac002316893434d753be8cfb549fe1d40d Author: Yuezhang Mo Date: Thu Oct 20 14:27:37 2022 +0800 exfat: fix reporting fs error when reading dir beyond EOF Since seekdir() does not check whether the position is valid, the position may exceed the size of the directory. We found that for a directory with discontinuous clusters, if the position exceeds the size of the directory and the excess size is greater than or equal to the cluster size, exfat_readdir() will return -EIO, causing a file system error and making the file system unavailable. Reproduce this bug by: seekdir(dir, dir_size + cluster_size); dirent = readdir(dir); The following log will be printed if mount with 'errors=remount-ro'. [11166.712896] exFAT-fs (sdb1): error, invalid access to FAT (entry 0xffffffff) [11166.712905] exFAT-fs (sdb1): Filesystem has been set read-only Fixes: 1e5654de0f51 ("exfat: handle wrong stream entry size in exfat_readdir()") Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 6cb5d1a16a51d080fbc1649a5144cbc5ca7d6f88 Author: Yuezhang Mo Date: Thu Sep 22 14:43:47 2022 +0800 exfat: fix unexpected EOF while reading dir If the position is not aligned with the dentry size, the return value of readdir() will be NULL and errno is 0, which means the end of the directory stream is reached. If the position is aligned with dentry size, but there is no file or directory at the position, exfat_readdir() will continue to get dentry from the next dentry. So the dentry gotten by readdir() may not be at the position. After this commit, if the position is not aligned with the dentry size, round the position up to the dentry size and continue to get the dentry. Fixes: ca06197382bd ("exfat: add directory operations") Cc: stable@vger.kernel.org # v5.7+ Reported-by: Wang Yugui Signed-off-by: Yuezhang Mo Reviewed-by: Andy Wu Reviewed-by: Aoyama Wataru Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit dd8314739a1ff8ed081d3a06f5f87045f7384636 Author: Jiaxun Yang Date: Wed Feb 22 13:24:22 2023 +0000 MIPS: Remove DMA_PERDEV_COHERENT As now we are always managing DMA coherence on per dev bias, there is no need to have such option. And it's not selected by any platform. Signed-off-by: Jiaxun Yang Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Bogendoerfer commit ff30bd6a6618e979b16977617371c0f28a95036e Author: Geert Uytterhoeven Date: Thu Feb 2 17:20:55 2023 +0100 sh: clk: Fix clk_enable() to return 0 on NULL clk On SH, devm_clk_get_optional_enabled() fails with -EINVAL if the clock is not found. This happens because __devm_clk_get() assumes it can pass a NULL clock pointer (as returned by clk_get_optional()) to the init() function (clk_prepare_enable() in this case), while the SH implementation of clk_enable() considers that an error. Fix this by making the SH clk_enable() implementation return zero instead, like the Common Clock Framework does. Reported-by: John Paul Adrian Glaubitz Signed-off-by: Geert Uytterhoeven Tested-by: John Paul Adrian Glaubitz Acked-by: Stephen Boyd Link: https://lore.kernel.org/r/b53e6b557b4240579933b3359dda335ff94ed5af.1675354849.git.geert+renesas@glider.be Signed-off-by: John Paul Adrian Glaubitz commit 250870824c1cf199b032b1ef889c8e8d69d9123a Author: Michael Karcher Date: Tue Jan 24 22:48:16 2023 +0100 sh: intc: Avoid spurious sizeof-pointer-div warning GCC warns about the pattern sizeof(void*)/sizeof(void), as it looks like the abuse of a pattern to calculate the array size. This pattern appears in the unevaluated part of the ternary operator in _INTC_ARRAY if the parameter is NULL. The replacement uses an alternate approach to return 0 in case of NULL which does not generate the pattern sizeof(void*)/sizeof(void), but still emits the warning if _INTC_ARRAY is called with a nonarray parameter. This patch is required for successful compilation with -Werror enabled. The idea to use _Generic for type distinction is taken from Comment #7 in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108483 by Jakub Jelinek Signed-off-by: Michael Karcher Acked-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/619fa552-c988-35e5-b1d7-fe256c46a272@mkarcher.dialup.fu-berlin.de Signed-off-by: John Paul Adrian Glaubitz commit ba3be66f11c3c49afaa9f49b99e21d88756229ef Author: Dmitry Osipenko Date: Thu Nov 17 04:40:38 2022 +0300 drm/panfrost: Don't sync rpm suspension after mmu flushing Lockdep warns about potential circular locking dependency of devfreq with the fs_reclaim caused by immediate device suspension when mapping is released by shrinker. Fix it by doing the suspension asynchronously. Reviewed-by: Steven Price Fixes: ec7eba47da86 ("drm/panfrost: Rework page table flushing and runtime PM interaction") Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/all/20230108210445.3948344-3-dmitry.osipenko@collabora.com/ commit 9630b585b607bd26f505d34620b14d75b9a5af7d Author: Dmitry Osipenko Date: Fri Nov 4 19:04:59 2022 +0300 drm/msm/gem: Prevent blocking within shrinker loop Consider this scenario: 1. APP1 continuously creates lots of small GEMs 2. APP2 triggers `drop_caches` 3. Shrinker starts to evict APP1 GEMs, while APP1 produces new purgeable GEMs 4. msm_gem_shrinker_scan() returns non-zero number of freed pages and causes shrinker to try shrink more 5. msm_gem_shrinker_scan() returns non-zero number of freed pages again, goto 4 6. The APP2 is blocked in `drop_caches` until APP1 stops producing purgeable GEMs To prevent this blocking scenario, check number of remaining pages that GPU shrinker couldn't release due to a GEM locking contention or shrinking rejection. If there are no remaining pages left to shrink, then there is no need to free up more pages and shrinker may break out from the loop. This problem was found during shrinker/madvise IOCTL testing of virtio-gpu driver. The MSM driver is affected in the same way. Reviewed-by: Rob Clark Reviewed-by: Thomas Zimmermann Fixes: b352ba54a820 ("drm/msm/gem: Convert to using drm_gem_lru") Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/all/20230108210445.3948344-2-dmitry.osipenko@collabora.com/ commit ee9adb7a45516cfa536ca92253d7ae59d56db9e4 Author: Dmitry Osipenko Date: Mon Jan 9 00:13:11 2023 +0300 drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free. Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Osipenko Reviewed-by: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/20230108211311.3950107-1-dmitry.osipenko@collabora.com commit a54bace095d00e9222161495649688bc43de4dde Author: Oleksandr Tyshchenko Date: Fri Feb 24 17:34:50 2023 +0200 drm/virtio: Pass correct device to dma_sync_sgtable_for_device() The "vdev->dev.parent" should be used instead of "vdev->dev" as a device for which to perform the DMA operation in both virtio_gpu_cmd_transfer_to_host_2d(3d). Because the virtio-gpu device "vdev->dev" doesn't really have DMA OPS assigned to it, but parent (virtio-pci or virtio-mmio) device "vdev->dev.parent" has. The more, the sgtable in question the code is trying to sync here was mapped for the parent device (by using its DMA OPS) previously at: virtio_gpu_object_shmem_init()->drm_gem_shmem_get_pages_sgt()-> dma_map_sgtable(), so should be synced here for the same parent device. Fixes: b5c9ed70d1a9 ("drm/virtio: Improve DMA API usage for shmem BOs") Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Dmitry Osipenko Signed-off-by: Dmitry Osipenko Link: https://patchwork.freedesktop.org/patch/msgid/20230224153450.526222-1-olekstysh@gmail.com commit f3a2439f20d918930cc4ae8f76fe1c1afd26958f Merge: cc38a46de76e1 7c855ef7137a6 Author: Linus Torvalds Date: Sun Feb 26 12:18:36 2023 -0800 Merge tag 'rproc-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Support for PRU clients to acquire a control reference to the PRU instances is introduced, and the PRU now allows specifying firmware-name in Devicetree. sysfs is requested to be read-only when the remoteproc instance is consumed by another kernel driver - Support for the C7xv DSP on AM62A SoC is introduced - The Devicetree binding for the Qualcomm PAS devices are split up in multiple files, to better account for the differences in resources between them. A number of missing Devicetree bindings are added, and the Qualcomm WCNSS binding is converted to YAML - A few cleanups are introduced for the Mediatek SCP driver. And a sanity check of the firmware image is introduced in the Mediatek driver - For Qualcomm SC7280 ADSP support is added, MSM8953 gains ADSP and modem support, SM6115 and SM8550 gains ADSP, CDSP and modem support, and support for pronto v3 support (used on e.g. MSM8953) is added - The Qualcomm modem remoteproc driver is modified to use a no-map reserved-memory region for it's authentication metadata, in order to avoid fatal security violations caused by accesses from Linux during the authentication process - Support for separate loading of a Devicetree blob is added to the PAS driver, and support for the PAS driver to carve out DSM memory for the modem is added as well - The Qualcomm ADSP remoteproc driver gains support for mapping memory into specific range using the IOMMU. The sysmon driver is transitioned to strlcpy() * tag 'rproc-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (69 commits) dt-bindings: mailbox: qcom,apcs-kpss-global: drop mbox-names from example dt-bindings: remoteproc: qcom,glink-edge: correct label description dt-bindings: remoteproc: qcom,glink-rpm-edge: convert to DT schema dt-bindings: remoteproc: qcom,sm8550-pas: correct power domains remoteproc: qcom_q6v5_pas: enable sm8550 adsp & cdsp autoboot dt-bindings: remoteproc: qcom: Add sm6115 pas yaml file remoteproc: qcom: pas: Add sm6115 remoteprocs remoteproc: qcom: pas: Adjust the phys addr wrt the mem region remoteproc: qcom: fix sparse warnings remoteproc: qcom: replace kstrdup with kstrndup remoteproc: mediatek: Check the SCP image format remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers Revert "remoteproc: qcom_q6v5_mss: map/unmap metadata region before/after use" dt-bindings: remoteproc: qcom,sc7280-mss-pil: Update memory-region dt-bindings: remoteproc: qcom,sc7180-mss-pil: Update memory-region dt-bindings: remoteproc: qcom,msm8996-mss-pil: Update memory region dt-bindings: remoteproc: qcom,q6v5: Move MSM8996 to schema remoteproc: qcom_q6v5_pas: add sm8550 adsp, cdsp & mpss compatible & data remoteproc: qcom_q6v5_pas: add support for assigning memory to firmware remoteproc: qcom_q6v5_pas: add support for dtb co-firmware loading ... commit cc38a46de76e15d20bea5768e99af17b65a9caeb Merge: 9b0b0dd857652 fb80ef67e8ff6 Author: Linus Torvalds Date: Sun Feb 26 12:10:28 2023 -0800 Merge tag 'rpmsg-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull rpmsg updates from Bjorn Andersson: - rpmsg ctrl and char driver locking is ensure ordering in cases where the communication link is being torn down in parallel with calls to open(2) or poll(2) - The glink driver is refactored, to move rpm/smem-specifics out of the common logic and better suite further improvements, such as transports without a mailbox controller. The handling of remoteproc shutdown is improved, to fail clients immediately instead of having them to wait for timeouts. A driver_override memory leak is corrected and a few spelling improvements are introduced - glink_ssr is transitioned off strlcpy() and "gpr" is added as a valid child node of the glink-edge DT binding * tag 'rpmsg-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: rpmsg: glink: Release driver_override rpmsg: glink: Avoid infinite loop on intent for missing channel rpmsg: glink: Fix GLINK command prefix rpmsg: glink: Fix spelling of peek rpmsg: glink: Cancel pending intent requests at removal rpmsg: glink: Fail qcom_glink_tx() once remove has been initiated rpmsg: glink: Move irq and mbox handling to transports rpmsg: glink: rpm: Wrap driver context rpmsg: glink: smem: Wrap driver context rpmsg: glink: Extract tx kick operation rpmsg: glink: Include types in qcom_glink_native.h rpmsg: ctrl: Add lock to rpmsg_ctrldev_remove rpmsg: char: Add lock to avoid race when rpmsg device is released rpmsg: move from strlcpy with unused retval to strscpy dt-bindings: remoteproc: qcom,glink-edge: add GPR node commit 9b0b0dd857652bf77d5350c6aec6cae767c48824 Merge: 498a1cf902c31 95e158ec84366 Author: Linus Torvalds Date: Sun Feb 26 12:05:38 2023 -0800 Merge tag 'hwlock-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock updates from Bjorn Andersson: "This updates the sun6i DT binding to allow (and require) #hwlock-cells and makes use of device_match_of_node() to slight clean up the condition in of_hwspin_lock_get_id()" * tag 'hwlock-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: dt-bindings: hwlock: sun6i: Add #hwlock-cells to example dt-bindings: hwlock: sun6i: Add missing #hwlock-cells hwspinlock: Use device_match_of_node() commit 498a1cf902c31c3af398082d65cf150b33b367e6 Merge: 4b8c673b761e7 7adf14d8aca1e Author: Linus Torvalds Date: Sun Feb 26 11:53:25 2023 -0800 Merge tag 'kbuild-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Change V=1 option to print both short log and full command log - Allow V=1 and V=2 to be combined as V=12 - Make W=1 detect wrong .gitignore files - Tree-wide cleanups for unused command line arguments passed to Clang - Stop using -Qunused-arguments with Clang - Make scripts/setlocalversion handle only correct release tags instead of any arbitrary annotated tag - Create Debian and RPM source packages without cleaning the source tree - Various cleanups for packaging * tag 'kbuild-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (74 commits) kbuild: rpm-pkg: remove unneeded KERNELRELEASE from modules/headers_install docs: kbuild: remove description of KBUILD_LDS_MODULE .gitattributes: use 'dts' diff driver for *.dtso files kbuild: deb-pkg: improve the usability of source package kbuild: deb-pkg: fix binary-arch and clean in debian/rules kbuild: tar-pkg: use tar rules in scripts/Makefile.package kbuild: make perf-tar*-src-pkg work without relying on git kbuild: deb-pkg: switch over to source format 3.0 (quilt) kbuild: deb-pkg: make .orig tarball a hard link if possible kbuild: deb-pkg: hide KDEB_SOURCENAME from Makefile kbuild: srcrpm-pkg: create source package without cleaning kbuild: rpm-pkg: build binary packages from source rpm kbuild: deb-pkg: create source package without cleaning kbuild: add a tool to list files ignored by git Documentation/llvm: add Chimera Linux, Google and Meta datacenters setlocalversion: use only the correct release tag for git-describe setlocalversion: clean up the construction of version output .gitignore: ignore *.cover and *.mbx kbuild: remove --include-dir MAKEFLAG from top Makefile kbuild: fix trivial typo in comment ... commit 4b8c673b761e74add4fd185d806ac16c9b40158f Merge: d4563201f33a0 3e62aba8284de Author: Linus Torvalds Date: Sun Feb 26 11:47:26 2023 -0800 Merge tag 'media/v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Removal of several VB1-only deprecated drivers: cpia2, fsl-viu, meye, stkwebcam, tm6000, vpfe_capture and zr364xx - saa7146 recovered from staging/deprecated. We opted to give ti a chance, and, instead of deprecating it, the intention is to write patches migrating it from VB1 to VB2. - av7110 returned from staging/deprecated/ to staging/ as we're not planning on dropping it any time soon - media controller API has gained experimental support for G_ROUTING and streams API. No drivers use it right now. We're planning to add one after -rc1, giving some time to experience the API and eventually have changes during the next development cycle - New sensor drivers: imx296, imx415, ov8858 - Atomisp had lots of changes, specially on its sensor's interface, making atomisp sensor drivers closer to normal sensor drivers - media controller kAPI has gained some helpers to traverse pipelines - uvcvideo now better support power line control - lots of bug fixes, cleanups and driver improvements * tag 'media/v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (296 commits) media: imx-mipi-csis: Check csis_fmt validity before use media: v4l2-subdev.c: clear stream field media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line media: Revert "media: saa7146: deprecate hexium_gemini/orion, mxb and ttpci" media: Revert "media: av7110: move to staging/media/deprecated/saa7146" media: imx-pxp: convert to regmap media: imx-pxp: Use non-threaded IRQ media: imx-pxp: Introduce pxp_read() and pxp_write() wrappers media: imx-pxp: Implement frame size enumeration media: imx-pxp: Pass pixel format value to find_format() media: imx-pxp: Add media controller support media: imx-pxp: Don't set bus_info manually in .querycap() media: imx-pxp: Sort headers alphabetically media: imx-pxp: add support for i.MX7D media: imx-pxp: make data_path_ctrl0 platform dependent media: imx-pxp: disable LUT block media: imx-pxp: explicitly disable unused blocks media: imx-pxp: extract helper function to setup data path media: imx-pxp: detect PXP version media: dt-bindings: media: fsl-pxp: convert to yaml ... commit d4563201f33a022fc0353033d9dfeb1606a88330 Author: Linus Torvalds Date: Sun Feb 26 11:25:04 2023 -0800 Documentation: simplify and clarify DCO contribution example language Long long ago, in a more innocent time, Greg wrote the clarification for how the DCO should work and that you couldn't make anonymous contributions, because the sign-off needed to be something we could check back with. It was 2006, and nobody reacted to the wording, the whole Facebook 'real name' controversy was a decade in the future, and nobody even thought about it. And despite the language, we've always accepted nicknames and that language was never meant to be any kind of exclusionary wording. In fact, even when it became a discussion in other adjacent projects, apparently nobody even thought to just clarify the language in the kernel docs, and instead we had projects like the CNCF that had long discussions about it, and wrote their own clarifications [1] of it. Just simplify the wording to the point where it shouldn't be causing unnecessary angst and pain, or scare away people who go by preferred naming. Link: https://github.com/cncf/foundation/blob/659fd32c86dc/dco-guidelines.md [1] Fixes: af45f32d25cc ("We can not allow anonymous contributions to the kernel") Acked-by: Greg KH Acked-by: Michael Dolan Signed-off-by: Linus Torvalds commit f7c4d9b133c7a04ca619355574e96b6abf209fba Author: Ilya Dryomov Date: Fri Feb 24 18:48:54 2023 +0100 rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts is triggered in do_rbd_add(). The root cause is that the ownership of these structures is transfered to rbd_dev prematurely and they all end up getting freed when rbd_dev_create() calls rbd_dev_free() prior to returning to do_rbd_add(). Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova . Cc: stable@vger.kernel.org Fixes: 1643dfa4c2c8 ("rbd: introduce a per-device ordered workqueue") Signed-off-by: Ilya Dryomov commit e027253c4b77d395798600a90b6a96fe4adf4d5e Author: Xiubo Li Date: Mon Feb 13 13:56:20 2023 +0800 ceph: update the time stamps and try to drop the suid/sgid The fallocate will try to clear the suid/sgid if a unprevileged user changed the file. There is no POSIX item requires that we should clear the suid/sgid in fallocate code path but this is the default behaviour for most of the filesystems and the VFS layer. And also the same for the write code path, which have already support it. And also we need to update the time stamps since the fallocate will change the file contents. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/58054 Signed-off-by: Xiubo Li Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 724337be7f218111cd798702e2e17bfc6615744b Author: Russell King (Oracle) Date: Fri Feb 24 16:44:20 2023 +0000 net: dsa: ocelot_ext: remove unnecessary phylink.h include During review of ocelot_ext, it created a private phylink instance that wasn't necessary. This was removed for subsequent postings, but the include file seems to have been left behind. Remove it. Signed-off-by: Russell King (Oracle) Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 5f79f12c08a4ddf5f00eb736e156020dbb0489a9 Merge: 3fa10563361eb ef1a99c65edb5 Author: David S. Miller Date: Sun Feb 26 18:31:37 2023 +0000 Merge branch 'net-ocelot-switch-regressions' Vladimir Oltean says: ==================== Regressions in Ocelot switch drivers These are 3 patches which resolve a regression in the Seville driver, one in the Felix driver and a generic one which affects any kernel compiled with 2 Kconfig options enabled. All of them have in common my lack of attention during review/testing. The patches touch the DSA, MFD and MDIO drivers for Ocelot. I think it would be preferable if all patches went through netdev (with Lee's Ack). ==================== Signed-off-by: David S. Miller commit ef1a99c65edb504c509a5c4aa865830867df6e7b Author: Vladimir Oltean Date: Fri Feb 24 17:52:35 2023 +0200 net: mscc: ocelot: fix duplicate driver name error When compiling a kernel which has both CONFIG_NET_DSA_MSCC_OCELOT_EXT and CONFIG_MSCC_OCELOT_SWITCH enabled, the following error message will be printed: [ 5.266588] Error: Driver 'ocelot-switch' is already registered, aborting... Rename the ocelot_ext.c driver to "ocelot-ext-switch" to avoid the name duplication, and update the mfd_cell entry for its resources. Fixes: 3d7316ac81ac ("net: dsa: ocelot: add external ocelot switch control") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 940af261321307cd1dd0fe8f9c34a6129f9d4bdc Author: Vladimir Oltean Date: Fri Feb 24 17:52:34 2023 +0200 net: dsa: felix: fix internal MDIO controller resource length The blamed commit did not properly convert the resource start/end format into the DEFINE_RES_MEM_NAMED() start/length format, resulting in a resource for vsc9959_imdio_res which is much longer than expected: $ cat /proc/iomem 1f8000000-1f815ffff : pcie@1f0000000 1f8140000-1f815ffff : 0000:00:00.5 1f8148030-1f815006f : imdio vs (correct) $ cat /proc/iomem 1f8000000-1f815ffff : pcie@1f0000000 1f8140000-1f815ffff : 0000:00:00.5 1f8148030-1f814803f : imdio Luckily it's not big enough to exceed the size of the parent resource (pci_resource_end(pdev, VSC9959_IMDIO_PCI_BAR)), and it doesn't overlap with anything else that the Linux driver uses currently, so the larger than expected size isn't a practical problem that I can see. Although it is clearly wrong in the /proc/iomem output. Fixes: 044d447a801f ("net: dsa: felix: use DEFINE_RES_MEM_NAMED for resources") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 0322ef49c1ac6f0e2ef37b146c0bf8440873072c Author: Vladimir Oltean Date: Fri Feb 24 17:52:33 2023 +0200 net: dsa: seville: ignore mscc-miim read errors from Lynx PCS During the refactoring in the commit below, vsc9953_mdio_read() was replaced with mscc_miim_read(), which has one extra step: it checks for the MSCC_MIIM_DATA_ERROR bits before returning the result. On T1040RDB, there are 8 QSGMII PCSes belonging to the switch, and they are organized in 2 groups. First group responds to MDIO addresses 4-7 because QSGMIIACR1[MDEV_PORT] is 1, and the second group responds to MDIO addresses 8-11 because QSGMIIBCR1[MDEV_PORT] is 2. I have double checked that these values are correctly set in the SERDES, as well as PCCR1[QSGMA_CFG] and PCCR1[QSGMB_CFG] are both 0b01. mscc_miim_read: phyad 8 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 8 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 8 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 8 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 9 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 9 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 9 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 9 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 10 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 10 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 10 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 10 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 11 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 11 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 11 reg 0x1 MIIM_DATA 0x2d mscc_miim_read: phyad 11 reg 0x5 MIIM_DATA 0x5801 mscc_miim_read: phyad 4 reg 0x1 MIIM_DATA 0x3002d, ERROR mscc_miim_read: phyad 4 reg 0x5 MIIM_DATA 0x3da01, ERROR mscc_miim_read: phyad 5 reg 0x1 MIIM_DATA 0x3002d, ERROR mscc_miim_read: phyad 5 reg 0x5 MIIM_DATA 0x35801, ERROR mscc_miim_read: phyad 5 reg 0x1 MIIM_DATA 0x3002d, ERROR mscc_miim_read: phyad 5 reg 0x5 MIIM_DATA 0x35801, ERROR mscc_miim_read: phyad 6 reg 0x1 MIIM_DATA 0x3002d, ERROR mscc_miim_read: phyad 6 reg 0x5 MIIM_DATA 0x35801, ERROR mscc_miim_read: phyad 6 reg 0x1 MIIM_DATA 0x3002d, ERROR mscc_miim_read: phyad 6 reg 0x5 MIIM_DATA 0x35801, ERROR mscc_miim_read: phyad 7 reg 0x1 MIIM_DATA 0x3002d, ERROR mscc_miim_read: phyad 7 reg 0x5 MIIM_DATA 0x35801, ERROR mscc_miim_read: phyad 7 reg 0x1 MIIM_DATA 0x3002d, ERROR mscc_miim_read: phyad 7 reg 0x5 MIIM_DATA 0x35801, ERROR As can be seen, the data in MIIM_DATA is still valid despite having the MSCC_MIIM_DATA_ERROR bits set. The driver as introduced in commit 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch") was ignoring these bits, perhaps deliberately (although unbeknownst to me). This is an old IP and the hardware team cannot seem to be able to help me track down a plausible reason for these failures. I'll keep investigating, but in the meantime, this is a direct regression which must be restored to a working state. The only thing I can do is keep ignoring the errors as before. Fixes: b99658452355 ("net: dsa: ocelot: felix: utilize shared mscc-miim driver for indirect MDIO access") Signed-off-by: Vladimir Oltean Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 3fa10563361eb4e998f8916d274a2afdbce3fc19 Merge: aaa3c08ee0653 4a20056a49a18 Author: David S. Miller Date: Sun Feb 26 18:27:46 2023 +0000 Merge branch 'net-sched-action-bind' Pedro Tammela says: ==================== net/sched: fix action bind logic Some actions are not handling the case where an action can be created and bound to a filter independently. These actions are checking for parameters only passed in the netlink message for create/change/replace, which then errors out for valid uses like: tc filter ... action pedit index 1 In the iproute2 side, we saw a couple of actions with their parsers broken when passing "index 1" as the only action argument, while the kernel side accepted it correctly. We fixed those as well. ==================== Signed-off-by: David S. Miller commit 4a20056a49a1854966562241922f68197f950539 Author: Pedro Tammela Date: Fri Feb 24 12:00:58 2023 -0300 net/sched: act_sample: fix action bind logic The TC architecture allows filters and actions to be created independently. In filters the user can reference action objects using: tc action add action sample ... index 1 tc filter add ... action pedit index 1 In the current code for act_sample this is broken as it checks netlink attributes for create/update before actually checking if we are binding to an existing action. tdc results: 1..29 ok 1 9784 - Add valid sample action with mandatory arguments ok 2 5c91 - Add valid sample action with mandatory arguments and continue control action ok 3 334b - Add valid sample action with mandatory arguments and drop control action ok 4 da69 - Add valid sample action with mandatory arguments and reclassify control action ok 5 13ce - Add valid sample action with mandatory arguments and pipe control action ok 6 1886 - Add valid sample action with mandatory arguments and jump control action ok 7 7571 - Add sample action with invalid rate ok 8 b6d4 - Add sample action with mandatory arguments and invalid control action ok 9 a874 - Add invalid sample action without mandatory arguments ok 10 ac01 - Add invalid sample action without mandatory argument rate ok 11 4203 - Add invalid sample action without mandatory argument group ok 12 14a7 - Add invalid sample action without mandatory argument group ok 13 8f2e - Add valid sample action with trunc argument ok 14 45f8 - Add sample action with maximum rate argument ok 15 ad0c - Add sample action with maximum trunc argument ok 16 83a9 - Add sample action with maximum group argument ok 17 ed27 - Add sample action with invalid rate argument ok 18 2eae - Add sample action with invalid group argument ok 19 6ff3 - Add sample action with invalid trunc size ok 20 2b2a - Add sample action with invalid index ok 21 dee2 - Add sample action with maximum allowed index ok 22 560e - Add sample action with cookie ok 23 704a - Replace existing sample action with new rate argument ok 24 60eb - Replace existing sample action with new group argument ok 25 2cce - Replace existing sample action with new trunc argument ok 26 59d1 - Replace existing sample action with new control argument ok 27 0a6e - Replace sample action with invalid goto chain control ok 28 3872 - Delete sample action with valid index ok 29 a394 - Delete sample action with invalid index Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action") Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit e88d78a773cb5242e933930c8855bf4b2e8c2397 Author: Pedro Tammela Date: Fri Feb 24 12:00:57 2023 -0300 net/sched: act_mpls: fix action bind logic The TC architecture allows filters and actions to be created independently. In filters the user can reference action objects using: tc action add action mpls ... index 1 tc filter add ... action mpls index 1 In the current code for act_mpls this is broken as it checks netlink attributes for create/update before actually checking if we are binding to an existing action. tdc results: 1..53 ok 1 a933 - Add MPLS dec_ttl action with pipe opcode ok 2 08d1 - Add mpls dec_ttl action with pass opcode ok 3 d786 - Add mpls dec_ttl action with drop opcode ok 4 f334 - Add mpls dec_ttl action with reclassify opcode ok 5 29bd - Add mpls dec_ttl action with continue opcode ok 6 48df - Add mpls dec_ttl action with jump opcode ok 7 62eb - Add mpls dec_ttl action with trap opcode ok 8 09d2 - Add mpls dec_ttl action with opcode and cookie ok 9 c170 - Add mpls dec_ttl action with opcode and cookie of max length ok 10 9118 - Add mpls dec_ttl action with invalid opcode ok 11 6ce1 - Add mpls dec_ttl action with label (invalid) ok 12 352f - Add mpls dec_ttl action with tc (invalid) ok 13 fa1c - Add mpls dec_ttl action with ttl (invalid) ok 14 6b79 - Add mpls dec_ttl action with bos (invalid) ok 15 d4c4 - Add mpls pop action with ip proto ok 16 91fb - Add mpls pop action with ip proto and cookie ok 17 92fe - Add mpls pop action with mpls proto ok 18 7e23 - Add mpls pop action with no protocol (invalid) ok 19 6182 - Add mpls pop action with label (invalid) ok 20 6475 - Add mpls pop action with tc (invalid) ok 21 067b - Add mpls pop action with ttl (invalid) ok 22 7316 - Add mpls pop action with bos (invalid) ok 23 38cc - Add mpls push action with label ok 24 c281 - Add mpls push action with mpls_mc protocol ok 25 5db4 - Add mpls push action with label, tc and ttl ok 26 7c34 - Add mpls push action with label, tc ttl and cookie of max length ok 27 16eb - Add mpls push action with label and bos ok 28 d69d - Add mpls push action with no label (invalid) ok 29 e8e4 - Add mpls push action with ipv4 protocol (invalid) ok 30 ecd0 - Add mpls push action with out of range label (invalid) ok 31 d303 - Add mpls push action with out of range tc (invalid) ok 32 fd6e - Add mpls push action with ttl of 0 (invalid) ok 33 19e9 - Add mpls mod action with mpls label ok 34 1fde - Add mpls mod action with max mpls label ok 35 0c50 - Add mpls mod action with mpls label exceeding max (invalid) ok 36 10b6 - Add mpls mod action with mpls label of MPLS_LABEL_IMPLNULL (invalid) ok 37 57c9 - Add mpls mod action with mpls min tc ok 38 6872 - Add mpls mod action with mpls max tc ok 39 a70a - Add mpls mod action with mpls tc exceeding max (invalid) ok 40 6ed5 - Add mpls mod action with mpls ttl ok 41 77c1 - Add mpls mod action with mpls ttl and cookie ok 42 b80f - Add mpls mod action with mpls max ttl ok 43 8864 - Add mpls mod action with mpls min ttl ok 44 6c06 - Add mpls mod action with mpls ttl of 0 (invalid) ok 45 b5d8 - Add mpls mod action with mpls ttl exceeding max (invalid) ok 46 451f - Add mpls mod action with mpls max bos ok 47 a1ed - Add mpls mod action with mpls min bos ok 48 3dcf - Add mpls mod action with mpls bos exceeding max (invalid) ok 49 db7c - Add mpls mod action with protocol (invalid) ok 50 b070 - Replace existing mpls push action with new ID ok 51 95a9 - Replace existing mpls push action with new label, tc, ttl and cookie ok 52 6cce - Delete mpls pop action ok 53 d138 - Flush mpls actions Fixes: 2a2ea50870ba ("net: sched: add mpls manipulation actions to TC") Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit e9e42292ea76a8358b0c02ffd530d78e133a1b73 Author: Pedro Tammela Date: Fri Feb 24 12:00:56 2023 -0300 net/sched: act_pedit: fix action bind logic The TC architecture allows filters and actions to be created independently. In filters the user can reference action objects using: tc action add action pedit ... index 1 tc filter add ... action pedit index 1 In the current code for act_pedit this is broken as it checks netlink attributes for create/update before actually checking if we are binding to an existing action. tdc results: 1..69 ok 1 319a - Add pedit action that mangles IP TTL ok 2 7e67 - Replace pedit action with invalid goto chain ok 3 377e - Add pedit action with RAW_OP offset u32 ok 4 a0ca - Add pedit action with RAW_OP offset u32 (INVALID) ok 5 dd8a - Add pedit action with RAW_OP offset u16 u16 ok 6 53db - Add pedit action with RAW_OP offset u16 (INVALID) ok 7 5c7e - Add pedit action with RAW_OP offset u8 add value ok 8 2893 - Add pedit action with RAW_OP offset u8 quad ok 9 3a07 - Add pedit action with RAW_OP offset u8-u16-u8 ok 10 ab0f - Add pedit action with RAW_OP offset u16-u8-u8 ok 11 9d12 - Add pedit action with RAW_OP offset u32 set u16 clear u8 invert ok 12 ebfa - Add pedit action with RAW_OP offset overflow u32 (INVALID) ok 13 f512 - Add pedit action with RAW_OP offset u16 at offmask shift set ok 14 c2cb - Add pedit action with RAW_OP offset u32 retain value ok 15 1762 - Add pedit action with RAW_OP offset u8 clear value ok 16 bcee - Add pedit action with RAW_OP offset u8 retain value ok 17 e89f - Add pedit action with RAW_OP offset u16 retain value ok 18 c282 - Add pedit action with RAW_OP offset u32 clear value ok 19 c422 - Add pedit action with RAW_OP offset u16 invert value ok 20 d3d3 - Add pedit action with RAW_OP offset u32 invert value ok 21 57e5 - Add pedit action with RAW_OP offset u8 preserve value ok 22 99e0 - Add pedit action with RAW_OP offset u16 preserve value ok 23 1892 - Add pedit action with RAW_OP offset u32 preserve value ok 24 4b60 - Add pedit action with RAW_OP negative offset u16/u32 set value ok 25 a5a7 - Add pedit action with LAYERED_OP eth set src ok 26 86d4 - Add pedit action with LAYERED_OP eth set src & dst ok 27 f8a9 - Add pedit action with LAYERED_OP eth set dst ok 28 c715 - Add pedit action with LAYERED_OP eth set src (INVALID) ok 29 8131 - Add pedit action with LAYERED_OP eth set dst (INVALID) ok 30 ba22 - Add pedit action with LAYERED_OP eth type set/clear sequence ok 31 dec4 - Add pedit action with LAYERED_OP eth set type (INVALID) ok 32 ab06 - Add pedit action with LAYERED_OP eth add type ok 33 918d - Add pedit action with LAYERED_OP eth invert src ok 34 a8d4 - Add pedit action with LAYERED_OP eth invert dst ok 35 ee13 - Add pedit action with LAYERED_OP eth invert type ok 36 7588 - Add pedit action with LAYERED_OP ip set src ok 37 0fa7 - Add pedit action with LAYERED_OP ip set dst ok 38 5810 - Add pedit action with LAYERED_OP ip set src & dst ok 39 1092 - Add pedit action with LAYERED_OP ip set ihl & dsfield ok 40 02d8 - Add pedit action with LAYERED_OP ip set ttl & protocol ok 41 3e2d - Add pedit action with LAYERED_OP ip set ttl (INVALID) ok 42 31ae - Add pedit action with LAYERED_OP ip ttl clear/set ok 43 486f - Add pedit action with LAYERED_OP ip set duplicate fields ok 44 e790 - Add pedit action with LAYERED_OP ip set ce, df, mf, firstfrag, nofrag fields ok 45 cc8a - Add pedit action with LAYERED_OP ip set tos ok 46 7a17 - Add pedit action with LAYERED_OP ip set precedence ok 47 c3b6 - Add pedit action with LAYERED_OP ip add tos ok 48 43d3 - Add pedit action with LAYERED_OP ip add precedence ok 49 438e - Add pedit action with LAYERED_OP ip clear tos ok 50 6b1b - Add pedit action with LAYERED_OP ip clear precedence ok 51 824a - Add pedit action with LAYERED_OP ip invert tos ok 52 106f - Add pedit action with LAYERED_OP ip invert precedence ok 53 6829 - Add pedit action with LAYERED_OP beyond ip set dport & sport ok 54 afd8 - Add pedit action with LAYERED_OP beyond ip set icmp_type & icmp_code ok 55 3143 - Add pedit action with LAYERED_OP beyond ip set dport (INVALID) ok 56 815c - Add pedit action with LAYERED_OP ip6 set src ok 57 4dae - Add pedit action with LAYERED_OP ip6 set dst ok 58 fc1f - Add pedit action with LAYERED_OP ip6 set src & dst ok 59 6d34 - Add pedit action with LAYERED_OP ip6 dst retain value (INVALID) ok 60 94bb - Add pedit action with LAYERED_OP ip6 traffic_class ok 61 6f5e - Add pedit action with LAYERED_OP ip6 flow_lbl ok 62 6795 - Add pedit action with LAYERED_OP ip6 set payload_len, nexthdr, hoplimit ok 63 1442 - Add pedit action with LAYERED_OP tcp set dport & sport ok 64 b7ac - Add pedit action with LAYERED_OP tcp sport set (INVALID) ok 65 cfcc - Add pedit action with LAYERED_OP tcp flags set ok 66 3bc4 - Add pedit action with LAYERED_OP tcp set dport, sport & flags fields ok 67 f1c8 - Add pedit action with LAYERED_OP udp set dport & sport ok 68 d784 - Add pedit action with mixed RAW/LAYERED_OP #1 ok 69 70ca - Add pedit action with mixed RAW/LAYERED_OP #2 Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") Fixes: f67169fef8db ("net/sched: act_pedit: fix WARN() in the traffic path") Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 52fd90638a7269be2a6f6cf1e4dea6724f8e13b6 Author: Johannes Berg Date: Fri Feb 24 13:59:34 2023 +0100 wifi: wext: warn about usage only once Warn only once since the ratelimit parameters are still allowing too many messages to happen. This will no longer tell you all the different processes, but still gives a heads-up of sorts. Also modify the message to note that wext stops working for future Wi-Fi 7 hardware, this is already implemented in commit 4ca69027691a ("wifi: wireless: deny wireless extensions on MLO-capable devices") and is maybe of more relevance to users than the fact that we'd like to have wireless extensions deprecated. The issue with Wi-Fi 7 is that you can now have multiple connections to the same AP, so a whole bunch of things now become per link rather than per netdev, which can't really be handled in wireless extensions. Signed-off-by: Johannes Berg Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230224135933.94104aeda1a0.Ie771c6a66d7d6c3cf67da5f3b0c66cea66fd514c@changeid commit cf45efcb250ea788085f330db972256735f970e0 Author: Lorenzo Bianconi Date: Fri Feb 24 00:02:17 2023 +0100 wifi: mt76: usb: fix use-after-free in mt76u_free_rx_queue Fix the following use-after-free issue in mt76u_free_rx_queue routine: usb 3-3.3.4: reset high-speed USB device number 8 using xhci_hcd iwlwifi 0000:05:00.0: Detected RF HR B3, rfid=0x10a100 iwlwifi 0000:05:00.0: base HW address: 50:eb:71:79:02:57 iwlwifi 0000:05:00.0 wlp5s0: renamed from wlan0 mt76x2u 3-3.3.4:1.0: ASIC revision: 76320044 usb 3-3.3.1: 1:3 : unsupported format bits 0x100000000 mt76x2u 3-3.3.4:1.0: could not get hardware semaphore for ROM PATCH ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 13 PID: 983 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 Modules linked in: snd_seq_midi snd_seq_midi_event mt76x2u(+) mt76x2_common mt76x02_usb mt76_usb iwlmvm mt76x02_lib mt76 snd_hda_codec_realtek intel_rapl_msr snd_hda_codec_generic snd_hda_codec_hdmi intel_rapl_common snd_hda_intel mac80211 snd_intel_dspcfg snd_usb_audio(+) snd_intel_sdw_acpi btusb edac_mce_amd snd_hda_codec btrtl btbcm snd_usbmidi_lib snd_hda_core btintel snd_rawmidi btmtk snd_hwdep libarc4 mc iwlwifi kvm_amd snd_seq vfat bluetooth eeepc_wmi asus_ec_sensors snd_seq_device fat kvm cfg80211 asus_wmi snd_pcm irqbypass ledtrig_audio sparse_keymap rapl wmi_bmof platform_profile xpad snd_timer k10temp ff_memless i2c_piix4 rfkill snd joydev soundcore acpi_cpufreq loop zram amdgpu crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic drm_ttm_helper ttm video iommu_v2 ucsi_ccg drm_buddy gpu_sched typec_ucsi ghash_clmulni_intel drm_display_helper igb sha512_ssse3 typec ccp nvme cec sp5100_tco nvme_core dca nvme_common wmi ip6_tables ip_tables fuse BTRFS info (device nvme1n1): enabling ssd optimizations CPU: 13 PID: 983 Comm: (udev-worker) Tainted: G W L ------- --- 6.3.0-0.rc0.20230222git5b7c4cabbb65.3.fc39.x86_64+debug BTRFS info (device nvme1n1): auto enabling async discard Hardware name: System manufacturer System Product Name/ROG STRIX X570-I GAMING, BIOS 4601 02/02/2023 RIP: 0010:refcount_warn_saturate+0xba/0x110 Code: 01 01 e8 69 a6 83 ff 0f 0b e9 52 f4 85 00 80 3d 69 6f ec 01 00 75 85 48 c7 c7 d0 25 b3 a9 c6 05 59 6f ec 01 01 e8 46 a6 83 ff <0f> 0b e9 2f f4 85 00 80 3d 47 6f ec 01 00 0f 85 5e ff ff ff 48 c7 RSP: 0018:ffffb4010456fb78 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000080000000 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffffa9b17e3e RDI: 00000000ffffffff RBP: ffff8d15877336c0 R08: 0000000000000000 R09: ffffb4010456fa00 R10: 0000000000000003 R11: ffff8d246e2fffe8 R12: 0000000000000080 R13: ffff8d15b42fd000 R14: 0000000000000000 R15: ffff8d1587736a58 FS: 00007fc05ae34940(0000) GS:ffff8d2425e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d801f1d540 CR3: 000000011df60000 CR4: 0000000000350ee0 Call Trace: mt76u_queues_deinit+0x2a0/0x370 [mt76_usb] mt76x2u_probe+0xf3/0x130 [mt76x2u] usb_probe_interface+0xe8/0x300 really_probe+0x1b6/0x410 __driver_probe_device+0x78/0x170 driver_probe_device+0x1f/0x90 __driver_attach+0xd2/0x1c0 ? __pfx___driver_attach+0x10/0x10 bus_for_each_dev+0x8a/0xd0 bus_add_driver+0x141/0x230 driver_register+0x77/0x120 usb_register_driver+0xaf/0x170 ? __pfx_init_module+0x10/0x10 [mt76x2u] do_one_initcall+0x6e/0x350 do_init_module+0x4a/0x220 __do_sys_init_module+0x192/0x1c0 ? lock_is_held_type+0xce/0x120 do_syscall_64+0x5b/0x80 ? lock_is_held_type+0xce/0x120 ? asm_exc_page_fault+0x22/0x30 ? lockdep_hardirqs_on+0x7d/0x100 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fc05b1351be Code: 48 8b 0d 4d 0c 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1a 0c 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd947c0988 EFLAGS: 00000246 ORIG_RAX: 00000000000000af RAX: ffffffffffffffda RBX: 000055d801f2b090 RCX: 00007fc05b1351be RDX: 00007fc05b65c07d RSI: 00000000000234be RDI: 000055d802c6b170 RBP: 00007ffd947c0a40 R08: 000055d8019b4690 R09: 0000000000022000 R10: 000000055d8019b4 R11: 0000000000000246 R12: 00007fc05b65c07d R13: 0000000000020000 R14: 000055d801f39770 R15: 000055d801f47780 irq event stamp: 186313 hardirqs last enabled at (186323): [] __up_console_sem+0x5e/0x70 hardirqs last disabled at (186332): [] __up_console_sem+0x43/0x70 softirqs last enabled at (186022): [] __irq_exit_rcu+0xd7/0x160 softirqs last disabled at (186017): [] __irq_exit_rcu+0xd7/0x160 ---[ end trace 0000000000000000 ]--- mt76x2u: probe of 3-3.3.4:1.0 failed with error -110 usbcore: registered new interface driver mt76x2u kauditd_printk_skb: 32 callbacks suppressed Fixes: 2f5c3c77fc9b ("wifi: mt76: switch to page_pool allocator") Tested-by: Mikhail Gavrilov Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/f2398f68011c976510c81e1964975b677e65860e.1677193208.git.lorenzo@kernel.org commit aaa3c08ee0653beaa649d4adfb27ad562641cfd8 Author: Michal Schmidt Date: Fri Feb 24 01:41:45 2023 +0100 qede: avoid uninitialized entries in coal_entry array Even after commit 908d4bb7c54c ("qede: fix interrupt coalescing configuration"), some entries of the coal_entry array may theoretically be used uninitialized: 1. qede_alloc_fp_array() allocates QEDE_MAX_RSS_CNT entries for coal_entry. The initial allocation uses kcalloc, so everything is initialized. 2. The user sets a small number of queues (ethtool -L). coal_entry is reallocated for the actual small number of queues. 3. The user sets a bigger number of queues. coal_entry is reallocated bigger. The added entries are not necessarily initialized. In practice, the reallocations will actually keep using the originally allocated region of memory, but we should not rely on it. The reallocation is unnecessary. coal_entry can always have QEDE_MAX_RSS_CNT entries. Fixes: 908d4bb7c54c ("qede: fix interrupt coalescing configuration") Signed-off-by: Michal Schmidt Nacked-by: Manish Chopra Acked-by: Manish Chopra Signed-off-by: David S. Miller commit 5064561090fda0ca059d2961f9922e2b7afea36a Merge: 25ff6f8a5a3b8 d28a06d7dbedc Author: David S. Miller Date: Sun Feb 26 16:22:08 2023 +0000 Merge tag 'mlx5-fixes-2023-02-24' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahemeed says: ==================== mlx5 fixes 2023-02-24 V1->V2: - Toss away arguably non-fixes patches This series provides bug fixes for mlx5 driver. Please pull and let me know if there is any problem. ==================== commit 25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea Author: Fedor Pchelkin Date: Sat Feb 25 13:56:14 2023 +0300 nfc: fix memory leak of se_io context in nfc_genl_se_io The callback context for sending/receiving APDUs to/from the selected secure element is allocated inside nfc_genl_se_io and supposed to be eventually freed in se_io_cb callback function. However, there are several error paths where the bwi_timer is not charged to call se_io_cb later, and the cb_context is leaked. The patch proposes to free the cb_context explicitly on those error paths. At the moment we can't simply check 'dev->ops->se_io()' return value as it may be negative in both cases: when the timer was charged and was not. Fixes: 5ce3f32b5264 ("NFC: netlink: SE API implementation") Reported-by: syzbot+df64c0a2e8d68e78a4fa@syzkaller.appspotmail.com Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Signed-off-by: David S. Miller commit cf871006c01709211f2620a33de37257362a05e8 Author: Jacob Keller Date: Fri Feb 24 13:32:41 2023 -0800 ice: remove unnecessary CONFIG_ICE_GNSS CONFIG_ICE_GNSS was added by commit c7ef8221ca7d ("ice: use GNSS subsystem instead of TTY") as a way to allow the ice driver to optionally support GNSS features without forcing a dependency on CONFIG_GNSS. The original implementation of that commit at [1] used IS_REACHABLE. This was rejected by Olek at [2] with the suggested implementation of CONFIG_ICE_GNSS. Eventually after merging, Linus reported a .config which had CONFIG_ICE_GNSS = y when both GNSS = n and ICE = n. This confused him and he felt that the config option was not useful, and commented about it at [3]. CONFIG_ICE_GNSS is defined to y whenever GNSS = ICE. This results in it being set in cases where both options are not enabled. The goal of CONFIG_ICE_GNSS is to ensure that the GNSS support in the ice driver is enabled when GNSS is enabled. The complaint from Olek about the original IS_REACHABLE was due to the required IS_REACHABLE checks throughout the ice driver code and the fact that ice_gnss.c was compiled regardless of GNSS support. This can be fixed in the Makefile by using ice-$(CONFIG_GNSS) += ice_gnss.o In this case, if GNSS = m and ICE = y, we can result in some confusing behavior where GNSS support is not enabled because its not built in. See [4]. To disallow this, have CONFIG_ICE depend on GNSS || GNSS = n. This ensures that we cannot enable CONFIG_ICE as builtin while GNSS is a module. Drop CONFIG_ICE_GNSS, and replace the IS_ENABLED checks for it with checks for GNSS. Update the Makefile to add the ice_gnss.o object based on CONFIG_GNSS. This works to ensure that GNSS support can optionally be enabled, doesn't have an unnnecessary extra config option, and has Kbuild enforce the dependency such that you can't accidentally enable GNSS as a module and ICE as a builtin. [1] https://lore.kernel.org/intel-wired-lan/20221019095603.44825-1-arkadiusz.kubalewski@intel.com/ [2] https://lore.kernel.org/intel-wired-lan/20221028165706.96849-1-alexandr.lobakin@intel.com/ [3] https://lore.kernel.org/all/CAHk-=wi_410KZqHwF-WL5U7QYxnpHHHNP-3xL=g_y89XnKc-uw@mail.gmail.com/ [4] https://lore.kernel.org/netdev/20230223161309.0e439c5f@kernel.org/ Reported-by: Linus Torvalds Signed-off-by: Jacob Keller Fixes: c7ef8221ca7d ("ice: use GNSS subsystem instead of TTY") Cc: Arkadiusz Kubalewski Cc: Alexander Lobakin Cc: Jakub Kicinski Cc: Anthony Nguyen Acked-by: Jakub Kicinski Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit 37e1f3acc339b28493eb3dad571c3f01b6af86f6 Author: Nathan Chancellor Date: Fri Feb 24 11:18:49 2023 -0700 net/sched: cls_api: Move call to tcf_exts_miss_cookie_base_destroy() When CONFIG_NET_CLS_ACT is disabled: ../net/sched/cls_api.c:141:13: warning: 'tcf_exts_miss_cookie_base_destroy' defined but not used [-Wunused-function] 141 | static void tcf_exts_miss_cookie_base_destroy(struct tcf_exts *exts) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Due to the way the code is structured, it is possible for a definition of tcf_exts_miss_cookie_base_destroy() to be present without actually being used. Its single callsite is in an '#ifdef CONFIG_NET_CLS_ACT' block but a definition will always be present in the file. The version of tcf_exts_miss_cookie_base_destroy() that actually does something depends on CONFIG_NET_TC_SKB_EXT, so the stub function is used in both CONFIG_NET_CLS_ACT=n and CONFIG_NET_CLS_ACT=y + CONFIG_NET_TC_SKB_EXT=n configurations. Move the call to tcf_exts_miss_cookie_base_destroy() in tcf_exts_destroy() out of the '#ifdef CONFIG_NET_CLS_ACT', so that it always appears used to the compiler, while not changing any behavior with any of the various configuration combinations. Fixes: 80cd22c35c90 ("net/sched: cls_api: Support hardware miss to tc action") Signed-off-by: Nathan Chancellor Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 099cc90a5a62e68b2fe3a42da011ab929b98bf73 Author: Kai-Heng Feng Date: Thu Feb 23 10:00:59 2023 +0800 iio: light: cm32181: Unregister second I2C client if present If a second dummy client that talks to the actual I2C address was created in probe(), there should be a proper cleanup on driver and device removal to avoid leakage. So unregister the dummy client via another callback. Reviewed-by: Hans de Goede Suggested-by: Hans de Goede Fixes: c1e62062ff54 ("iio: light: cm32181: Handle CM3218 ACPI devices with 2 I2C resources") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2152281 Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20230223020059.2013993-1-kai.heng.feng@canonical.com Cc: Signed-off-by: Jonathan Cameron commit 3e62aba8284de0994a669d07983299242e68fe72 Author: Marek Vasut Date: Thu Feb 16 02:44:01 2023 +0100 media: imx-mipi-csis: Check csis_fmt validity before use The find_csis_format() may return NULL in case supported format is not found, check the return value of find_csis_format() before using the result to avoid NULL pointer dereference. Fixes: 11927d0fd0d0 ("media: imx-mipi-csis: Use V4L2 subdev active state") Signed-off-by: Marek Vasut Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 68e87ebf2605643072264ed452f4e560417ddb1b Author: Hans Verkuil Date: Wed Feb 15 15:48:17 2023 +0100 media: v4l2-subdev.c: clear stream field Both userspace and kernelspace can pass structs with an uninitialized 'stream' field. Since the check_state() function checks for a non-zero stream field, suddenly these calls will fails with -EINVAL. So check in the wrapper functions in v4l2-subdev.c (which are used by both the kernel and userspace API) if V4L2_SUBDEV_FL_STREAMS is set, and if not, then zero the stream field. Currently no drivers set V4L2_SUBDEV_FL_STREAMS, so the stream field will always be set to 0. This patch might well be reverted in the future when streams support is fully enabled and we finalized the userspace API support for this feature. Signed-off-by: Hans Verkuil Reviewed-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 7adf14d8aca1ea53bf9ccf8463809c82adb8c23a Author: Masahiro Yamada Date: Wed Feb 22 23:47:29 2023 +0900 kbuild: rpm-pkg: remove unneeded KERNELRELEASE from modules/headers_install This is a temporary workaround added by commit f6e09b07cc12 ("kbuild: do not put .scmversion into the source tarball"). Since commit 1cb86b6c3136 ("kbuild: save overridden KERNELRELEASE in include/config/kernel.release"), the user-supplied KERNELRELEASE is saved in include/config/kernel.release. Remove it again. Signed-off-by: Masahiro Yamada Reviewed-by: Nathan Chancellor commit 29cbe6ecfd97cb599883c68d3c6dbac11d0618b8 Author: Sangmoon Kim Date: Wed Feb 22 19:47:19 2023 +0900 docs: kbuild: remove description of KBUILD_LDS_MODULE Commit 596b0474d3d9 ("kbuild: preprocess module linker script") removes KBUILD_LDS_MODULE, yet the variable is still mentioned in kbuild documentation. Remove the reference to the now-nonexistent variable. Signed-off-by: Sangmoon Kim Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit ae41e0e41ba04b4b51641b504fb3b405aef7ec04 Author: Masahiro Yamada Date: Sun Feb 19 23:23:27 2023 +0900 .gitattributes: use 'dts' diff driver for *.dtso files Now we have the third extension for DT source files (overlay). Give the diff=dts attribute to *.dtso as well. While I was here, I merged *.c and *.o into *.[ch] and added the SPDX-License-Identifier. Signed-off-by: Masahiro Yamada commit 3ab18a625ce42163da91ee4096460218d11bed36 Author: Masahiro Yamada Date: Wed Feb 15 10:20:33 2023 +0900 kbuild: deb-pkg: improve the usability of source package Improve the source package support in case the dpkg-buildpackage is directly used to build binary packages. For cross-compiling, you can set CROSS_COMPILE via the environment variable, but it is better to set it automatically - set it to ${DEB_HOST_GNU_TYPE}- if we are cross-compiling but not from the top Makefile. The generated source package may be carried to a different build environment, which may have a different compiler installed. Run olddefconfig first to set new CONFIG options to their default values without prompting. Take KERNELRELEASE and KBUILD_BUILD_VERSION from the version field of debian/changelog in case it is updated afterwards. Signed-off-by: Masahiro Yamada commit c5bf2efb058d841bf8993b9a9b4522abda804d39 Author: Masahiro Yamada Date: Wed Feb 15 10:20:32 2023 +0900 kbuild: deb-pkg: fix binary-arch and clean in debian/rules The clean target needs ARCH=${ARCH} to clean up the tree for the correct architecture. 'make (bin)deb-pkg' skips cleaning, but the preclean hook may be executed if dpkg-buildpackage is directly used. The binary-arch target does not need KERNELRELEASE because it is not updated during the installation. KBUILD_BUILD_VERSION is not needed either because binary-arch does not build vmlinux. Signed-off-by: Masahiro Yamada commit 1fc9095846cc0b7a4d027da2d0bd7569914bf129 Author: Masahiro Yamada Date: Wed Feb 15 10:20:31 2023 +0900 kbuild: tar-pkg: use tar rules in scripts/Makefile.package Use %.tar, %.tar.gz, %.tar.bz2, %.tar.xz, %.tar.zst rules in scripts/Makefile.package. Signed-off-by: Masahiro Yamada commit e0ca16749ac3392a5a2ea4e67327fa71ef4aa680 Author: Masahiro Yamada Date: Wed Feb 15 10:20:30 2023 +0900 kbuild: make perf-tar*-src-pkg work without relying on git Currently, perf-tar*-src-pkg only uses 'git archive', but it is better to make it work without relying on git. The file, HEAD, which saves the commit hash, will be included in the tarball only when the source tree is managed by git. The git tree is more precisely checked; it has been copied from scripts/setlocalversion. Signed-off-by: Masahiro Yamada commit e7853995594baa1a1258b20ff077b60a958becdc Author: Masahiro Yamada Date: Wed Feb 15 10:20:29 2023 +0900 kbuild: deb-pkg: switch over to source format 3.0 (quilt) Change the source format from "1.0" to "3.0 (quilt)" because it works more cleanly. All files except .config and debian/ go into the orig tarball. Add a single patch, debian/patches/config, and delete the ugly extend-diff-ignore patterns. The debian tarball will be compressed into *.debian.tar.xz by default. If you like to use a different compression mode, you can pass the command line option, DPKG_FLAGS=-Zgzip, for example. The orig tarball only supports gzip for now. The combination of gzip and xz is somewhat clumsy, but it is not a practical problem. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit b44aa8c96e9eea54a42c074c278a8e05e1c231d5 Author: Masahiro Yamada Date: Wed Feb 15 10:20:28 2023 +0900 kbuild: deb-pkg: make .orig tarball a hard link if possible If '..' belongs to the same filesystem, create a hard link instead of a copy. In most cases, you can save disk space. I do not want to use 'mv' because keeping linux.tar.gz is useful to avoid unneeded rebuilding of the tarball. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 6eabebb1b66c48d830549dbca5952f72307fbd0b Author: Masahiro Yamada Date: Wed Feb 15 10:20:27 2023 +0900 kbuild: deb-pkg: hide KDEB_SOURCENAME from Makefile scripts/Makefile.package does not need to know the value of KDEB_SOURCENAME because the source name can be taken from debian/changelog by using dpkg-parsechangelog. Move the default of KDEB_SOURCENAME (i.e. linux-upstream) to scripts/package/mkdebian. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 6fc91752d7c4706f1036838544b1ef5d9f41c058 Author: Masahiro Yamada Date: Wed Feb 15 10:20:26 2023 +0900 kbuild: srcrpm-pkg: create source package without cleaning If you run 'make (src)rpm-pkg', all objects are lost due to 'make clean', which makes the incremental builds impossible. Instead of cleaning, pass the exclude list to tar's --exclude-from option. Previously, the .config was contained in the source tarball. With this commit, the source rpm consists of separate linux.tar.gz and .config. Remove stale comments. Now, 'make (src)rpm-pkg' works with O= option. Signed-off-by: Masahiro Yamada commit 1ec9bb704faf50c48727b5daa33bc42e7334db60 Author: Masahiro Yamada Date: Wed Feb 15 10:20:25 2023 +0900 kbuild: rpm-pkg: build binary packages from source rpm The build rules of rpm-pkg and srcrpm-pkg are almost the same. Remove the code duplication. Change rpm-pkg to build binary packages from the source package generated by srcrpm-pkg. This changes the output directory of the srpm generated by 'make rpm-pkg' because srcrpm-pkg overrides _srcrpmdir. Signed-off-by: Masahiro Yamada commit 7bf4582d7aad870ecb4f760743307ecba7a960f4 Author: Masahiro Yamada Date: Wed Feb 15 10:20:24 2023 +0900 kbuild: deb-pkg: create source package without cleaning If you run 'make deb-pkg', all objects are lost due to 'make clean', which makes the incremental builds impossible. Instead of cleaning, pass the exclude list to tar's --exclude-from option. Previously, *.diff.gz contained some check-in files such as .clang-format, .cocciconfig. With this commit, *.diff.gz will only contain the .config and debian/. The other source files will go into the .orig tarball. linux.tar.gz is rebuilt only when the source files that would go into the tarball are changed. Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier commit 2fcd07b7ccd5fd10b2120d298363e4e6c53ccf9c Author: Liam R. Howlett Date: Fri Feb 24 16:20:55 2023 -0500 mm/mprotect: Fix successful vma_merge() of next in do_mprotect_pkey() If mprotect_fixup() successfully calls vma_merge() and replaces vma and the next vma, then the tmp variable in the do_mprotect_pkey() is not updated to point to the new vma end. This results in the loop detecting a gap between VMAs that does not exist. Fix the faulty value of tmp by setting it to the end location of the vma iterator at the end of the loop. Link: https://lkml.kernel.org/r/20230224212055.1786100-1-Liam.Howlett@oracle.com Fixes: 2286a6914c77 ("mm: change mprotect_fixup to vma iterator") Link: https://lore.kernel.org/linux-mm/20230223120407.729110a6ecd1416ac59d9cb0@linux-foundation.org/ Signed-off-by: Liam R. Howlett Reported-by: Bert Karwatzki Link: https://bugzilla.kernel.org/show_bug.cgi?id=217061 Tested-by: Bert Karwatzki Reported-by: Linus Torvalds Link: https://lore.kernel.org/linux-mm/CAHk-=wjFmVL7NiuxL54qLkoabni_yD-oF9=dpDgETtdsiCbhUg@mail.gmail.com/ Tested-by: Linus Torvalds Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c16bda37594f83147b167d381d54c010024efecf Author: Jens Axboe Date: Sat Feb 25 12:53:53 2023 -0700 io_uring/poll: allow some retries for poll triggering spuriously If we get woken spuriously when polling and fail the operation with -EAGAIN again, then we generally only allow polling again if data had been transferred at some point. This is indicated with REQ_F_PARTIAL_IO. However, if the spurious poll triggers when the socket was originally empty, then we haven't transferred data yet and we will fail the poll re-arm. This either punts the socket to io-wq if it's blocking, or it fails the request with -EAGAIN if not. Neither condition is desirable, as the former will slow things down, while the latter will make the application confused. We want to ensure that a repeated poll trigger doesn't lead to infinite work making no progress, that's what the REQ_F_PARTIAL_IO check was for. But it doesn't protect against a loop post the first receive, and it's unnecessarily strict if we started out with an empty socket. Add a somewhat random retry count, just to put an upper limit on the potential number of retries that will be done. This should be high enough that we won't really hit it in practice, unless something needs to be aborted anyway. Cc: stable@vger.kernel.org # v5.10+ Link: https://github.com/axboe/liburing/issues/364 Signed-off-by: Jens Axboe commit 1ec35eadc3b448c91a6b763371a7073444e95f9d Merge: 562ed38ded83a b64baafa24d2c Author: Linus Torvalds Date: Sat Feb 25 15:16:23 2023 -0800 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "We have one small patch to the clk core this time around. It fixes a corner case with the CLK_OPS_PARENT_ENABLE flag combined with clk_core_is_enabled() where it hangs the system. We'll simply assume the clk is disabled if the parent is disabled and the flag is set. Trying to turn on the parent to check the enable state of the clk runs into system hangs at boot. We let this bake in -next for a couple weeks to make sure there aren't any more issues because the last attempt to fix this ran into hangs and had to be reverted. Note: There were some more patches to the core framework around sync_state and disabling unused clks, but I asked for that to be reverted from the qcom PR because it isn't ready and we're still discussing the best solution on the list. Outside of the core clk framework, we have the usual collection of clk driver updates and support for new SoCs (which seems to never stop). The dirstat is dominated by Qualcomm because they added support for quite a few SoCs this time around and also migrated quite a few of their drivers to clk_parent_data. The other big diff is in the Mediatek clk drivers that saw a significant rework this cycle to similarly modernize the code, and we'll see that work continue in the next cycle as well. Nothing really jumps out as scary here, except that the significant churn in parent data descriptions can have typos that go unnoticed. More details below. Core: - Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() New Drivers: - Add a new clk-gpr-mux clock type and use it on i.MX6Q to add ENET ref clocks - Support for Mediatek MT7891 SoC clks - Support for many Qualcomm clk controllers: - QDU1000/QRU1000 global clock controller - SA8775P global clock controller - SM8550 TCSR and display clock controller - SM6350 clock controller - MSM8996 CBF and APCS clock controllers Updates: - Various cleanups and improvements to Mediatek clk drivers to reduce code size and modernize the drivers - Support for Versa 5P49V60 clks - Disable R-Car H3 ES1.*, as it was only available to an internal development group and needed a lot of quirks and workarounds - Add PWM, Compare-Match Timer (TIM), USB, SDHI, and eMMC clocks and resets on Renesas RZ/V2M - Add display clocks on Renesas R-Car V4H - Add Camera Receiving Unit (CRU) clocks and resets on Renesas RZ/G2L - Free the imx_uart_clocks even if imx_register_uart_clocks returns early - Get the stdout clocks count from device tree on i.MX - Drop the clock count argument from imx_register_uart_clocks() - Keep the uart clocks on i.MX93 for when earlycon is used - Fix SPDX comment in i.MX6SLL clocks bindings header - Drop some unnecessary spaces from i.MX8ULP clocks bindings header - Add imx_obtain_fixed_of_clock() for allowing to add a clock that is not configured via devicetree - Fix the ENET1 gate configuration for i.MX6UL according to the reference manual - Add ENET refclock mux support for i.MX6UL - Add support for USB host/device configuration on Renesas RZ/N1 - Add PLL2 programming support, and CAN-FD clocks on Renesas R-Car V4H - Add D1 CAN bus gates and resets for Allwinner - Mark D1 CPUX clock as critical on Allwinner - Reuse D1 driver for Allwinner R528/T113 - Cleanup sunxi-ng Kconfig - Fix sunxi-ng kernel-doc issues - Model Allwinner H3/H5 DRAM clock as fixed clock - Use .determine_rate() instead of .round_rate() for the dualdiv, mpll, sclk-div and cpu-dyn-div amlogic clock drivers - DDR clocks were marked as critical in the proper clock driver for each AT91 SoC such that drivers/memory/atmel-sdramc.c to be deleted in the next releases as it only does clock enablement - Patch to avoid compiling dt-compat.o for all AT91 SoCs as only some of them may use it - Support synchronous power_off requests in the qcom GDSC driver for proper GPU power collapse - Drop test clocks from various Qualcomm clk drivers - Update parent references to use clk_parent_data/clk_hw in various Qualcomm clk drivers - Fixes for the Qualcomm MSM8996 CPU clock controller - Transition Qualcomm MSM8974 GCC off the externally defined sleep_clk - Add GDSCs in the global clock controller for Qualcomm QCS404 - The SDCC core clocks on Qualcomm SM6115 are moved to floor_ops - Programming of clk_dis_wait for GPU CX GDSC on Qualcomm SC7180 and SDM845 are moved to use the recently introduced properties in the GDSC struct - Qualcomm's RPMh clock driver gains SM8550 and SA8775P clocks, and the IPA clock is added on a variety of platforms - De-duplicate identical clks in Qualcomm SMD RPM clk driver - Add a few missing clocks across msm8998, msm8992, msm8916, qcs404 to Qualcomm SDM RPM clk driver - Various Qualcomm clk drivers use devm_pm_runtime_enable() to simplify" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (228 commits) clk: qcom: apcs-msm8986: Include bitfield.h for FIELD_PREP clk: qcom: Revert sync_state based clk_disable_unused clk: imx: pll14xx: fix recalc_rate for negative kdiv clk: rs9: Drop unused pin_xin field MAINTAINERS: clk: imx: Add Peng Fan as reviewer clk: sprd: Add dependency for SPRD_UMS512_CLK clk: ralink: fix 'mt7621_gate_is_enabled()' function clk: mediatek: clk-mtk: Remove unneeded semicolon dt-bindings: clock: remove stih416 bindings dt-bindings: clock: add loongson-2 clock dt-bindings: clock: add loongson-2 clock include file clk: imx: fix compile testing imxrt1050 clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() clk: imx: set imx_clk_gpr_mux_ops storage-class-specifier to static clk: renesas: rcar-gen3: Disable R-Car H3 ES1.* dt-bindings: clock: Merge qcom,gpucc-sm8350 into qcom,gpucc.yaml clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC dt-bindings: clock: qcom,sa8775p-gcc: add the power-domains property clk: qcom: cpu-8996: add missing cputype include ... commit 562ed38ded83a5cd3ecf9a1a875c7ee786c146ae Merge: 2e3036a2642b6 6ccbe33a39523 Author: Linus Torvalds Date: Sat Feb 25 15:10:14 2023 -0800 Merge tag 'mailbox-v6.3' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - qcom: misc changes to bindings for sa8775p, QDU1000/QRU1000, IPQ5332, SDX55, msm8976, glink-rpm-edge - sti: convert to DT schema - zynq: switch to flexible array to simplify code * tag 'mailbox-v6.3' of git://git.linaro.org/landing-teams/working/fujitsu/integration: dt-bindings: mailbox: qcom-ipcc: Add compatible for QDU1000/QRU1000 mailbox: qcom-apcs-ipc: add IPQ5332 APSS clock support dt-bindings: mailbox: qcom: add compatible for the IPQ5332 SoC dt-bindings: remoteproc: qcom,glink-rpm-edge: convert to DT schema mailbox: qcom-apcs-ipc: enable APCS clock device for MSM8996 dt-bindings: mailbox: qcom: add #clock-cells to msm8996 example dt-bindings: mailbox: qcom: add missing platforms to conditional clauses dt-bindings: mailbox: qcom: correct the list of platforms using clocks dt-bindings: mailbox: qcom: enable syscon compatible for msm8976 dt-bindings: mailbox: qcom: add SDX55 compatible dt-bindings: mailbox: qcom-ipcc: document the sa8775p platform dt-bindings: mailbox: sti-mailbox: convert to DT schema mailbox: zynq: Switch to flexible array to simplify code commit 2e3036a2642b6145a8117d21514bfc5f8d5ea595 Merge: 60e2bf7d10e9c f4440abc08917 Author: Linus Torvalds Date: Sat Feb 25 15:05:08 2023 -0800 Merge tag 'mtd/for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD changes: - parsers: ofpart: add workaround for #size-cells 0 - dt-bindings: partitions: Fix partition node name pattern - dataflash: remove duplicate SPI ID table Raw NAND core changes: - Check the data only read pattern only once - Prepare the late addition of supported operation checks - Support for sequential cache reads - Fix nand_chip kdoc Raw NAND driver changes: - Fsl_elbc: Propagate HW ECC settings to HW - Marvell: Add missing layouts - Pasemi: Don't use static data to track per-device state - Sunxi: - Fix the size of the last OOB region - Remove an unnecessary check - Remove an unnecessary check - Clean up chips after failed init - Precompute the ECC_CTL register value - Embed sunxi_nand_hw_ecc by value - Update OOB layout to match hardware - tmio_nand: Remove driver - vf610_nfc: Use regular comments for functions SPI-NAND driver changes: - Add support for AllianceMemory AS5F34G04SND - Macronix: use scratch buffer for DMA operation NAND ECC changes: - Mediatek: - Add ECC support fot MT7986 IC - Add compatible for MT7986 - dt-bindings: Split ECC engine with rawnand controller SPI NOR changes: - Misc core fixes SPI NOR driver changes: - Spansion: Minor fixes" * tag 'mtd/for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (33 commits) mtd: parsers: ofpart: add workaround for #size-cells 0 mtd: rawnand: sunxi: Precompute the ECC_CTL register value mtd: rawnand: sunxi: Embed sunxi_nand_hw_ecc by value mtd: rawnand: sunxi: Update OOB layout to match hardware mtd: spi-nor: Sort headers alphabetically mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type mtd: nand: ecc-mtk: Add ECC support fot MT7986 IC dt-bindings: mtd: mediatek,nand-ecc-engine: Add compatible for MT7986 dt-bindings: mtd: Split ECC engine with rawnand controller mtd: rawnand: fsl_elbc: Propagate HW ECC settings to HW mtd: spinand: Add support for AllianceMemory AS5F34G04SND dt-bindings: mtd: partitions: Fix partition node name pattern mtd: spi-nor: Create macros to define chip IDs and geometries mtd: spi-nor: spansion: Make CFRx reg fields generic mtd: spi-nor: spansion: Consider reserved bits in CFR5 register mtd: spi-nor: core: fix implicit declaration warning mtd: spinand: macronix: use scratch buffer for DMA operation mtd: rawnand: Fix nand_chip kdoc mtd: rawnand: vf610_nfc: use regular comments for functions mtd: rawnand: Support for sequential cache reads ... commit 60e2bf7d10e9cd5641f4a5183a19058d9a2c8782 Merge: 116b41162f8b2 7ae9fb1b7ecbb Author: Linus Torvalds Date: Sat Feb 25 15:01:32 2023 -0800 Merge tag 'input-for-v6.3-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - a set of tweaks to iqs269a touch controller driver - a fix for ads7846 driver to properly handle 7845 chip - cap11xx driver will support cap1203, cap1293 and cap1298 models - xpad driver will support 8BitDo Pro 2 Wired Controller - input drivers have been switched to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() - other miscellaneous fixes and tweaks * tag 'input-for-v6.3-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (113 commits) dt-bindings: input: iqs626a: Redefine trackpad property types Input: iqs626a - drop unused device node references dt-bindings: input: touchscreen: st,stmfts: convert to dtschema Input: cyttsp5 - fix bitmask for touch buttons Input: exc3000 - properly stop timer on shutdown Input: synaptics-rmi4 - fix SPI device ID Input: cap11xx - add support for cap1203, cap1293 and cap1298 dt-bindings: input: microchip,cap11xx: add cap1203, cap1293 and cap1298 Input: pmic8xxx-keypad - fix a Kconfig spelling mistake & hyphenation Input: edt-ft5x06 - fix typo in a comment Input: tegra-kbc - use devm_platform_get_and_ioremap_resource() Input: st-keyscan - use devm_platform_get_and_ioremap_resource() Input: spear-keyboard - use devm_platform_get_and_ioremap_resource() Input: olpc_apsp - use devm_platform_get_and_ioremap_resource() Input: arc_ps2 - use devm_platform_get_and_ioremap_resource() Input: apbps2 - use devm_platform_get_and_ioremap_resource() Input: altera_ps2 - use devm_platform_get_and_ioremap_resource() Input: ads7846 - don't check penirq immediately for 7845 Input: ads7846 - always set last command to PWRDOWN Input: ads7846 - don't report pressure for ads7845 ... commit 3ca04951b004fa184ff84369448a37bf5df98a79 Author: Johan Hovold Date: Thu Feb 2 16:54:43 2023 +0100 rtc: pm8xxx: add support for nvmem offset On many Qualcomm platforms the PMIC RTC control and time registers are read-only so that the RTC time can not be updated. Instead an offset needs be stored in some machine-specific non-volatile memory, which the driver can take into account. Add support for storing a 32-bit offset from the Epoch in an nvmem cell so that the RTC time can be set on such platforms. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230202155448.6715-18-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit 430aa33a304654704c16ed7bbbcbec9e9686aa81 Author: Johan Hovold Date: Thu Feb 2 16:54:42 2023 +0100 dt-bindings: rtc: qcom-pm8xxx: add nvmem-cell offset On many Qualcomm platforms the PMIC RTC control and time registers are read-only so that the RTC time can not be updated. Instead an offset needs be stored in some machine-specific non-volatile memory, which a driver can take into account. Add an 'offset' nvmem cell which can be used to store a 32-bit offset from the Unix epoch so that the RTC time can be updated on such platforms. Acked-by: Krzysztof Kozlowski Signed-off-by: Johan Hovold Reviewed-by: David Collins Link: https://lore.kernel.org/r/20230202155448.6715-17-johan+linaro@kernel.org Signed-off-by: Alexandre Belloni commit c978414bf5190c0474d3c98df95228c2635b6021 Merge: e90ff8ede777b 08279468a294d Author: Alexandre Belloni Date: Sat Feb 25 23:31:23 2023 +0100 Merge tag 'rtc-6.2-fixes' into rtc-next commit f195c470f2c2cf3737b2b157a5a2dbe182e374fa Author: Jack Chen Date: Thu Jan 5 16:29:52 2023 -0500 i3c: transfer pid from boardinfo to device info I3C device PID could be defined in device tree and stored in i3c_dev_boardinfo. It should be passed to i3c_device_info when allocating a i3c_dev_desc. Rational behind this change is: when users decide to use SETDASA to assign a dynamic address with exactly the original static address, in step of i3c_master_reattach_i3c_dev, this address is checked to be taken. Then device information retrieving step is skipped. As a result, though the i3c device is registered correctly, its device driver could not be probed. Tested: Tested with a I3C device. If assigned-address is set to be the device's static address, without this change, its device driver could not probed. And with this change, its driver is probed successfully. Signed-off-by: Jack Chen Link: https://lore.kernel.org/r/20230105212952.56321-1-zenghuchen@google.com Signed-off-by: Alexandre Belloni commit 116b41162f8b267987ea9a73eb7e73eaa7c2cce5 Merge: 0447ed0d71251 bd78acc89d414 Author: Linus Torvalds Date: Sat Feb 25 13:06:28 2023 -0800 Merge tag 'probes-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull kprobes cleanup updates from Masami Hiramatsu: "These are probe events cleanups, no new features but improve readability: - Rename print_probe_args() to trace_probe_print_args() and un-inline it - Introduce a set of default data fetch functions for dynamic probe events - Extract common code of data fetch process of dynamic probe events" * tag 'probes-v6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kernel/trace: extract common part in process_fetch_insn kernel/trace: Provide default impelentations defined in trace_probe_tmpl.h kernel/trace: Introduce trace_probe_print_args and use it in *probes commit 0447ed0d71251e8e67c9d15f8d9001a3ab621fcd Merge: 472a2abb7af50 6ba912f1c0814 Author: Linus Torvalds Date: Sat Feb 25 13:02:20 2023 -0800 Merge tag 'kcsan.2023.02.24a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull kernel concurrency sanitizer (KCSAN) updates from Paul McKenney: "This fixes gcc-11 errors for x86_64 KCSAN-enabled kernel builds by selecting the CONSTRUCTORS Kconfig option" * tag 'kcsan.2023.02.24a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: kcsan: select CONFIG_CONSTRUCTORS commit 472a2abb7af5067c45db25fb59c17e828af07886 Merge: e534a583cc438 b942a520d9e43 Author: Linus Torvalds Date: Sat Feb 25 12:53:42 2023 -0800 Merge tag 'flex-array-transformations-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull flexible-array updates from Gustavo Silva: "Transform zero-length arrays, in unions, into flexible arrays" * tag 'flex-array-transformations-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: bcache: Replace zero-length arrays with DECLARE_FLEX_ARRAY() helper mm/memremap: Replace zero-length array with DECLARE_FLEX_ARRAY() helper exportfs: Replace zero-length array with DECLARE_FLEX_ARRAY() helper commit e534a583cc438ec2e9a7dc534c9d80d14b440718 Merge: cac85e4616b1c 290ec1d58049e Author: Linus Torvalds Date: Sat Feb 25 12:49:29 2023 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha Pull alpha updates from Al Viro: "Mostly small janitorial fixes but there's also more important ones: a patch to fix loading large modules from Edward Humes, and some fixes from Al Viro" [ The fixes from Al mostly came in separately through Al's trees too and are now duplicated.. - Linus ] * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha: alpha: in_irq() cleanup alpha: lazy FPU switching alpha/boot/misc: trim unused declarations alpha/boot/tools/objstrip: fix the check for ELF header alpha/boot: fix the breakage from -isystem series... alpha: fix FEN fault handling alpha: Avoid comma separated statements alpha: fixed a typo in core_cia.c alpha: remove unused __SLOW_DOWN_IO and SLOW_DOWN_IO definitions alpha: update config files alpha: fix R_ALPHA_LITERAL reloc for large modules alpha: Add some spaces to ensure format specification alpha: replace NR_SYSCALLS by NR_syscalls alpha: Remove redundant local asm header redirections alpha: Implement "current_stack_pointer" alpha: remove redundant err variable alpha: osf_sys: reduce kernel log spamming on invalid osf_mount call typenr commit e3645d72f8865ffe36f9dc811540d40aa3c848d3 Author: Zhang Yi Date: Sun Jan 29 11:49:39 2023 +0800 ext4: fix incorrect options show of original mount_opt and extend mount_opt2 Current _ext4_show_options() do not distinguish MOPT_2 flag, so it mixed extend sbi->s_mount_opt2 options with sbi->s_mount_opt, it could lead to show incorrect options, e.g. show fc_debug_force if we mount with errors=continue mode and miss it if we set. $ mkfs.ext4 /dev/pmem0 $ mount -o errors=remount-ro /dev/pmem0 /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force #empty $ mount -o remount,errors=continue /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force fc_debug_force $ mount -o remount,errors=remount-ro,fc_debug_force /mnt $ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force #empty Fixes: 995a3ed67fc8 ("ext4: add fast_commit feature and handling for extended mount options") Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230129034939.3702550-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 0813299c586b175d7edb25f56412c54b812d0379 Author: Jan Kara Date: Thu Jan 26 12:22:21 2023 +0100 ext4: Fix possible corruption when moving a directory When we are renaming a directory to a different directory, we need to update '..' entry in the moved directory. However nothing prevents moved directory from being modified and even converted from the inline format to the normal format. When such race happens the rename code gets confused and we crash. Fix the problem by locking the moved directory. CC: stable@vger.kernel.org Fixes: 32f7f22c0b52 ("ext4: let ext4_rename handle inline dir") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20230126112221.11866-1-jack@suse.cz Signed-off-by: Theodore Ts'o commit 172e344e6f82dc266cb65a69f4bed03428ea8a05 Author: Ye Bin Date: Thu Jan 19 09:37:11 2023 +0800 ext4: init error handle resource before init group descriptors Now, 's_err_report' timer is init after ext4_group_desc_init() when fill super. Theoretically, ext4_group_desc_init() may access to error handle as follows: __ext4_fill_super ext4_group_desc_init ext4_check_descriptors ext4_get_group_desc ext4_error ext4_handle_error ext4_commit_super ext4_update_super if (!es->s_error_count) mod_timer(&sbi->s_err_report, jiffies + 24*60*60*HZ); --> Accessing Uninitialized Variables timer_setup(&sbi->s_err_report, print_daily_error_info, 0); Maybe above issue is just theoretical, as ext4_check_descriptors() didn't judge 'gpd' which get from ext4_get_group_desc(), if access to error handle ext4_get_group_desc() will return NULL, then will trigger null-ptr-deref in ext4_check_descriptors(). However, from the perspective of pure code, it is better to initialize resource that may need to be used first. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230119013711.86680-1-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o commit cac85e4616b1cf4a90844b952b49b9cbc4562530 Merge: 84cc6674b76ba d649c34cb916b Author: Linus Torvalds Date: Sat Feb 25 11:52:57 2023 -0800 Merge tag 'vfio-v6.3-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Remove redundant resource check in vfio-platform (Angus Chen) - Use GFP_KERNEL_ACCOUNT for persistent userspace allocations, allowing removal of arbitrary kernel limits in favor of cgroup control (Yishai Hadas) - mdev tidy-ups, including removing the module-only build restriction for sample drivers, Kconfig changes to select mdev support, documentation movement to keep sample driver usage instructions with sample drivers rather than with API docs, remove references to out-of-tree drivers in docs (Christoph Hellwig) - Fix collateral breakages from mdev Kconfig changes (Arnd Bergmann) - Make mlx5 migration support match device support, improve source and target flows to improve pre-copy support and reduce downtime (Yishai Hadas) - Convert additional mdev sysfs case to use sysfs_emit() (Bo Liu) - Resolve copy-paste error in mdev mbochs sample driver Kconfig (Ye Xingchen) - Avoid propagating missing reset error in vfio-platform if reset requirement is relaxed by module option (Tomasz Duszynski) - Range size fixes in mlx5 variant driver for missed last byte and stricter range calculation (Yishai Hadas) - Fixes to suspended vaddr support and locked_vm accounting, excluding mdev configurations from the former due to potential to indefinitely block kernel threads, fix underflow and restore locked_vm on new mm (Steve Sistare) - Update outdated vfio documentation due to new IOMMUFD interfaces in recent kernels (Yi Liu) - Resolve deadlock between group_lock and kvm_lock, finally (Matthew Rosato) - Fix NULL pointer in group initialization error path with IOMMUFD (Yan Zhao) * tag 'vfio-v6.3-rc1' of https://github.com/awilliam/linux-vfio: (32 commits) vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd docs: vfio: Update vfio.rst per latest interfaces vfio: Update the kdoc for vfio_device_ops vfio/mlx5: Fix range size calculation upon tracker creation vfio: no need to pass kvm pointer during device open vfio: fix deadlock between group lock and kvm lock vfio: revert "iommu driver notify callback" vfio/type1: revert "implement notify callback" vfio/type1: revert "block on invalid vaddr" vfio/type1: restore locked_vm vfio/type1: track locked_vm per dma vfio/type1: prevent underflow of locked_vm via exec() vfio/type1: exclude mdevs from VFIO_UPDATE_VADDR vfio: platform: ignore missing reset if disabled at module init vfio/mlx5: Improve the target side flow to reduce downtime vfio/mlx5: Improve the source side flow upon pre_copy vfio/mlx5: Check whether VF is migratable samples: fix the prompt about SAMPLE_VFIO_MDEV_MBOCHS vfio/mdev: Use sysfs_emit() to instead of sprintf() vfio-mdev: add back CONFIG_VFIO dependency ... commit 84cc6674b76ba2cdac0df8037b4d8a22a6fc1b77 Merge: 49d575926890e deeacf35c922d Author: Linus Torvalds Date: Sat Feb 25 11:48:02 2023 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: - device feature provisioning in ifcvf, mlx5 - new SolidNET driver - support for zoned block device in virtio blk - numa support in virtio pmem - VIRTIO_F_RING_RESET support in vhost-net - more debugfs entries in mlx5 - resume support in vdpa - completion batching in virtio blk - cleanup of dma api use in vdpa - now simulating more features in vdpa-sim - documentation, features, fixes all over the place * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (64 commits) vdpa/mlx5: support device features provisioning vdpa/mlx5: make MTU/STATUS presence conditional on feature bits vdpa: validate device feature provisioning against supported class vdpa: validate provisioned device features against specified attribute vdpa: conditionally read STATUS in config space vdpa: fix improper error message when adding vdpa dev vdpa/mlx5: Initialize CVQ iotlb spinlock vdpa/mlx5: Don't clear mr struct on destroy MR vdpa/mlx5: Directly assign memory key tools/virtio: enable to build with retpoline vringh: fix a typo in comments for vringh_kiov vhost-vdpa: print warning when vhost_vdpa_alloc_domain fails scsi: virtio_scsi: fix handling of kmalloc failure vdpa: Fix a couple of spelling mistakes in some messages vhost-net: support VIRTIO_F_RING_RESET vhost-scsi: convert sysfs snprintf and sprintf to sysfs_emit vdpa: mlx5: support per virtqueue dma device vdpa: set dma mask for vDPA device virtio-vdpa: support per vq dma device vdpa: introduce get_vq_dma_device() ... commit 49d575926890e6ada930bf6f06d62b2fde8fce95 Merge: 01687e7c935ef 45dd9bc75d9ad Author: Linus Torvalds Date: Sat Feb 25 11:30:21 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "ARM: - Provide a virtual cache topology to the guest to avoid inconsistencies with migration on heterogenous systems. Non secure software has no practical need to traverse the caches by set/way in the first place - Add support for taking stage-2 access faults in parallel. This was an accidental omission in the original parallel faults implementation, but should provide a marginal improvement to machines w/o FEAT_HAFDBS (such as hardware from the fruit company) - A preamble to adding support for nested virtualization to KVM, including vEL2 register state, rudimentary nested exception handling and masking unsupported features for nested guests - Fixes to the PSCI relay that avoid an unexpected host SVE trap when resuming a CPU when running pKVM - VGIC maintenance interrupt support for the AIC - Improvements to the arch timer emulation, primarily aimed at reducing the trap overhead of running nested - Add CONFIG_USERFAULTFD to the KVM selftests config fragment in the interest of CI systems - Avoid VM-wide stop-the-world operations when a vCPU accesses its own redistributor - Serialize when toggling CPACR_EL1.SMEN to avoid unexpected exceptions in the host - Aesthetic and comment/kerneldoc fixes - Drop the vestiges of the old Columbia mailing list and add [Oliver] as co-maintainer RISC-V: - Fix wrong usage of PGDIR_SIZE instead of PUD_SIZE - Correctly place the guest in S-mode after redirecting a trap to the guest - Redirect illegal instruction traps to guest - SBI PMU support for guest s390: - Sort out confusion between virtual and physical addresses, which currently are the same on s390 - A new ioctl that performs cmpxchg on guest memory - A few fixes x86: - Change tdp_mmu to a read-only parameter - Separate TDP and shadow MMU page fault paths - Enable Hyper-V invariant TSC control - Fix a variety of APICv and AVIC bugs, some of them real-world, some of them affecting architecurally legal but unlikely to happen in practice - Mark APIC timer as expired if its in one-shot mode and the count underflows while the vCPU task was being migrated - Advertise support for Intel's new fast REP string features - Fix a double-shootdown issue in the emergency reboot code - Ensure GIF=1 and disable SVM during an emergency reboot, i.e. give SVM similar treatment to VMX - Update Xen's TSC info CPUID sub-leaves as appropriate - Add support for Hyper-V's extended hypercalls, where "support" at this point is just forwarding the hypercalls to userspace - Clean up the kvm->lock vs. kvm->srcu sequences when updating the PMU and MSR filters - One-off fixes and cleanups - Fix and cleanup the range-based TLB flushing code, used when KVM is running on Hyper-V - Add support for filtering PMU events using a mask. If userspace wants to restrict heavily what events the guest can use, it can now do so without needing an absurd number of filter entries - Clean up KVM's handling of "PMU MSRs to save", especially when vPMU support is disabled - Add PEBS support for Intel Sapphire Rapids - Fix a mostly benign overflow bug in SEV's send|receive_update_data() - Move several SVM-specific flags into vcpu_svm x86 Intel: - Handle NMI VM-Exits before leaving the noinstr region - A few trivial cleanups in the VM-Enter flows - Stop enabling VMFUNC for L1 purely to document that KVM doesn't support EPTP switching (or any other VM function) for L1 - Fix a crash when using eVMCS's enlighted MSR bitmaps Generic: - Clean up the hardware enable and initialization flow, which was scattered around multiple arch-specific hooks. Instead, just let the arch code call into generic code. Both x86 and ARM should benefit from not having to fight common KVM code's notion of how to do initialization - Account allocations in generic kvm_arch_alloc_vm() - Fix a memory leak if coalesced MMIO unregistration fails selftests: - On x86, cache the CPU vendor (AMD vs. Intel) and use the info to emit the correct hypercall instruction instead of relying on KVM to patch in VMMCALL - Use TAP interface for kvm_binary_stats_test and tsc_msrs_test" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (325 commits) KVM: SVM: hyper-v: placate modpost section mismatch error KVM: x86/mmu: Make tdp_mmu_allowed static KVM: arm64: nv: Use reg_to_encoding() to get sysreg ID KVM: arm64: nv: Only toggle cache for virtual EL2 when SCTLR_EL2 changes KVM: arm64: nv: Filter out unsupported features from ID regs KVM: arm64: nv: Emulate EL12 register accesses from the virtual EL2 KVM: arm64: nv: Allow a sysreg to be hidden from userspace only KVM: arm64: nv: Emulate PSTATE.M for a guest hypervisor KVM: arm64: nv: Add accessors for SPSR_EL1, ELR_EL1 and VBAR_EL1 from virtual EL2 KVM: arm64: nv: Handle SMCs taken from virtual EL2 KVM: arm64: nv: Handle trapped ERET from virtual EL2 KVM: arm64: nv: Inject HVC exceptions to the virtual EL2 KVM: arm64: nv: Support virtual EL2 exceptions KVM: arm64: nv: Handle HCR_EL2.NV system register traps KVM: arm64: nv: Add nested virt VCPU primitives for vEL2 VCPU state KVM: arm64: nv: Add EL2 system registers to vcpu context KVM: arm64: nv: Allow userspace to set PSR_MODE_EL2x KVM: arm64: nv: Reset VCPU to EL2 registers if VCPU nested virt is set KVM: arm64: nv: Introduce nested virtualization VCPU feature KVM: arm64: Use the S2 MMU context to iterate over S2 table ... commit 01687e7c935ef70eca69ea2d468020bc93e898dc Merge: d0a32f5520a33 eb9be8310c58c Author: Linus Torvalds Date: Sat Feb 25 11:14:08 2023 -0800 Merge tag 'riscv-for-linus-6.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: "There's a bunch of fixes/cleanups throughout the tree as usual, but we also have a handful of new features: - Various improvements to the extension detection and alternative patching infrastructure - Zbb-optimized string routines - Support for cpu-capacity in the RISC-V DT bindings - Zicbom no longer depends on toolchain support - Some performance and code size improvements to ftrace - Support for ARCH_WANT_LD_ORPHAN_WARN - Oops now contain the faulting instruction" * tag 'riscv-for-linus-6.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (67 commits) RISC-V: add a spin_shadow_stack declaration riscv: mm: hugetlb: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP riscv: Add header include guards to insn.h riscv: alternative: proceed one more instruction for auipc/jalr pair riscv: Avoid enabling interrupts in die() riscv, mm: Perform BPF exhandler fixup on page fault RISC-V: take text_mutex during alternative patching riscv: hwcap: Don't alphabetize ISA extension IDs RISC-V: fix ordering of Zbb extension riscv: jump_label: Fixup unaligned arch_static_branch function RISC-V: Only provide the single-letter extensions in HWCAP riscv: mm: fix regression due to update_mmu_cache change scripts/decodecode: Add support for RISC-V riscv: Add instruction dump to RISC-V splats riscv: select ARCH_WANT_LD_ORPHAN_WARN for !XIP_KERNEL riscv: vmlinux.lds.S: explicitly catch .init.bss sections from EFI stub riscv: vmlinux.lds.S: explicitly catch .riscv.attributes sections riscv: vmlinux.lds.S: explicitly catch .rela.dyn symbols riscv: lds: define RUNTIME_DISCARD_EXIT RISC-V: move some stray __RISCV_INSN_FUNCS definitions from kprobes ... commit 2b2d50bdd258f8ef37c25f7d5f0d7ba694066dec Author: Jarkko Sakkinen Date: Thu Jan 26 21:56:12 2023 +0000 scripts: coccicheck: Use /usr/bin/env If bash is not located under /bin, coccicheck fails to run. In the real world, this happens for instance when NixOS is used in the host. Instead, use /usr/bin/env to locate the executable binary for bash. Signed-off-by: Jarkko Sakkinen Tested-by: Deepak R Varma Signed-off-by: Julia Lawall commit 180da5ef84fba0a8ea06870a38d6d657d689944a Author: Peter Foley Date: Fri Jan 13 12:29:36 2023 -0500 scripts: coccicheck: Avoid warning about spurious escape e.g. grep: warning: stray \ before - Signed-off-by: Peter Foley Signed-off-by: Julia Lawall commit d0a32f5520a33e7f2ace396db6913625e0d29544 Merge: 5596c6adb04d0 f82cdc37c4bd4 Author: Linus Torvalds Date: Sat Feb 25 11:00:06 2023 -0800 Merge tag 'powerpc-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Support for configuring secure boot with user-defined keys on PowerVM LPARs - Simplify the replay of soft-masked IRQs by making it non-recursive - Add support for KCSAN on 64-bit Book3S - Improvements to the API & code which interacts with RTAS (pseries firmware) - Change 32-bit powermac to assign PCI bus numbers per domain by default - Some improvements to the 32-bit BPF JIT - Various other small features and fixes Thanks to Anders Roxell, Andrew Donnellan, Andrew Jeffery, Benjamin Gray, Christophe Leroy, Frederic Barrat, Ganesh Goudar, Geoff Levand, Greg Kroah-Hartman, Jan-Benedict Glaw, Josh Poimboeuf, Kajol Jain, Laurent Dufour, Mahesh Salgaonkar, Mathieu Desnoyers, Mimi Zohar, Murphy Zhou, Nathan Chancellor, Nathan Lynch, Nayna Jain, Nicholas Piggin, Pali Rohár, Petr Mladek, Rohan McLure, Russell Currey, Sachin Sant, Sathvika Vasireddy, Sourabh Jain, Stefan Berger, Stephen Rothwell, and Sudhakar Kuppusamy. * tag 'powerpc-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (114 commits) powerpc/pseries: Avoid hcall in plpks_is_available() on non-pseries powerpc: dts: turris1x.dts: Set lower priority for CPLD syscon-reboot powerpc/e500: Add missing prototype for 'relocate_init' powerpc/64: Fix unannotated intra-function call warning powerpc/epapr: Don't use wrteei on non booke powerpc: Pass correct CPU reference to assembler powerpc/mm: Rearrange if-else block to avoid clang warning powerpc/nohash: Fix build with llvm-as powerpc/nohash: Fix build error with binutils >= 2.38 powerpc/pseries: Fix endianness issue when parsing PLPKS secvar flags macintosh: windfarm: Use unsigned type for 1-bit bitfields powerpc/kexec_file: print error string on usable memory property update failure powerpc/machdep: warn when machine_is() used too early powerpc/64: Replace -mcpu=e500mc64 by -mcpu=e5500 powerpc/eeh: Set channel state after notifying the drivers selftests/powerpc: Fix incorrect kernel headers search path powerpc/rtas: arch-wide function token lookup conversions powerpc/rtas: introduce rtas_function_token() API powerpc/pseries/lpar: convert to papr_sysparm API powerpc/pseries/hv-24x7: convert to papr_sysparm API ... commit 5596c6adb04d00cad445641a35f1f1745de57119 Merge: 7c3dc440b1f5c 91dc288f4edf0 Author: Linus Torvalds Date: Sat Feb 25 10:56:39 2023 -0800 Merge tag 'mips_6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: "Just cleanups and fixes" * tag 'mips_6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: vpe-mt: drop physical_memsize mips: fix syscall_get_nr MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set MIPS: DTS: jz4780: add #clock-cells to rtc_dev MIPS: dts: Boston: Fix dtc 'pci_device_reg' warning mips: dts: ralink: mt7621: add port@5 as CPU port mips: dts: align LED node names with dtschema MIPS: ralink: Use devm_platform_get_and_ioremap_resource() MIPS: pci-mt7620: Use devm_platform_get_and_ioremap_resource() MIPS: pci: lantiq: Use devm_platform_get_and_ioremap_resource() MIPS: lantiq: xway: Use devm_platform_get_and_ioremap_resource() MIPS: BCM47XX: Add support for Linksys E2500 V3 mips: ralink: make SOC_MT7621 select PINCTRL_MT7621 and fix help section MIPS: DTS: CI20: fix otg power gpio MIPS: dts: lantiq: Remove bogus interrupt-parent; line MIPS: Fix a compilation issue MIPS: remove CONFIG_MIPS_LD_CAN_LINK_VDSO mips: Realtek RTL: select NO_EXCEPT_FILL MIPS: OCTEON: octeon-usb: Consolidate error messages commit 7c3dc440b1f5c75f45e24430f913e561dc82a419 Merge: d8e473182ab9e e686c32590f40 Author: Linus Torvalds Date: Sat Feb 25 09:19:23 2023 -0800 Merge tag 'cxl-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull Compute Express Link (CXL) updates from Dan Williams: "To date Linux has been dependent on platform-firmware to map CXL RAM regions and handle events / errors from devices. With this update we can now parse / update the CXL memory layout, and report events / errors from devices. This is a precursor for the CXL subsystem to handle the end-to-end "RAS" flow for CXL memory. i.e. the flow that for DDR-attached-DRAM is handled by the EDAC driver where it maps system physical address events to a field-replaceable-unit (FRU / endpoint device). In general, CXL has the potential to standardize what has historically been a pile of memory-controller-specific error handling logic. Another change of note is the default policy for handling RAM-backed device-dax instances. Previously the default access mode was "device", mmap(2) a device special file to access memory. The new default is "kmem" where the address range is assigned to the core-mm via add_memory_driver_managed(). This saves typical users from wondering why their platform memory is not visible via free(1) and stuck behind a device-file. At the same time it allows expert users to deploy policy to, for example, get dedicated access to high performance memory, or hide low performance memory from general purpose kernel allocations. This affects not only CXL, but also systems with high-bandwidth-memory that platform-firmware tags with the EFI_MEMORY_SP (special purpose) designation. Summary: - CXL RAM region enumeration: instantiate 'struct cxl_region' objects for platform firmware created memory regions - CXL RAM region provisioning: complement the existing PMEM region creation support with RAM region support - "Soft Reservation" policy change: Online (memory hot-add) soft-reserved memory (EFI_MEMORY_SP) by default, but still allow for setting aside such memory for dedicated access via device-dax. - CXL Events and Interrupts: Takeover CXL event handling from platform-firmware (ACPI calls this CXL Memory Error Reporting) and export CXL Events via Linux Trace Events. - Convey CXL _OSC results to drivers: Similar to PCI, let the CXL subsystem interrogate the result of CXL _OSC negotiation. - Emulate CXL DVSEC Range Registers as "decoders": Allow for first-generation devices that pre-date the definition of the CXL HDM Decoder Capability to translate the CXL DVSEC Range Registers into 'struct cxl_decoder' objects. - Set timestamp: Per spec, set the device timestamp in case of hotplug, or if platform-firwmare failed to set it. - General fixups: linux-next build issues, non-urgent fixes for pre-production hardware, unit test fixes, spelling and debug message improvements" * tag 'cxl-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (66 commits) dax/kmem: Fix leak of memory-hotplug resources cxl/mem: Add kdoc param for event log driver state cxl/trace: Add serial number to trace points cxl/trace: Add host output to trace points cxl/trace: Standardize device information output cxl/pci: Remove locked check for dvsec_range_allowed() cxl/hdm: Add emulation when HDM decoders are not committed cxl/hdm: Create emulated cxl_hdm for devices that do not have HDM decoders cxl/hdm: Emulate HDM decoder from DVSEC range registers cxl/pci: Refactor cxl_hdm_decode_init() cxl/port: Export cxl_dvsec_rr_decode() to cxl_port cxl/pci: Break out range register decoding from cxl_hdm_decode_init() cxl: add RAS status unmasking for CXL cxl: remove unnecessary calling of pci_enable_pcie_error_reporting() dax/hmem: build hmem device support as module if possible dax: cxl: add CXL_REGION dependency cxl: avoid returning uninitialized error code cxl/pmem: Fix nvdimm registration races cxl/mem: Fix UAPI command comment cxl/uapi: Tag commands from cxl_query_cmd() ... commit d8e473182ab9e85708067be81d20424045d939fa Merge: 489fa31ea8732 1e70c680375aa Author: Linus Torvalds Date: Sat Feb 25 09:11:30 2023 -0800 Merge tag 'x86_tdx_for_6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull Intel Trust Domain Extensions (TDX) updates from Dave Hansen: "Other than a minor fixup, the content here is to ensure that TDX guests never see virtualization exceptions (#VE's) that might be induced by the untrusted VMM. This is a highly desirable property. Without it, #VE exception handling would fall somewhere between NMIs, machine checks and total insanity. With it, #VE handling remains pretty mundane. Summary: - Fixup comment typo - Prevent unexpected #VE's from: - Hosts removing perfectly good guest mappings (SEPT_VE_DISABLE) - Excessive #VE notifications (NOTIFY_ENABLES) which are delivered via a #VE" * tag 'x86_tdx_for_6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tdx: Do not corrupt frame-pointer in __tdx_hypercall() x86/tdx: Disable NOTIFY_ENABLES x86/tdx: Relax SEPT_VE_DISABLE check for debug TD x86/tdx: Use ReportFatalError to report missing SEPT_VE_DISABLE x86/tdx: Expand __tdx_hypercall() to handle more arguments x86/tdx: Refactor __tdx_hypercall() to allow pass down more arguments x86/tdx: Add more registers to struct tdx_hypercall_args x86/tdx: Fix typo in comment in __tdx_hypercall() commit 8883bf83127d533abb415b204eabc064863ae6c9 Author: Qing Zhang Date: Sat Feb 25 15:52:57 2023 +0800 selftests/ftrace: Add LoongArch kprobe args string tests support Before: [5] Kprobe event string type argument [UNTESTED] [7] Kprobe event argument syntax [UNTESTED] After: [5] Kprobe event string type argument [PASS] [7] Kprobe event argument syntax [PASS] Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit eb4071b988397144a35c4aa98061f587cbb3b467 Author: Huacai Chen Date: Sat Feb 25 15:52:57 2023 +0800 selftests/seccomp: Add LoongArch selftesting support BPF for LoongArch is supported now, add the selftesting support in seccomp_bpf.c. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 121ff07bdee06555835e26499f5c125223a6beb3 Author: Huacai Chen Date: Sat Feb 25 15:52:57 2023 +0800 tools: Add LoongArch build infrastructure We will add tools support for LoongArch (bpf, perf, objtool, etc.), add build infrastructure and common headers for preparation. Signed-off-by: Huacai Chen commit a6484baa3b02b9d71bfd6016e7632dd1c02d5cba Author: Tiezhu Yang Date: Sat Feb 25 15:52:57 2023 +0800 samples/kprobes: Add LoongArch support Add LoongArch specific info in handler_pre() and handler_post(). Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit fcf77d016216ae75a19078e1079c2511a6319a49 Author: Tiezhu Yang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: Mark some assembler symbols as non-kprobe-able Some assembler symbols are not kprobe safe, such as handle_syscall (used as syscall exception handler), *memset*/*memcpy*/*memmove* (may cause recursive exceptions), they can not be instrumented, just blacklist them for kprobing. Here is a related problem and discussion: Link: https://lore.kernel.org/lkml/20230114143859.7ccc45c1c5d9ce302113ab0a@kernel.org/ Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 09e679c28a4def4ea8d4f618503c1d55c355ae5c Author: Tiezhu Yang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: Add kprobes on ftrace support Add kprobe_ftrace_handler() and arch_prepare_kprobe_ftrace() to support kprobes on ftrace, the code is similar with x86 and riscv. Here is a simple example: # echo 'p:myprobe kernel_clone' > /sys/kernel/debug/tracing/kprobe_events # echo 'r:myretprobe kernel_clone $retval' >> /sys/kernel/debug/tracing/kprobe_events # echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable # echo 1 > /sys/kernel/debug/tracing/events/kprobes/myretprobe/enable # echo 1 > /sys/kernel/debug/tracing/tracing_on # cat /sys/kernel/debug/tracing/trace # tracer: nop # # entries-in-buffer/entries-written: 2/2 #P:4 # # _-----=> irqs-off/BH-disabled # / _----=> need-resched # | / _---=> hardirq/softirq # || / _--=> preempt-depth # ||| / _-=> migrate-disable # |||| / delay # TASK-PID CPU# ||||| TIMESTAMP FUNCTION # | | | ||||| | | bash-488 [002] ..... 2041.190681: myprobe: (kernel_clone+0x0/0x40c) bash-488 [002] ..... 2041.190788: myretprobe: (__do_sys_clone+0x84/0xb8 <- kernel_clone) arg1=0x200 Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 3f5536860086d906b01ec5ed68cf50c7edcc40af Author: Tiezhu Yang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: Add kretprobes support Use the generic kretprobe trampoline handler to add kretprobes support for LoongArch. Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 6d4cc40fb5f58147defc6c0e9d86e6232fe31616 Author: Tiezhu Yang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: Add kprobes support Kprobes allows you to trap at almost any kernel address and execute a callback function, this commit adds kprobes support for LoongArch. Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 9b3441a6b0e1ed4796e7f5a8586c4d6023c4e3ab Author: Tiezhu Yang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: Simulate branch and PC* instructions According to LoongArch Reference Manual, simulate branch and PC* instructions, this is preparation for later patch. Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#branch-instructions Link: https://loongson.github.io/LoongArch-Documentation/LoongArch-Vol1-EN.html#_pcaddi_pcaddu121_pcaddu18l_pcalau12i Tested-by: Jeff Xie Co-developed-by: Jinyang He Signed-off-by: Jinyang He Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 424421a7f34c1222d20a6c279f13b9caa71ecc83 Author: Qing Zhang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: ptrace: Add hardware single step support Use the generic ptrace_resume code for PTRACE_SYSCALL, PTRACE_CONT, PTRACE_KILL and PTRACE_SINGLESTEP handling. This implies defining arch_has_single_step() and implementing the user_enable_single_step() and user_disable_single_step() functions. LoongArch cannot do hardware single-stepping per se, the hardware single-stepping it is achieved by configuring the instruction fetch watchpoints (FWPS) and specifies that the next instruction must trigger the watch exception by setting the mask bit. In some scenarios CSR.FWPS.Skip is used to ignore the next hit result, avoid endless repeated triggering of the same watchpoint without canceling it. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 356bd6f23682f11f7afe923d86c7f5f852b97fb2 Author: Qing Zhang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: ptrace: Add function argument access API Add regs_get_argument() which returns N th argument of the function call, This enables ftrace kprobe events to access kernel function arguments via $argN syntax for later use. E.g.: echo 'p bio_add_page arg1=$arg1' > kprobe_events bash: echo: write error: Invalid argument Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 1a69f7a161a78aead07cd4b811d796950e892fa4 Author: Qing Zhang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: ptrace: Expose hardware breakpoints to debuggers Implement the regset-based ptrace interface that exposes hardware breakpoints to user-space debuggers to query and set instruction and data breakpoints. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit edffa33c7bb5a73e90c754c7a497162b77d7c55f Author: Qing Zhang Date: Sat Feb 25 15:52:57 2023 +0800 LoongArch: Add hardware breakpoints/watchpoints support Use perf framework to manage hardware instruction and data breakpoints. LoongArch defines hardware watchpoint functions for instruction fetch and memory load/store operations. After the software configures hardware watchpoints, the processor hardware will monitor the access address of the instruction fetch and load/store operation, and trigger an exception of the watchpoint when it meets the conditions set by the watchpoint. The hardware monitoring points for instruction fetching and load/store operations each have a register for the overall configuration of all monitoring points, a register for recording the status of all monitoring points, and four registers required for configuration of each watchpoint individually. Signed-off-by: Qing Zhang Signed-off-by: Huacai Chen commit 35c94fab6eee72d60d9cd8d1e6e43e1f77b1dce2 Author: Youling Tang Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: kdump: Add crashkernel=YM handling When the kernel crashkernel parameter is specified with just a size, we are supposed to allocate a region from RAM to store the crashkernel, "crashkernel=512M" would be recommended for kdump. Fix this by lifting similar code from x86, importing it to LoongArch with LoongArch specific parameters added. We allocate the crashkernel region from the first 4GB of physical memory (because SWIOTLB should be allocated below 4GB). However, LoongArch currently does not implement crashkernel_low and crashkernel_high the same as x86. When X is not specified, crash_base defaults to 0 (crashkernel=YM@XM). Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 3f89765d6227fe4645a91e062332b6b4eb24072c Author: Youling Tang Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: kdump: Add single kernel image implementation This feature depends on the kernel being relocatable. Enable using single kernel image for kdump, and then no longer need to build two kernels (production kernel and capture kernel share a single kernel image). Also enable CONFIG_CRASH_DUMP in loongson3_defconfig. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit e5f02b51fa0cb785e352e77271a65e96051b789b Author: Youling Tang Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Add support for kernel address space layout randomization (KASLR) This patch adds support for relocating the kernel to a random address. Entropy is derived from the banner, which will change every build and random_get_entropy() which should provide additional runtime entropy. The kernel is relocated by up to RANDOMIZE_BASE_MAX_OFFSET bytes from its link address. Because relocation happens so early during the kernel booting, the amount of physical memory has not yet been determined. This means the only way to limit relocation within the available memory is via Kconfig. So we limit the maximum value of RANDOMIZE_BASE_MAX_OFFSET to 256M (0x10000000) because our memory layout has many holes. Signed-off-by: Youling Tang Signed-off-by: Xi Ruoyao # Fix compiler warnings Signed-off-by: Huacai Chen commit d8da19fbdedd5852592fbba18a7348e3f09500e6 Author: Youling Tang Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Add support for kernel relocation This config allows to compile kernel as PIE and to relocate it at any virtual address at runtime: this paves the way to KASLR. Runtime relocation is possible since relocation metadata are embedded into the kernel. Signed-off-by: Youling Tang Signed-off-by: Xi Ruoyao # Use arch_initcall Signed-off-by: Jinyang He # Provide la_abs relocation code Signed-off-by: Huacai Chen commit 396233c650084cb957eb6d87dd4abd3e56a7d499 Author: Youling Tang Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Add la_abs macro implementation Use the "la_abs macro" instead of the "la.abs pseudo instruction" to prepare for the subsequent PIE kernel. When PIE is not enabled, la_abs is equivalent to la.abs. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 8cbd5ebfe241699288cb152081854414f6265718 Author: Youling Tang Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Add JUMP_VIRT_ADDR macro implementation to avoid using la.abs Add JUMP_VIRT_ADDR macro implementation to avoid using la.abs directly. This is a preparation for subsequent patches. Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit f733f119e9b31088063652a7ad16963d85cb73dd Author: Xi Ruoyao Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Use la.pcrel instead of la.abs when it's trivially possible Let's start to kill la.abs in preparation for the subsequent support of the PIE kernel. BTW, Re-tab the indention in arch/loongarch/kernel/entry.S for alignment. Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit 41596803302d83a67a80dc1efef4e51ac46acabb Author: Huacai Chen Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Make -mstrict-align configurable Introduce Kconfig option ARCH_STRICT_ALIGN to make -mstrict-align be configurable. Not all LoongArch cores support h/w unaligned access, we can use the -mstrict-align build parameter to prevent unaligned accesses. CPUs with h/w unaligned access support: Loongson-2K2000/2K3000/3A5000/3C5000/3D5000. CPUs without h/w unaligned access support: Loongson-2K500/2K1000. This option is enabled by default to make the kernel be able to run on all LoongArch systems. But you can disable it manually if you want to run kernel only on systems with h/w unaligned access support in order to optimise for performance. Reviewed-by: Arnd Bergmann Signed-off-by: Huacai Chen commit bb7a78e343468873bf00b2b181fcfd3c02d8cb56 Author: Tiezhu Yang Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Only call get_timer_irq() once in constant_clockevent_init() Under CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_DEBUG_PREEMPT=y, we can see the following messages on LoongArch, this is because using might_sleep() in preemption disable context. [ 0.001127] smp: Bringing up secondary CPUs ... [ 0.001222] Booting CPU#1... [ 0.001244] 64-bit Loongson Processor probed (LA464 Core) [ 0.001247] CPU1 revision is: 0014c012 (Loongson-64bit) [ 0.001250] FPU1 revision is: 00000000 [ 0.001252] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 [ 0.001255] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 0.001257] preempt_count: 1, expected: 0 [ 0.001258] RCU nest depth: 0, expected: 0 [ 0.001259] Preemption disabled at: [ 0.001261] [<9000000000223800>] arch_dup_task_struct+0x20/0x110 [ 0.001272] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc7+ #43 [ 0.001275] Hardware name: Loongson Loongson-3A5000-7A1000-1w-A2101/Loongson-LS3A5000-7A1000-1w-A2101, BIOS vUDK2018-LoongArch-V4.0.05132-beta10 12/13/202 [ 0.001277] Stack : 0072617764726148 0000000000000000 9000000000222f1c 90000001001e0000 [ 0.001286] 90000001001e3be0 90000001001e3be8 0000000000000000 0000000000000000 [ 0.001292] 90000001001e3be8 0000000000000040 90000001001e3cb8 90000001001e3a50 [ 0.001297] 9000000001642000 90000001001e3be8 be694d10ce4139dd 9000000100174500 [ 0.001303] 0000000000000001 0000000000000001 00000000ffffe0a2 0000000000000020 [ 0.001309] 000000000000002f 9000000001354116 00000000056b0000 ffffffffffffffff [ 0.001314] 0000000000000000 0000000000000000 90000000014f6e90 9000000001642000 [ 0.001320] 900000000022b69c 0000000000000001 0000000000000000 9000000001736a90 [ 0.001325] 9000000100038000 0000000000000000 9000000000222f34 0000000000000000 [ 0.001331] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 [ 0.001337] ... [ 0.001339] Call Trace: [ 0.001342] [<9000000000222f34>] show_stack+0x5c/0x180 [ 0.001346] [<90000000010bdd80>] dump_stack_lvl+0x60/0x88 [ 0.001352] [<9000000000266418>] __might_resched+0x180/0x1cc [ 0.001356] [<90000000010c742c>] mutex_lock+0x20/0x64 [ 0.001359] [<90000000002a8ccc>] irq_find_matching_fwspec+0x48/0x124 [ 0.001364] [<90000000002259c4>] constant_clockevent_init+0x68/0x204 [ 0.001368] [<900000000022acf4>] start_secondary+0x40/0xa8 [ 0.001371] [<90000000010c0124>] smpboot_entry+0x60/0x64 Here are the complete call chains: smpboot_entry() start_secondary() constant_clockevent_init() get_timer_irq() irq_find_matching_fwnode() irq_find_matching_fwspec() mutex_lock() might_sleep() __might_sleep() __might_resched() In order to avoid the above issue, we should break the call chains, using timer_irq_installed variable as check condition to only call get_timer_irq() once in constant_clockevent_init() is a simple and proper way. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit fd200632d09dcea9fd67714241155b7635505cd6 Author: Jinyang He Date: Sat Feb 25 15:52:56 2023 +0800 LoongArch: Fix Chinese comma in cpu.h Fix Chinese comma introduced by accident in cpu.h. Signed-off-by: Jinyang He Signed-off-by: Huacai Chen commit 0c058fb94ae0e2a68639f4569de1c3abf5df7ad7 Author: Saravana Kannan Date: Fri Feb 24 22:54:42 2023 -0800 driver core: fw_devlink: Print full path and name of fwnode Some of the log messages were printing just the fwnode name. While it's short, it's not always uniquely identifiable in system. So print the full path and name to make debugging easier. Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20230225065443.278284-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit 6309872413f14f3d58c13ae4dc85b1a7004b4193 Author: Saravana Kannan Date: Fri Feb 24 22:41:47 2023 -0800 driver core: fw_devlink: Avoid spurious error message fw_devlink can sometimes try to create a device link with the consumer and supplier as the same device. These attempts will fail (correctly), but are harmless. So, avoid printing an error for these cases. Also, add more detail to the error message. Fixes: 3fb16866b51d ("driver core: fw_devlink: Make cycle detection more robust") Reported-by: Vladimir Oltean Reported-by: Dmitry Baryshkov Signed-off-by: Saravana Kannan Link: https://lore.kernel.org/r/20230225064148.274376-1-saravanak@google.com Signed-off-by: Greg Kroah-Hartman commit e8b812b3e515742a4faaf2e4722bdc5755b98f56 Author: Geert Uytterhoeven Date: Tue Feb 21 13:53:51 2023 +0100 driver core: bus: Handle early calls to bus_to_subsys() When calling soc_device_match() from early_initcall(), bus_kset is still NULL, causing a crash: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 ... Call trace: __lock_acquire+0x530/0x20f0 lock_acquire.part.0+0xc8/0x210 lock_acquire+0x64/0x80 _raw_spin_lock+0x4c/0x60 bus_to_subsys+0x24/0xac bus_for_each_dev+0x30/0xcc soc_device_match+0x4c/0xe0 r8a7795_sysc_init+0x18/0x60 rcar_sysc_pd_init+0xb0/0x33c do_one_initcall+0x128/0x2bc Before, bus_for_each_dev() handled this gracefully by checking that the back-pointer to the private structure was valid. Fix this by adding a NULL check for bus_kset to bus_to_subsys(). Fixes: 83b9148df2c95e23 ("driver core: bus: bus iterator cleanups") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/0a92979f6e790737544638e8a4c19b0564e660a2.1676983596.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 4093b0062f100e69c01812ff73bca2b7521f467f Merge: c9c3395d5e3dc 6fffbc7ae1373 Author: Huacai Chen Date: Sat Feb 25 15:48:46 2023 +0800 Merge 'pci/enumeration' into loongarch-next LoongArch architecture changes for 6.3 depend on the pci changes to work well, so merge them to create a base. commit 290ec1d58049e6203062d5fc796c50852112ae00 Author: Changbin Du Date: Sat Aug 14 09:01:03 2021 +0800 alpha: in_irq() cleanup Replace the obsolete and ambiguos macro in_irq() with new macro in_hardirq(). Signed-off-by: Changbin Du Signed-off-by: Matt Turner commit 050966666047b5013fe44944cef9e9605bdf6cfe Author: Al Viro Date: Fri Sep 2 02:50:12 2022 +0100 alpha: lazy FPU switching On each context switch we save the FPU registers on stack of old process and restore FPU registers from the stack of new one. That allows us to avoid doing that each time we enter/leave the kernel mode; however, that can get suboptimal in some cases. For one thing, we don't need to bother saving anything for kernel threads. For another, if between entering and leaving the kernel a thread gives CPU up more than once, it will do useless work, saving the same values every time, only to discard the saved copy as soon as it returns from switch_to(). Alternative solution: * move the array we save into from switch_stack to thread_info * have a (thread-synchronous) flag set when we save them * have another flag set when they should be restored on return to userland. * do *NOT* save/restore them in do_switch_stack()/undo_switch_stack(). * restore on the exit to user mode if the restore flag had been set. Clear both flags. * on context switch, entry to fork/clone/vfork, before entry into do_signal() and on entry into straced syscall save the registers and set the 'saved' flag unless it had been already set. * on context switch set the 'restore' flag as well. * have copy_thread() set both flags for child, so the registers would be restored once the child returns to userland. * use the saved data in setup_sigcontext(); have restore_sigcontext() set both flags and copy from sigframe to save area. * teach ptrace to look for FPU registers in thread_info instead of switch_stack. * teach isolated accesses to FPU registers (rdfpcr, wrfpcr, etc.) to check the 'saved' flag (under preempt_disable()) and work with the save area if it's been set; if 'saved' flag is found upon write access, set 'restore' flag as well. Signed-off-by: Al Viro Signed-off-by: Matt Turner commit a7acb188e874be1b2752461a445af935e0a47da7 Author: Al Viro Date: Wed Jan 11 20:44:25 2023 +0000 alpha/boot/misc: trim unused declarations gzip_mark() and gzip_release() are gone; there used to be two forward declarations of each and the patch removing those suckers had left one of each behind... Signed-off-by: Al Viro Signed-off-by: Matt Turner commit a4c082f26718f7b2af6d62f5fd8b9759941c71c5 Author: Al Viro Date: Wed Jan 11 20:43:59 2023 +0000 alpha/boot/tools/objstrip: fix the check for ELF header Just memcmp() with ELFMAG - that's the normal way to do it in userland code, which that thing is. Besides, that has the benefit of actually building - str_has_prefix() is *NOT* present in . Fixes: 5f14596e55de "alpha: Replace strncmp with str_has_prefix" Signed-off-by: Al Viro Signed-off-by: Matt Turner commit 56efd34f8205ce24a97445184d819713dd3ce31e Author: Al Viro Date: Wed Jan 11 20:43:10 2023 +0000 alpha/boot: fix the breakage from -isystem series... Signed-off-by: Al Viro Signed-off-by: Matt Turner commit d3c51b701b1d3e618c7b158fb976aa648b1ac4ab Author: Al Viro Date: Sat Jan 7 00:59:29 2023 +0000 alpha: fix FEN fault handling Type 3 instruction fault (FPU insn with FPU disabled) is handled by quietly enabling FPU and returning. Which is fine, except that we need to do that both for fault in userland and in the kernel; the latter *can* legitimately happen - all it takes is this: .global _start _start: call_pal 0xae lda $0, 0 ldq $0, 0($0) - call_pal CLRFEN to clear "FPU enabled" flag and arrange for a signal delivery (SIGSEGV in this case). Fixed by moving the handling of type 3 into the common part of do_entIF(), before we check for kernel vs. user mode. Incidentally, check for kernel mode is unidiomatic; the normal way to do that is !user_mode(regs). The difference is that the open-coded variant treats any of bits 63..3 of regs->ps being set as "it's user mode" while the normal approach is to check just the bit 3. PS is a 4-bit register and regs->ps always will have bits 63..4 clear, so the open-code variant here is actually equivalent to !user_mode(regs). Harder to follow, though... Reproducer above will crash any box where CLRFEN is not ignored by PAL (== any actual hardware, AFAICS; PAL used in qemu doesn't bother implementing that crap). Cc: stable@vger.kernel.org # all way back... Reviewed-by: Richard Henderson Signed-off-by: Al Viro Signed-off-by: Matt Turner commit 4da2bd306bffb46109819647b28e8cabae39c941 Author: Joe Perches Date: Tue Aug 25 04:55:59 2020 +0000 alpha: Avoid comma separated statements Use semicolons and braces. Signed-off-by: Joe Perches Signed-off-by: Matt Turner commit 6b6b64abe02c7693d56c9abfd27f142fa8a0caa6 Author: rj1 Date: Fri Feb 3 18:47:03 2023 -0600 alpha: fixed a typo in core_cia.c Signed-off-by: Matt Turner commit 489fa31ea873282b41046d412ec741f93946fc2d Merge: 3df88c6a175d8 39ecb653f671b Author: Linus Torvalds Date: Fri Feb 24 19:27:55 2023 -0800 Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "Assorted stuff that didn't fit anywhere else" * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: nsfs: repair kernel-doc for ns_match() nsfs: add compat ioctl handler fs/cramfs: Convert kmap() to kmap_local_data() commit 3df88c6a175d883b58fc3c31e36c94eb5e2ad180 Merge: 10cc5d483ebc0 da27f796a8321 Author: Linus Torvalds Date: Fri Feb 24 19:20:07 2023 -0800 Merge branch 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull ipc namespace update from Al Viro: "Rik's patches reducing the amount of synchronize_rcu() triggered by ipc namespace destruction. I've some pending stuff reducing that on the normal umount side, but it's nowhere near ready and Rik's stuff shouldn't be held back due to conflicts - I'll just redo the parts of my series that stray into ipc/*" * 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ipc,namespace: batch free ipc_namespace structures ipc,namespace: make ipc namespace allocation wait for pending free commit 10cc5d483ebc00e82d9a38d3419b2edc8b79b64d Merge: d6b9cf417c626 beb9797ee8b0c Author: Linus Torvalds Date: Fri Feb 24 19:05:45 2023 -0800 Merge branch 'work.alpha' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull alpha updates from Al Viro: "FEN (floating-point enable) fault fix deals with a really old oopsable braino, the rest is alpha/boot compile fixes and minor cleaning up" * 'work.alpha' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: alpha/boot/misc: trim unused declarations alpha/boot/tools/objstrip: fix the check for ELF header alpha/boot: fix the breakage from -isystem series... alpha: fix FEN fault handling commit d6b9cf417c62601f26fa47f97d6c0681704bf0e3 Merge: 397aa6b63ff25 abb7c74239732 Author: Linus Torvalds Date: Fri Feb 24 19:03:26 2023 -0800 Merge branch 'work.sysv' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull sysv updates from Al Viro: "Fabio's 'switch to kmap_local_page()' patchset (originally after the ext2 counterpart, with a lot of cleaning up done to it; as the matter of fact, ext2 side is in need of similar cleanups - calling conventions there are bloody awful). Plus the equivalents of minix stuff..." * 'work.sysv' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: sysv: fix handling of delete_entry and set_link failures fs/sysv: Replace kmap() with kmap_local_page() fs/sysv: Use dir_put_page() in sysv_rename() fs/sysv: Change the signature of dir_get_page() fs/sysv: Use the offset_in_page() helper sysv: don't flush page immediately for DIRSYNC directories commit 397aa6b63ff25cee0b8ed20a6d447527c8ab0849 Merge: 595fa4e313fee 2cb6a44220b97 Author: Linus Torvalds Date: Fri Feb 24 19:01:15 2023 -0800 Merge branch 'work.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull minix updates from Al Viro: "Assorted fixes - mostly Christoph's" * 'work.minix' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: minix_rename(): minix_delete_entry() might fail minix: don't flush page immediately for DIRSYNC directories minix: fix error handling in minix_set_link minix: fix error handling in minix_delete_entry minix: move releasing pages into unlink and rename minix: make minix_new_inode() return error as ERR_PTR(-E...) commit 6f2ce45f0c5f12b5fc6ffabf367bc1bb145534cc Author: Nick Child Date: Thu Feb 23 09:39:44 2023 -0600 ibmvnic: Assign XPS map to correct queue index When setting the XPS map value for TX queues, use the index of the transmit queue. Previously, the function was passing the index of the loop that iterates over all queues (RX and TX). This was causing invalid XPS map values. Fixes: 6831582937bd ("ibmvnic: Toggle between queue types in affinity mapping") Signed-off-by: Nick Child Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230223153944.44969-1-nnac123@linux.ibm.com Signed-off-by: Jakub Kicinski commit bce90459937376b6c7553cfbe957d73293ab7bc8 Author: nick black Date: Thu Feb 23 21:29:16 2023 -0500 docs: net: fix inaccuracies in msg_zerocopy.rst Replace "sendpage" with "sendfile". Remove comment about ENOBUFS when the sockopt hasn't been set; experimentation indicates that this is not true. Signed-off-by: nick black Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/Y/gg/EhIIjugLdd3@schwarzgerat.orthanc Signed-off-by: Jakub Kicinski commit 595fa4e313fee3c0b69c10bbed6fffb803237306 Merge: 8ff99ad04c2eb 66f95de7c13be Author: Linus Torvalds Date: Fri Feb 24 17:29:52 2023 -0800 Merge tag 'soundwire-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: "This is a small update which features a bit of core changes and driver updates in Intel and cadence driver. Core: - sdw_transfer_defer() API change to drop an argument - Reset page address rework - Export sdw_nwrite_no_pm and sdw_nread_no_pm APIs Drivers: - Cadence and related intel driver updates for FIFO handling and low level msg transfers" * tag 'soundwire-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: cadence: further simplify low-level xfer_msg_defer() callback soundwire: cadence: use directly bus sdw_defer structure soundwire: bus: remove sdw_defer argument in sdw_transfer_defer() soundwire: stream: use consistent pattern for freeing buffers soundwire: bus: Remove unused reset_page_addr() callback soundwire: bus: Don't zero page registers after every transaction soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe() soundwire: stream: Move remaining register accesses over to no_pm soundwire: debugfs: Switch to sdw_read_no_pm soundwire: Provide build stubs for common functions soundwire: bus: export sdw_nwrite_no_pm and sdw_nread_no_pm functions soundwire: cadence: remove unused sdw_cdns_master_ops declaration soundwire: enable optional clock registers for SoundWire 1.2 devices ASoC/soundwire: remove is_sdca boolean property soundwire: cadence: Drain the RX FIFO after an IO timeout soundwire: cadence: Remove wasted space in response_buf soundwire: cadence: Don't overflow the command FIFOs soundwire: intel: remove DAI startup/shutdown commit 8ff99ad04c2ebacb272ff9e4f6155c35be136b3d Merge: 9e6bfd42b14b4 3584f6392f094 Author: Linus Torvalds Date: Fri Feb 24 17:22:11 2023 -0800 Merge tag 'phy-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "This features a bunch of new device support, a couple of new drivers, yaml conversion and updates of a few drivers. Core support: - New devm_of_phy_optional_get() API with users and conversion New hardware support: - Mediatek MT7986 phy support - Qualcomm SM8550 UFS, PCIe, combo phy support, SM6115 / SM4250 USB3 phy support, SM6350 combo phy support, SM6125 UFS PHY support amd SM8350 & SM8450 combo phy support - Qualcomm SNPS eUSB2 eUSB2 repeater drivers - Allwinner F1C100s USB PHY support - Tegra xusb support for Tegra234 Updates: - Yaml conversion for Qualcomm pcie2 phy and usb-hsic-phy - G4 mode support in Qualcomm UFS phy and support for various SoCs - Yaml conversion for Meson usb2 phy - TI Type C support for usb phy for j721 - Yaml conversion for Tegra xusb binding" * tag 'phy-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (106 commits) phy: qcom: phy-qcom-snps-eusb2: Add support for eUSB2 repeater phy: qcom: Add QCOM SNPS eUSB2 repeater driver dt-bindings: phy: qcom,snps-eusb2-phy: Add phys property for the repeater dt-bindings: phy: Add qcom,snps-eusb2-repeater schema file dt-bindings: phy: amlogic,g12a-usb3-pcie-phy: add missing optional phy-supply property phy: rockchip-typec: Fix unsigned comparison with less than zero phy: rockchip-typec: fix tcphy_get_mode error case phy: qcom: snps-eusb2: Add missing headers phy: qcom-qmp-combo: Add support for SM8550 phy: qcom-qmp: Add v6 DP register offsets phy: qcom-qmp: pcs-usb: Add v6 register offsets dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp: Document SM8550 compatible phy: qcom: Add QCOM SNPS eUSB2 driver dt-bindings: phy: Add qcom,snps-eusb2-phy schema file phy: qcom-qmp-pcie: Add support for SM8550 g3x2 and g4x2 PCIEs phy: qcom-qmp: qserdes-lane-shared: Add v6 register offsets phy: qcom-qmp: qserdes-txrx: Add v6.20 register offsets phy: qcom-qmp: pcs-pcie: Add v6.20 register offsets phy: qcom-qmp: pcs-pcie: Add v6 register offsets phy: qcom-qmp: pcs: Add v6.20 register offsets ... commit 9e6bfd42b14b45737cae8bc84c759f1874949b8b Merge: 008128cd5948b e922bbf37564a Author: Linus Torvalds Date: Fri Feb 24 17:18:54 2023 -0800 Merge tag 'dmaengine-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "A new driver, couple of device support and binding conversion along with bunch of driver updates are the main features of this. New hardware support: - TI AM62Ax controller support - Xilinx xdma driver - Qualcomm SM6125, SM8550, QDU1000/QRU1000 GPI controller Updates: - Runtime pm support for at_xdmac driver - IMX sdma binding conversion to yaml and HDMI audio support - IMX mxs binding conversion to yaml" * tag 'dmaengine-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (35 commits) dmaengine: idma64: Update bytes_transferred field dmaengine: imx-sdma: Set DMA channel to be private dmaengine: dw: Move check for paused channel to dwc_get_residue() dmaengine: ptdma: check for null desc before calling pt_cmd_callback dmaengine: dw-axi-dmac: Do not dereference NULL structure dmaengine: idxd: Fix default allowed read buffers value in group dmaengine: sf-pdma: pdma_desc memory leak fix dmaengine: Simplify dmaenginem_async_device_register() function dmaengine: use sysfs_emit() to instead of scnprintf() dmaengine: Make an order in struct dma_device definition dt-bindings: dma: cleanup examples - indentation, lowercase hex dt-bindings: dma: drop unneeded quotes dmaengine: xilinx: xdma: Add user logic interrupt support dmaengine: xilinx: xdma: Add xilinx xdma driver dmaengine: drivers: Use devm_platform_ioremap_resource() dmaengine: at_xdmac: remove empty line dmaengine: at_xdmac: add runtime pm support dmaengine: at_xdmac: align properly function members dmaengine: ppc4xx: Convert to use sysfs_emit()/sysfs_emit_at() APIs dmaengine: sun6i: Set the maximum segment size ... commit 008128cd5948bd3589a9c300e426af4d834029bb Merge: 39f013440dbf5 e8444bb9fd77f Author: Linus Torvalds Date: Fri Feb 24 17:12:23 2023 -0800 Merge tag 'i2c-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: - new drivers for HPE GXP and Loongson 2K/LS7A - bigger refactorings for i801 and xiic - gpio driver gained ACPI and SDA-write only support - the core converted some OF helpers to fwnode helpers - usual bunch of driver updates * tag 'i2c-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (52 commits) MAINTAINERS: Add HPE GXP I2C Support i2c: Add GXP SoC I2C Controller dt-bindings: i2c: Add hpe,gxp-i2c i2c: xiic: Remove some dead code i2c: xiic: Add SCL frequency configuration support i2c: xiic: Update compatible with new IP version dt-bindings: i2c: xiic: Add 'xlnx,axi-iic-2.1' to compatible i2c: i801: Call i801_check_post() from i801_access() i2c: i801: Call i801_check_pre() from i801_access() i2c: i801: Centralize configuring block commands in i801_block_transaction i2c: i801: Centralize configuring non-block commands in i801_simple_transaction i2c: i801: Handle SMBAUXCTL_E32B in i801_block_transaction_by_block only i2c: i801: Add i801_simple_transaction(), complementing i801_block_transaction() Documentation: i2c: correct spelling dt-bindings: i2c: i2c-st: convert to DT schema i2c: i801: add helper i801_set_hstadd() i2c: i801: make FEATURE_BLOCK_PROC dependent on FEATURE_BLOCK_BUFFER i2c: i801: make FEATURE_HOST_NOTIFY dependent on FEATURE_IRQ i2c: i801: improve interrupt handler i2c: st: use pm_sleep_ptr to avoid ifdef CONFIG_PM_SLEEP ... commit 39f013440dbf5b1f209eadb3b4665d4f0e840b5b Merge: 90ddb3f03418c c142872ea40a9 Author: Linus Torvalds Date: Fri Feb 24 17:04:23 2023 -0800 Merge tag 'for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Nothing special for the power-supply subystem this time. - power-supply core: remove faulty cooling logic - convert all sysfs show() handlers from *printf() use sysfs_emit() - bq25890: add dual-charger support required by Lenovo Yoga Tab 3 Pro - bq27xxx: fix reporting critical level - syscon-reboot: add priority property support - new rt9467 charger driver - new rt9471 charger driver - new Odroid Go Ultra poweroff driver - misc minor fixes and cleanups" * tag 'for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (32 commits) power: reset: odroid-go-ultra: fix I2C dependency power: supply: leds: explicitly include linux/leds.h dt-bindings: power: supply: pm8941-coincell: Don't require charging properties dt-bindings: power: supply: pm8941-coincell: Add PM8998 compatible power: reset: add Odroid Go Ultra poweroff driver power: supply: rt9467: Fix spelling mistake "attache" -> "attach" power: supply: rt9471: fix using wrong ce_gpio in rt9471_probe() power: supply: max77650: Make max77650_charger_disable() return void Documentation: power: rt9467: Document exported sysfs entries power: supply: rt9467: Add Richtek RT9467 charger driver dt-bindings: power: supply: Add Richtek RT9467 battery charger Documentation: power: rt9471: Document exported sysfs entries power: supply: rt9471: Add Richtek RT9471 charger driver dt-bindings: power: supply: Add Richtek RT9471 battery charger power: supply: max1721x: Use strscpy() is more robust and safer power: supply: test-power: use strscpy() instead of strncpy() power: supply: bq27xxx: fix reporting critical level power: supply: bq256xx: Init ichg/vbat value with chip default value power: supply: collie_battery: Convert to GPIO descriptors (part 2) power: supply: remove faulty cooling logic ... commit 90ddb3f03418cce0d83c415c0c1d470cf524ba46 Merge: 8cbd92339db08 3eb5d0f26f4ea Author: Linus Torvalds Date: Fri Feb 24 16:51:40 2023 -0800 Merge tag 'pci-v6.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Rework portdrv shutdown so it disables interrupts but doesn't disable bus mastering, which leads to hangs on Loongson LS7A - Add mechanism to prevent Max_Read_Request_Size (MRRS) increases, again to avoid hardware issues on Loongson LS7A (and likely other devices based on DesignWare IP) - Ignore devices with a firmware (DT or ACPI) node that says the device is disabled Resource management: - Distribute spare resources to unconfigured hotplug bridges at boot-time (not just when hot-adding such a bridge), which makes hot-adding devices to docks work better. Tried this in v6.1 but had to revert for regressions, so try again - Fix root bus issue that dropped resources that happened to end at 0, e.g., [bus 00] PCI device hotplug: - Remove device locking when marking device as disconnected so this doesn't have to wait for concurrent driver bind/unbind to complete - Quirk more Qualcomm bridges that don't fully implement the PCIe Slot Status 'Command Completed' bit Power management: - Account for _S0W of the target bridge in acpi_pci_bridge_d3() so we don't miss hot-add notifications for USB4 docks, Thunderbolt, etc Reset: - Observe delay after reset, e.g., resuming from system sleep, regardless of whether a bridge can suspend to D3cold at runtime - Wait for secondary bus to become ready after a bridge reset Virtualization: - Avoid FLR on some AMD FCH AHCI adapters where it doesn't work - Allow independent IOMMU groups for some Wangxun NICs that prevent peer-to-peer transactions but don't advertise an ACS Capability Error handling: - Configure End-to-End-CRC (ECRC) only if Linux owns the AER Capability - Remove redundant Device Control Error Reporting Enable in the AER service driver since this is already done for all devices during enumeration ASPM: - Add pci_enable_link_state() interface to allow drivers to enable ASPM link state Endpoint framework: - Move dra7xx and tegra194 linkup processing from hard IRQ to threaded IRQ handler - Add a separate lock for endpoint controller list of endpoint function drivers to prevent deadlock in callbacks - Pass events from endpoint controller to endpoint function drivers via callbacks instead of notifiers Synopsys DesignWare eDMA controller driver (acked by Vinod): - Fix CPU vs PCI address issues - Fix source vs destination address issues - Fix issues with interleaved transfer semantics - Fix channel count initialization issue (issue still exists in several other drivers) - Clean up and improve debugfs usage so it will work on platforms with several eDMA devices Baikal T-1 PCIe controller driver: - Set a 64-bit DMA mask Freescale i.MX6 PCIe controller driver: - Add i.MX8MM, i.MX8MQ, i.MX8MP endpoint mode DT binding and driver support Intel VMD host bridge driver: - Add quirk to configure PCIe ASPM and LTR. This is normally done by BIOS, and will be for future products Marvell MVEBU PCIe controller driver: - Mark this driver as broken in Kconfig since bugs prevent its daily usage MediaTek MT7621 PCIe controller driver: - Delay PHY port initialization to improve boot reliability for ZBT WE1326, ZBT WF3526-P, and some Netgear models Qualcomm PCIe controller driver: - Add MSM8998 DT compatible string - Unify MSM8996 and MSM8998 clock orderings - Add SM8350 DT binding and driver support - Add IPQ8074 Gen3 DT binding and driver support - Correct qcom,perst-regs in DT binding - Add qcom_pcie_host_deinit() so the PHY is powered off and regulators and clocks are disabled on late host-init errors Socionext UniPhier Pro5 controller driver: - Clean up uniphier-ep reg, clocks, resets, and their names in DT binding Synopsys DesignWare PCIe controller driver: - Restrict coherent DMA mask to 32 bits for MSI, but allow controller drivers to set 64-bit streaming DMA mask - Add eDMA engine support in both Root Port and Endpoint controllers Miscellaneous: - Remove MODULE_LICENSE from boolean drivers so they don't look like modules so modprobe can complain about them" * tag 'pci-v6.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (86 commits) PCI: dwc: Add Root Port and Endpoint controller eDMA engine support PCI: bt1: Set 64-bit DMA mask PCI: dwc: Restrict only coherent DMA mask for MSI address allocation dmaengine: dw-edma: Prepare dw_edma_probe() for builtin callers dmaengine: dw-edma: Depend on DW_EDMA instead of selecting it dmaengine: dw-edma: Add mem-mapped LL-entries support PCI: Remove MODULE_LICENSE so boolean drivers don't look like modules PCI: hv: Drop duplicate PCI_MSI dependency PCI/P2PDMA: Annotate RCU dereference PCI/sysfs: Constify struct kobj_type pci_slot_ktype PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: pciehp: Add Qualcomm quirk for Command Completed erratum PCI: qcom: Add IPQ8074 Gen3 port support dt-bindings: PCI: qcom: Add IPQ8074 Gen3 port dt-bindings: PCI: qcom: Sort compatibles alphabetically PCI: qcom: Fix host-init error handling PCI: qcom: Add SM8350 support dt-bindings: PCI: qcom: Add SM8350 dt-bindings: PCI: qcom-ep: Correct qcom,perst-regs dt-bindings: PCI: qcom: Unify MSM8996 and MSM8998 clock order ... commit 13af134bdc6a9dacec4687e57b2ea8d3e08ff04f Author: ChiaEn Wu Date: Fri Feb 17 17:55:55 2023 +0800 dt-bindings: power: supply: Revise Richtek RT9467 compatible name Revise RT9467 compatible name from "richtek,rt9467-charger" to "richtek,rt9467" because it has to match the "compatible name" in the source code. Fixes: e1b4620fb503 ("dt-bindings: power: supply: Add Richtek RT9467 battery charger") Reported-by: Rob Herring Signed-off-by: ChiaEn Wu Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel commit f0cf05759497dbc90303adcbdf3d13a54bdaf97b Author: Bastien Nocera Date: Mon Feb 20 14:10:18 2023 +0100 ABI: testing: sysfs-class-power: Document absence of "present" property Document how the absence of the "present" property in the sysfs power_supply class should be handled. Link: https://gitlab.freedesktop.org/upower/upower/-/merge_requests/173 Cc: Mario Limonciello Signed-off-by: Bastien Nocera Signed-off-by: Sebastian Reichel commit bfaecf465a058b167abc7c0dfad985f167ff3af1 Author: qinyu Date: Thu Feb 23 16:10:47 2023 +0800 power: supply: fix null pointer check order in __power_supply_register There is an null pointer check order issue here: if we have to check !desc and !desc->name anyway, check it before dereferencing it in pr_warn(). Signed-off-by: qinyu Signed-off-by: Sebastian Reichel commit 8cbd92339db08b19b93d1637e5799ff2a8dddfd2 Merge: 143c7bc6496c8 66fb1d5df6ace Author: Linus Torvalds Date: Fri Feb 24 15:11:03 2023 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "Quite a small cycle this time, even with the rc8. I suppose everyone went to sleep over xmas. - Minor driver updates for hfi1, cxgb4, erdma, hns, irdma, mlx5, siw, mana - inline CQE support for hns - Have mlx5 display device error codes - Pinned DMABUF support for irdma - Continued rxe cleanups, particularly converting the MRs to use xarray - Improvements to what can be cached in the mlx5 mkey cache" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (61 commits) IB/mlx5: Extend debug control for CC parameters IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors IB/hfi1: Fix math bugs in hfi1_can_pin_pages() RDMA/irdma: Add support for dmabuf pin memory regions RDMA/mlx5: Use query_special_contexts for mkeys net/mlx5e: Use query_special_contexts for mkeys net/mlx5: Change define name for 0x100 lkey value net/mlx5: Expose bits for querying special mkeys RDMA/rxe: Fix missing memory barriers in rxe_queue.h RDMA/mana_ib: Fix a bug when the PF indicates more entries for registering memory on first packet RDMA/rxe: Remove rxe_alloc() RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size Subject: RDMA/rxe: Handle zero length rdma iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() RDMA/mlx5: Use rdma_umem_for_each_dma_block() RDMA/umem: Remove unused 'work' member from struct ib_umem RDMA/irdma: Cap MSIX used to online CPUs + 1 RDMA/mlx5: Check reg_create() create for errors RDMA/restrack: Correct spelling RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() ... commit 143c7bc6496c886ce5db2a2f9cec580494690170 Merge: a13de74e47653 939204e4df962 Author: Linus Torvalds Date: Fri Feb 24 14:34:12 2023 -0800 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "Some polishing and small fixes for iommufd: - Remove IOMMU_CAP_INTR_REMAP, instead rely on the interrupt subsystem - Use GFP_KERNEL_ACCOUNT inside the iommu_domains - Support VFIO_NOIOMMU mode with iommufd - Various typos - A list corruption bug if HWPTs are used for attach" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Do not add the same hwpt to the ioas->hwpt_list twice iommufd: Make sure to zero vfio_iommu_type1_info before copying to user vfio: Support VFIO_NOIOMMU with iommufd iommufd: Add three missing structures in ucmd_buffer selftests: iommu: Fix test_cmd_destroy_access() call in user_copy iommu: Remove IOMMU_CAP_INTR_REMAP irq/s390: Add arch_is_isolated_msi() for s390 iommu/x86: Replace IOMMU_CAP_INTR_REMAP with IRQ_DOMAIN_FLAG_ISOLATED_MSI genirq/msi: Rename IRQ_DOMAIN_MSI_REMAP to IRQ_DOMAIN_ISOLATED_MSI genirq/irqdomain: Remove unused irq_domain_check_msi_remap() code iommufd: Convert to msi_device_has_isolated_msi() vfio/type1: Convert to iommu_group_has_isolated_msi() iommu: Add iommu_group_has_isolated_msi() genirq/msi: Add msi_device_has_isolated_msi() commit a13de74e476532e32efb06e96acae84c634f0159 Merge: 8395d932d24a9 bedd29d793da3 Author: Linus Torvalds Date: Fri Feb 24 13:40:13 2023 -0800 Merge tag 'iommu-updates-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: - Consolidate iommu_map/unmap functions. There have been blocking and atomic variants so far, but that was problematic as this approach does not scale with required new variants which just differ in the GFP flags used. So Jason consolidated this back into single functions that take a GFP parameter. - Retire the detach_dev() call-back in iommu_ops - Arm SMMU updates from Will: - Device-tree binding updates: - Cater for three power domains on SM6375 - Document existing compatible strings for Qualcomm SoCs - Tighten up clocks description for platform-specific compatible strings - Enable Qualcomm workarounds for some additional platforms that need them - Intel VT-d updates from Lu Baolu: - Add Intel IOMMU performance monitoring support - Set No Execute Enable bit in PASID table entry - Two performance optimizations - Fix PASID directory pointer coherency - Fix missed rollbacks in error path - Cleanups - Apple t8110 DART support - Exynos IOMMU: - Implement better fault handling - Error handling fixes - Renesas IPMMU: - Add device tree bindings for r8a779g0 - AMD IOMMU: - Various fixes for handling on SNP-enabled systems and handling of faults with unknown request-ids - Cleanups and other small fixes - Various other smaller fixes and cleanups * tag 'iommu-updates-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (71 commits) iommu/amd: Skip attach device domain is same as new domain iommu: Attach device group to old domain in error path iommu/vt-d: Allow to use flush-queue when first level is default iommu/vt-d: Fix PASID directory pointer coherency iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode iommu/vt-d: Fix error handling in sva enable/disable paths iommu/amd: Improve page fault error reporting iommu/amd: Do not identity map v2 capable device when snp is enabled iommu: Fix error unwind in iommu_group_alloc() iommu/of: mark an unused function as __maybe_unused iommu: dart: DART_T8110_ERROR range should be 0 to 5 iommu/vt-d: Enable IOMMU perfmon support iommu/vt-d: Add IOMMU perfmon overflow handler support iommu/vt-d: Support cpumask for IOMMU perfmon iommu/vt-d: Add IOMMU perfmon support iommu/vt-d: Support Enhanced Command Interface iommu/vt-d: Retrieve IOMMU perfmon capability information iommu/vt-d: Support size of the register set in DRHD iommu/vt-d: Set No Execute Enable bit in PASID table entry iommu/vt-d: Remove sva from intel_svm_dev ... commit 8395d932d24a9b4c01ab33ed0b4b2de06328afc2 Merge: a93e884edf61f 1ba7dfb905b39 Author: Linus Torvalds Date: Fri Feb 24 13:31:53 2023 -0800 Merge tag 'devicetree-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "DT core: - Add node lifecycle unit tests - Add of_property_present() helper aligned with fwnode API - Print more information on reserved regions on boot - Update dtc to upstream v1.6.1-66-gabbd523bae6e - Use strscpy() to instead of strncpy() in DT core - Add option for schema validation on %.dtb targets Bindings: - Add/fix support for listing multiple patterns in DT_SCHEMA_FILES - Rework external memory controller/bus bindings to properly support controller specific child node properties - Convert loongson,ls1x-intc, fcs,fusb302, sil,sii8620, Rockchip RK3399 PCIe, Synquacer I2C, and Synquacer EXIU bindings to DT schema format - Add RiscV SBI PMU event mapping binding - Add missing contraints on Arm SCMI child node allowed properties - Add a bunch of missing Socionext UniPhier glue block bindings and example fixes - Various fixes for duplicate or conflicting type definitions on DT properties" * tag 'devicetree-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (66 commits) dt-bindings: regulator: Add mps,mpq7932 power-management IC of: dynamic: Fix spelling mistake "kojbect" -> "kobject" dt-bindings: drop Sagar Kadam from SiFive binding maintainership dt-bindings: sram: qcom,imem: document sm8450 dt-bindings: interrupt-controller: convert loongson,ls1x-intc.txt to json-schema dt-bindings: arm: Add Cortex-A715 and X3 of: dynamic: add lifecycle docbook info to node creation functions of: add consistency check to of_node_release() of: do not use "%pOF" printk format on node with refcount of zero of: unittest: add node lifecycle tests of: update kconfig unittest help of: add processing of EXPECT_NOT to of_unittest_expect of: prepare to add processing of EXPECT_NOT to of_unittest_expect of: Use preferred of_property_read_* functions of: Use of_property_present() helper of: Add of_property_present() helper of: reserved_mem: Use proper binary prefix dt-bindings: Fix multi pattern support in DT_SCHEMA_FILES of: reserved-mem: print out reserved-mem details during boot dt-bindings: serial: restrict possible child node names ... commit a93e884edf61f9debc9ca61ef9e545f0394ab666 Merge: 693fed981eb9b 88cd618dcc7b6 Author: Linus Torvalds Date: Fri Feb 24 12:58:55 2023 -0800 Merge tag 'driver-core-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the large set of driver core changes for 6.3-rc1. There's a lot of changes this development cycle, most of the work falls into two different categories: - fw_devlink fixes and updates. This has gone through numerous review cycles and lots of review and testing by lots of different devices. Hopefully all should be good now, and Saravana will be keeping a watch for any potential regression on odd embedded systems. - driver core changes to work to make struct bus_type able to be moved into read-only memory (i.e. const) The recent work with Rust has pointed out a number of areas in the driver core where we are passing around and working with structures that really do not have to be dynamic at all, and they should be able to be read-only making things safer overall. This is the contuation of that work (started last release with kobject changes) in moving struct bus_type to be constant. We didn't quite make it for this release, but the remaining patches will be finished up for the release after this one, but the groundwork has been laid for this effort. Other than that we have in here: - debugfs memory leak fixes in some subsystems - error path cleanups and fixes for some never-able-to-be-hit codepaths. - cacheinfo rework and fixes - Other tiny fixes, full details are in the shortlog All of these have been in linux-next for a while with no reported problems" [ Geert Uytterhoeven points out that that last sentence isn't true, and that there's a pending report that has a fix that is queued up - Linus ] * tag 'driver-core-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (124 commits) debugfs: drop inline constant formatting for ERR_PTR(-ERROR) OPP: fix error checking in opp_migrate_dentry() debugfs: update comment of debugfs_rename() i3c: fix device.h kernel-doc warnings dma-mapping: no need to pass a bus_type into get_arch_dma_ops() driver core: class: move EXPORT_SYMBOL_GPL() lines to the correct place Revert "driver core: add error handling for devtmpfs_create_node()" Revert "devtmpfs: add debug info to handle()" Revert "devtmpfs: remove return value of devtmpfs_delete_node()" driver core: cpu: don't hand-override the uevent bus_type callback. devtmpfs: remove return value of devtmpfs_delete_node() devtmpfs: add debug info to handle() driver core: add error handling for devtmpfs_create_node() driver core: bus: update my copyright notice driver core: bus: add bus_get_dev_root() function driver core: bus: constify bus_unregister() driver core: bus: constify some internal functions driver core: bus: constify bus_get_kset() driver core: bus: constify bus_register/unregister_notifier() driver core: remove private pointer from struct bus_type ... commit 693fed981eb9bf6e70bfda66bb872e2bb8155671 Merge: 0601f25d1c493 6ec363fc61422 Author: Linus Torvalds Date: Fri Feb 24 12:47:33 2023 -0800 Merge tag 'char-misc-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc and other driver subsystem updates from Greg KH: "Here is the large set of driver changes for char/misc drivers and other smaller driver subsystems that flow through this git tree. Included in here are: - New IIO drivers and features and improvments in that subsystem - New hwtracing drivers and additions to that subsystem - lots of interconnect changes and new drivers as that subsystem seems under very active development recently. This required also merging in the icc subsystem changes through this tree. - FPGA driver updates - counter subsystem and driver updates - MHI driver updates - nvmem driver updates - documentation updates - Other smaller driver updates and fixes, full details in the shortlog All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (223 commits) scripts/tags.sh: fix incompatibility with PCRE2 firmware: coreboot: Remove GOOGLE_COREBOOT_TABLE_ACPI/OF Kconfig entries mei: lower the log level for non-fatal failed messages mei: bus: disallow driver match while dismantling device misc: vmw_balloon: fix memory leak with using debugfs_lookup() nvmem: stm32: fix OPTEE dependency dt-bindings: nvmem: qfprom: add IPQ8074 compatible nvmem: qcom-spmi-sdam: register at device init time nvmem: rave-sp-eeprm: fix kernel-doc bad line warning nvmem: stm32: detect bsec pta presence for STM32MP15x nvmem: stm32: add OP-TEE support for STM32MP13x nvmem: core: use nvmem_add_one_cell() in nvmem_add_cells_from_of() nvmem: core: add nvmem_add_one_cell() nvmem: core: drop the removal of the cells in nvmem_add_cells() nvmem: core: move struct nvmem_cell_info to nvmem-provider.h nvmem: core: add an index parameter to the cell of: property: add #nvmem-cell-cells property of: property: make #.*-cells optional for simple props of: base: add of_parse_phandle_with_optional_args() net: add helper eth_addr_add() ... commit 0601f25d1c4937c678db786961705ce56fbd6bb6 Merge: 17cd4d6f05087 b5929325f0630 Author: Linus Torvalds Date: Fri Feb 24 12:25:55 2023 -0800 Merge tag 'staging-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is the "boring" staging driver update for 6.3-rc1. Nothing major in here at all, it's just lots of tiny code cleanups to bring some of the staging drivers more in line with the real portion of the kernel (apis and coding style.) Overall we remove more lines of code than we add, always a nice result. The big work was done by Martin Kaiser and Philipp Hortmann, both tackling some of the older wifi drivers, removing unused code and structures and a file in one case. Full details of the changes are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'staging-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (219 commits) staging: r8188eu: Revert "staging: r8188eu: simplify rtw_get_ff_hwaddr" staging: r8188eu: replace hand coded loop with list_for_each_entry staging: r8188eu: merge _rtw_enqueue_cmd into its caller most: add maintainer entry staging: rtl8192e: Use BIT() instead of << for bit field MSR_LINK_MASK staging: rtl8192e: Rename DM_RxPathSelTable staging: rtl8192e: Rename diff_TH and disabledRF staging: rtl8192e: Rename Enable, cck_Rx_path and SS_TH_low staging: rtl8192e: Rename RateAdaptiveTH.., VeryLowRSSI and WAIotTHVal staging: rtl8192e: Rename RxPathSelectio.., RateAdaptive.. and RateAdap.. staging: rtl8192e: Rename OFDM_Table.., CCK_Table_.. and RxPathSelecti.. staging: rtl8192e: Rename MacBlkCtrl and remove double definition staging: rtl8192e: Remove blank lines in r8192E_hw.h, rtl_core.h and .. staging: rtl8192e: Rename AcmHw_ViqEn, AcmHw_VoqEn and ANAPAR_FOR_8192PciE staging: r8188eu: bagg_pkt parameter is not used staging: r8188eu: simplify rtw_get_ff_hwaddr staging: r8188eu: simplify xmit_buf flags staging: r8188eu: xmit_buf's ff_hwaddr is not used staging: r8188eu: remove unused frametag defines staging: r8188eu: simplify rtw_alloc_xmitframe ... commit 310726c33ad76cebdee312dbfafc12c1b44bf977 Author: Jens Axboe Date: Fri Feb 24 10:01:19 2023 -0700 block: be a bit more careful in checking for NULL bdev while polling Wei reports a crash with an application using polled IO: PGD 14265e067 P4D 14265e067 PUD 47ec50067 PMD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 21915 Comm: iocore_0 Kdump: loaded Tainted: G S 5.12.0-0_fbk12_clang_7346_g1bb6f2e7058f #1 Hardware name: Wiwynn Delta Lake MP T8/Delta Lake-Class2, BIOS Y3DLM08 04/10/2022 RIP: 0010:bio_poll+0x25/0x200 Code: 0f 1f 44 00 00 0f 1f 44 00 00 55 41 57 41 56 41 55 41 54 53 48 83 ec 28 65 48 8b 04 25 28 00 00 00 48 89 44 24 20 48 8b 47 08 <48> 8b 80 70 02 00 00 4c 8b 70 50 8b 6f 34 31 db 83 fd ff 75 25 65 RSP: 0018:ffffc90005fafdf8 EFLAGS: 00010292 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 74b43cd65dd66600 RDX: 0000000000000003 RSI: ffffc90005fafe78 RDI: ffff8884b614e140 RBP: ffff88849964df78 R08: 0000000000000000 R09: 0000000000000008 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88849964df00 R13: ffffc90005fafe78 R14: ffff888137d3c378 R15: 0000000000000001 FS: 00007fd195000640(0000) GS:ffff88903f400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000270 CR3: 0000000466121001 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: iocb_bio_iopoll+0x1d/0x30 io_do_iopoll+0xac/0x250 __se_sys_io_uring_enter+0x3c5/0x5a0 ? __x64_sys_write+0x89/0xd0 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x94f225d Code: 24 cc 00 00 00 41 8b 84 24 d0 00 00 00 c1 e0 04 83 e0 10 41 09 c2 8b 33 8b 53 04 4c 8b 43 18 4c 63 4b 0c b8 aa 01 00 00 0f 05 <85> c0 0f 88 85 00 00 00 29 03 45 84 f6 0f 84 88 00 00 00 41 f6 c7 RSP: 002b:00007fd194ffcd88 EFLAGS: 00000202 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 00007fd194ffcdc0 RCX: 00000000094f225d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000007 RBP: 00007fd194ffcdb0 R08: 0000000000000000 R09: 0000000000000008 R10: 0000000000000001 R11: 0000000000000202 R12: 00007fd269d68030 R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 which is due to bio->bi_bdev being NULL. This can happen if we have two tasks doing polled IO, and task B ends up completing IO from task A if they are sharing a poll queue. If task B completes the IO and puts the bio into our cache, then it can allocate that bio again before task A is done polling for it. As that would necessitate a preempt between the two tasks, it's enough to just be a bit more careful in checking for whether or not bio->bi_bdev is NULL. Reported-and-tested-by: Wei Zhang Cc: stable@vger.kernel.org Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") Reviewed-by: Keith Busch Signed-off-by: Jens Axboe commit 11eb695feb636fa5211067189cad25ac073e7fe5 Author: Jens Axboe Date: Fri Feb 24 09:59:44 2023 -0700 block: clear bio->bi_bdev when putting a bio back in the cache This isn't strictly needed in terms of correctness, but it does allow polling to know if the bio has been put already by a different task and hence avoid polling something that we don't need to. Cc: stable@vger.kernel.org Fixes: be4d234d7aeb ("bio: add allocation cache abstraction") Reviewed-by: Keith Busch Signed-off-by: Jens Axboe commit 17cd4d6f05087ea1ae5c1416ef260e5b7fc5d5c9 Merge: 72bffe7e1eb6c 72206cc730b5c Author: Linus Torvalds Date: Fri Feb 24 12:17:14 2023 -0800 Merge tag 'tty-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver updates from Greg KH: "Here is the big set of serial and tty driver updates for 6.3-rc1. Once again, Jiri and Ilpo have done a number of core vt and tty/serial layer cleanups that were much needed and appreciated. Other than that, it's just a bunch of little tty/serial driver updates: - qcom-geni-serial driver updates - liteuart driver updates - hvcs driver cleanups - n_gsm updates and additions for new features - more 8250 device support added - fpga/dfl update and additions - imx serial driver updates - fsl_lpuart updates - other tiny fixes and updates for serial drivers All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (143 commits) tty: n_gsm: add keep alive support serial: imx: remove a redundant check dt-bindings: serial: snps-dw-apb-uart: add dma & dma-names properties soc: qcom: geni-se: Move qcom-geni-se.h to linux/soc/qcom/geni-se.h tty: n_gsm: add TIOCMIWAIT support tty: n_gsm: add RING/CD control support tty: n_gsm: mark unusable ioctl structure fields accordingly serial: imx: get rid of registers shadowing serial: imx: refine local variables in rxint() serial: imx: stop using USR2 in FIFO reading loop serial: imx: remove redundant USR2 read from FIFO reading loop serial: imx: do not break from FIFO reading loop prematurely serial: imx: do not sysrq broken chars serial: imx: work-around for hardware RX flood serial: imx: factor-out common code to imx_uart_soft_reset() serial: 8250_pci1xxxx: Add power management functions to quad-uart driver serial: 8250_pci1xxxx: Add RS485 support to quad-uart driver serial: 8250_pci1xxxx: Add driver for quad-uart support serial: 8250_pci: Add serial8250_pci_setup_port definition in 8250_pcilib.c tty: pcn_uart: fix memory leak with using debugfs_lookup() ... commit 72bffe7e1eb6cb82b90aa14cd786f3f5ede9e0ae Merge: ab7362d04d7c1 1243741f6b02b Author: Linus Torvalds Date: Fri Feb 24 12:07:00 2023 -0800 Merge tag 'usb-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt driver updates from Greg KH: "Here is the big set of USB and Thunderbolt driver changes for 6.3-rc1. Nothing major in here, just lots of good development, including: - Thunderbolt additions for new device support and features - xhci driver updates and cleanups - USB gadget media driver updates (includes media core changes that were acked by the v4l2 maintainers) - lots of other USB gadget driver updates for new features - dwc3 driver updates and fixes - minor debugfs leak fixes - typec driver updates and additions - dt-bindings conversions to yaml - other small bugfixes and driver updates All have been in linux-next for a while with no reported issues" * tag 'usb-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (237 commits) usb: dwc3: xilinx: Remove unused of_gpio,h usb: typec: pd: Add higher capability sysfs for sink PDO usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO usb: dwc3: pci: add support for the Intel Meteor Lake-M usb: gadget: u_ether: Don't warn in gether_setup_name_default() usb: gadget: u_ether: Convert prints to device prints usb: gadget: u_serial: Add null pointer check in gserial_resume usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails xhci: host: potential NULL dereference in xhci_generic_plat_probe() dt-bindings: usb: amlogic,meson-g12a-usb-ctrl: make G12A usb3-phy0 optional usb: host: fsl-mph-dr-of: reuse device_set_of_node_from_dev of: device: Do not ignore error code in of_device_uevent_modalias of: device: Ignore modalias of reused nodes usb: gadget: configfs: Fix set but not used variable warning usb: gadget: uvc: Use custom strings if available usb: gadget: uvc: Allow linking function to string descs usb: gadget: uvc: Pick up custom string descriptor IDs usb: gadget: uvc: Allow linking XUs to string descriptors usb: gadget: configfs: Attach arbitrary strings to cdev usb: gadget: configfs: Support arbitrary string descriptors ... commit 7605c43d67face310b4b87dee1a28bc0c8cd8c0f Author: David Lamparter Date: Fri Feb 24 16:01:24 2023 +0100 io_uring: remove MSG_NOSIGNAL from recvmsg MSG_NOSIGNAL is not applicable for the receiving side, SIGPIPE is generated when trying to write to a "broken pipe". AF_PACKET's packet_recvmsg() does enforce this, giving back EINVAL when MSG_NOSIGNAL is set - making it unuseable in io_uring's recvmsg. Remove MSG_NOSIGNAL from io_recvmsg_prep(). Cc: stable@vger.kernel.org # v5.10+ Signed-off-by: David Lamparter Cc: Eric Dumazet Cc: Jens Axboe Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230224150123.128346-1-equinox@diac24.net Signed-off-by: Jens Axboe commit 977bc87356107fb946fb4ff24f1e4c241b5043ec Author: Jens Axboe Date: Fri Feb 24 09:54:57 2023 -0700 io_uring/rsrc: always initialize 'folio' to NULL Smatch complains that: smatch warnings: io_uring/rsrc.c:1262 io_sqe_buffer_register() error: uninitialized symbol 'folio'. 'folio' may be used uninitialized, which can happen if we end up with a single page mapped. Ensure that we clear folio to NULL at the top so it's always set. Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202302241432.YML1CD5C-lkp@intel.com/ Signed-off-by: Jens Axboe commit 766d1bdceb3290f83ecadd949cc0cd3ef08f8146 Merge: ac3ad19584b26 d77e7eceeac9f Author: Jakub Kicinski Date: Fri Feb 24 11:55:49 2023 -0800 Merge branch 'tools-ynl-gen-fix-glitches-found-by-chuck' Jakub Kicinski says: ==================== tools: ynl-gen: fix glitches found by Chuck A handful of fixes Chuck run into while trying to define the family for crypto handshakes. ==================== Link: https://lore.kernel.org/r/20230223183141.1422857-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d77e7eceeac9f3ab40b45649531993b456eeacd0 Author: Jakub Kicinski Date: Thu Feb 23 10:31:41 2023 -0800 tools: net: add __pycache__ to gitignore Python will generate its customary cache when running ynl scripts: ?? tools/net/ynl/lib/__pycache__/ Reported-by: Chuck Lever III Signed-off-by: Jakub Kicinski commit b9d3a3e4ae0cb7c443d46ffe413e17749baab3ba Author: Jakub Kicinski Date: Thu Feb 23 10:31:40 2023 -0800 tools: ynl-gen: re-raise the exception instead of printing traceback.print_exception() seems tricky to call, we're missing some argument, so re-raise instead. Reported-by: Chuck Lever III Fixes: 3aacf8281336 ("tools: ynl: add an object hierarchy to represent parsed spec") Signed-off-by: Jakub Kicinski commit f7cf644796fcdb6a0e30e4a7f218be74ac8cb31d Author: Jakub Kicinski Date: Thu Feb 23 10:31:39 2023 -0800 tools: ynl-gen: fix single attribute structs with attr 0 only Chuck run into an issue with a single-element attr-set which only has an attr with value of 0. The search for max attr in a struct records attrs with value larger than 0 only (max_val is set to 0 at the start). Adjust the comparison, alternatively max_val could be init'ed to -1. Somehow picking the last attr of a value seems like a good idea in general. Reported-by: Chuck Lever III Fixes: be5bea1cc0bf ("net: add basic C code generators for Netlink") Signed-off-by: Jakub Kicinski commit ea9a78c3a7a44e36fa690e1cc90dc2a758c8eb9a Author: Johan Hovold Date: Fri Feb 24 14:05:09 2023 +0100 genirq/msi: Drop dead domain name assignment Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name information only") an IRQ domain is always given a name during allocation (e.g. used for the debugfs entry). Drop the unused fallback name assignment when creating MSI domains. Signed-off-by: Johan Hovold Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230224130509.27814-1-johan+linaro@kernel.org commit ab7362d04d7c14923420c1e19e889da512a65cd7 Author: David Howells Date: Fri Feb 24 14:31:15 2023 +0000 cifs: Fix cifs_writepages_region() Fix the cifs_writepages_region() to just jump over members of the batch that have been cleaned up rather than counting them as skipped. Unlike the other "skip_write" cases, this situation happens even for WB_SYNC_ALL, simply because the page has either been cleaned by somebody else, or was truncated. So in this case we're not "skipping" the write, we simply no longer need any write at all, so it's very different from the other skip_write cases. And we definitely shouldn't stop writing the rest just because of too many of these cases (or because we want to be rescheduled). Fixes: 3822a7c40997 ("Merge tag 'mm-stable-2023-02-20-13-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm") Signed-off-by: David Howells Link: https://lore.kernel.org/lkml/2213409.1677249075@warthog.procyon.org.uk/ Signed-off-by: Linus Torvalds commit d28a06d7dbedc598a06bd1e53a28125f87ca5d0c Author: Maor Dickman Date: Wed Feb 8 17:44:06 2023 +0200 net/mlx5: Geneve, Fix handling of Geneve object id as error code On success, mlx5_geneve_tlv_option_create returns non negative Geneve object id. In case the object id is positive value the caller functions will handle it as an error (non zero) and will fail to offload the Geneve rule. Fix this by changing caller function ,mlx5_geneve_tlv_option_add, to return 0 in case valid non negative object id was provided. Fixes: 0ccc171ea6a2 ("net/mlx5: Geneve, Manage Geneve TLV options") Signed-off-by: Maor Dickman Reviewed-by: Raed Salem Signed-off-by: Saeed Mahameed commit 1bf8b0dae8dde6f02520a5ea34fdaa3b39342e69 Author: Roi Dayan Date: Tue Jan 31 12:04:30 2023 +0200 net/mlx5e: Verify flow_source cap before using it When adding send to vport rule verify flow_source matching is supported by checking the flow_source cap. Fixes: d04442540372 ("net/mlx5: E-Switch, set flow source for send to uplink rule") Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit e1ed30c8c09abc85a01c897845bdbd08c0333353 Author: Maher Sanalla Date: Wed Feb 15 20:12:05 2023 +0200 net/mlx5: ECPF, wait for VF pages only after disabling host PFs Currently, during the early stages of their unloading, particularly during SRIOV disablement, PFs/ECPFs wait on the release of all of their VFs memory pages. Furthermore, ECPFs are considered the page supplier for host VFs, hence the host VFs memory pages are freed only during ECPF cleanup when host interfaces get disabled. Thus, disabling SRIOV early in unload timeline causes the DPU ECPF to stall on driver unload while waiting on the release of host VF pages that won't be freed before host interfaces get disabled later on. Therefore, for ECPFs, wait on the release of VFs pages only after the disablement of host PFs during ECPF cleanup flow. Then, host PFs and VFs are disabled and their memory shall be freed accordingly. Fixes: 143a41d7623d ("net/mlx5: Disable SRIOV before PF removal") Signed-off-by: Maher Sanalla Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 3a50cf1e8e5157b82268eee7e330dbe5736a0948 Author: Vadim Fedorenko Date: Thu Feb 2 09:13:55 2023 -0800 mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possible during re-sync action. WARN_ON_ONCE covers future cases. There were out-of-order cqe spotted which lead to drain of the queue and use-after-free because of lack of fifo pointers check. Special check and counter are added to avoid resync operation if SKB could not exist in the fifo because of OOO cqe (skb_id must be between consumer and producer index). Fixes: 58a518948f60 ("net/mlx5e: Add resiliency for PTP TX port timestamp") Signed-off-by: Vadim Fedorenko Signed-off-by: Saeed Mahameed commit e435941b1da1a0be4ff8a7ae425774c76a5ac514 Author: Vadim Fedorenko Date: Thu Feb 2 09:13:54 2023 -0800 mlx5: fix skb leak while fifo resync and push During ptp resync operation SKBs were poped from the fifo but were never freed neither by napi_consume nor by dev_kfree_skb_any. Add call to napi_consume_skb to properly free SKBs. Another leak was happening because mlx5e_skb_fifo_has_room() had an error in the check. Comparing free running counters works well unless C promotes the types to something wider than the counter. In this case counters are u16 but the result of the substraction is promouted to int and it causes wrong result (negative value) of the check when producer have already overlapped but consumer haven't yet. Explicit cast to u16 fixes the issue. Fixes: 58a518948f60 ("net/mlx5e: Add resiliency for PTP TX port timestamp") Reviewed-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Vadim Fedorenko Signed-off-by: Saeed Mahameed commit bfeda9683dcd697dc84bbd5ce375f659e9590bf5 Author: Yang Yingliang Date: Fri Feb 17 11:13:01 2023 +0800 net/mlx5e: TC, fix return value check in mlx5e_tc_act_stats_create() kvzalloc() returns NULL pointer not PTR_ERR() when it fails, so replace the IS_ERR() check with NULL pointer check. Fixes: d13674b1d14c ("net/mlx5e: TC, map tc action cookie to a hw counter") Signed-off-by: Yang Yingliang Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 0483a16bc493075bb9f6483497786fed41d27b94 Author: Yang Li Date: Wed Feb 22 10:29:44 2023 +0800 net/mlx5: Remove NULL check before dev_{put, hold} The call netdev_{put, hold} of dev_{put, hold} will check NULL, so there is no need to check before using dev_{put, hold}, remove it to silence the warning： ./drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c:714:2-9: WARNING: NULL check before dev_{put, hold} functions is not needed. Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4174 Signed-off-by: Yang Li Signed-off-by: Saeed Mahameed commit 047ee71ae4f412d8819e39e4b08c588fa299cfc2 Author: Krishna Yarlagadda Date: Fri Feb 24 22:10:34 2023 +0530 spi: tegra210-quad: Fix validate combined sequence Check for non dma transfers that do not fit in FIFO has issue and skips combined sequence for Tegra234 & Tegra241 which does not have GPCDMA. Fixes: 1b8342cc4a38 ("spi: tegra210-quad: combined sequence mode") Signed-off-by: Krishna Yarlagadda Link: https://lore.kernel.org/r/20230224164034.56933-1-kyarlagadda@nvidia.com Signed-off-by: Mark Brown commit fb1847cc460c127b12720119eae5f438ffc62e85 Author: Martin Povišer Date: Fri Feb 24 16:33:02 2023 +0100 ASoC: apple: mca: Improve handling of unavailable DMA channels When we fail to obtain a DMA channel, don't return a blanket -EINVAL, instead return the original error code if there's one. This makes deferring work as it should. Also don't print an error message for -EPROBE_DEFER. Fixes: 4ec8179c212f ("ASoC: apple: mca: Postpone requesting of DMA channels") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20230224153302.45365-3-povik+lin@cutebit.org Signed-off-by: Mark Brown commit d8b3e396088d787771f19fd3b7949e080dc31d6f Author: Martin Povišer Date: Fri Feb 24 16:33:01 2023 +0100 ASoC: apple: mca: Fix SERDES reset sequence Fix the reset sequence of reads and writes that we invoke from within the early trigger. It looks like there never was a SERDES_CONF_SOME_RST bit that should be involved in the reset sequence, and its presence in the driver code is a mistake from earlier. Instead, the reset sequence should go as follows: We should switch the the SERDES unit's SYNC_SEL mux to the value of 7 (so outside the range of 1...6 representing cluster's SYNCGEN units), then raise the RST bit in SERDES_STATUS and wait for it to clear. Properly resetting the SERDES unit fixes frame desynchronization hazard in case of long frames (longer than 4 used slots). The desynchronization manifests itself by rotating the PCM channels. Fixes: 3df5d0d97289 ("ASoC: apple: mca: Start new platform driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20230224153302.45365-2-povik+lin@cutebit.org Signed-off-by: Mark Brown commit aaf5f0d76b6e1870e3674408de2b13a92a4d4059 Author: Martin Povišer Date: Fri Feb 24 16:33:00 2023 +0100 ASoC: apple: mca: Fix final status read on SERDES reset From within the early trigger we are doing a reset of the SERDES unit, but the final status read is on a bad address. Add the missing SERDES unit offset in calculation of the address. Fixes: 3df5d0d97289 ("ASoC: apple: mca: Start new platform driver") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20230224153302.45365-1-povik+lin@cutebit.org Signed-off-by: Mark Brown commit 1b561d3949f8478c5403c9752b5533211a757226 Author: Sudeep Holla Date: Thu Feb 23 13:57:42 2023 +0000 arm64: acpi: Fix possible memory leak of ffh_ctxt Allocated 'ffh_ctxt' memory leak is possible if the SMCCC version and conduit checks fail and -EOPNOTSUPP is returned without freeing the allocated memory. Fix the same by moving the allocation after the SMCCC version and conduit checks. Fixes: 1d280ce099db ("arm64: Add architecture specific ACPI FFH Opregion callbacks") Cc: # 6.2.x Cc: Will Deacon Reported-by: kernel test robot Reported-by: Dan Carpenter Suggested-by: Dan Carpenter Link: https://lore.kernel.org/r/202302191417.dAl9NuE8-lkp@intel.com/ Signed-off-by: Sudeep Holla Link: https://lore.kernel.org/r/20230223135742.2952091-1-sudeep.holla@arm.com Signed-off-by: Catalin Marinas commit 060a2c92d1b627c86c5c42ca69baf00457c00c5a Author: Catalin Marinas Date: Wed Feb 22 17:52:32 2023 +0000 arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP Revert the HUGETLB_PAGE_FREE_VMEMMAP selection from commit 1e63ac088f20 ("arm64: mm: hugetlb: enable HUGETLB_PAGE_FREE_VMEMMAP for arm64") but keep the flush_dcache_page() compound_head() change as it aligns with the corresponding check in the __sync_icache_dcache() function. The original config option was renamed in commit 47010c040dec ("mm: hugetlb_vmemmap: cleanup CONFIG_HUGETLB_PAGE_FREE_VMEMMAP*") to HUGETLB_PAGE_OPTIMIZE_VMEMMAP and the flush_dcache_page() check was further simplified by commit 2da1c30929a2 ("mm: hugetlb_vmemmap: delete hugetlb_optimize_vmemmap_enabled()"). The reason for the revert is that the generic vmemmap_remap_pte() function changes both the permissions (writeable to read-only) and the output address (pfn) of the vmemmap ptes. This is deemed UNPREDICTABLE by the Arm architecture without a break-before-make sequence (make the PTE invalid, TLBI, write the new valid PTE). However, such sequence is not possible since the vmemmap may be concurrently accessed by the kernel. Disable the optimisation until a better solution is found. Fixes: 1e63ac088f20 ("arm64: mm: hugetlb: enable HUGETLB_PAGE_FREE_VMEMMAP for arm64") Cc: # 5.19.x Cc: Muchun Song Cc: Will Deacon Cc: Anshuman Khandual Link: https://lore.kernel.org/r/Y9pZALdn3pKiJUeQ@arm.com Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20230222175232.540851-1-catalin.marinas@arm.com Signed-off-by: Catalin Marinas commit 89c58cb395ec0fb58df5475dced1093eaf5896ad Author: Eric Van Hensbergen Date: Sun Dec 18 21:02:24 2022 +0000 fs/9p: fix error reporting in v9fs_dir_release Checking the p9_fid_put value allows us to pass back errors involved if we end up clunking the fid as part of dir_release. This can help with more graceful response to errors in writeback among other things. Signed-off-by: Eric Van Hensbergen Reviewed-by: Dominique Martinet commit 3866584a1c56a2bbc8c0981deb4476d0b801969e Author: Eric Van Hensbergen Date: Sun Dec 18 17:57:27 2022 +0000 net/9p: fix bug in client create for .L We are supposed to set fid->mode to reflect the flags that were used to open the file. We were actually setting it to the creation mode which is the default perms of the file not the flags the file was opened with. Signed-off-by: Eric Van Hensbergen Reviewed-by: Dominique Martinet commit 74a25e6e916cb57dab4267a96fbe8864ed21abdb Author: Zhengchao Shao Date: Wed Jan 4 10:04:24 2023 +0800 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv() When down_interruptible() or ib_post_send() failed in rdma_request(), receive dma buffer is not unmapped. Add unmap action to error path. Also if ib_post_recv() failed in post_recv(), dma buffer is not unmapped. Add unmap action to error path. Link: https://lkml.kernel.org/r/20230104020424.611926-1-shaozhengchao@huawei.com Fixes: fc79d4b104f0 ("9p: rdma: RDMA Transport Support for 9P") Signed-off-by: Zhengchao Shao Reviewed-by: Leon Romanovsky Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit c15fe55d14b3b4ded5af2a3260877460a6ffb8ad Author: Juergen Gross Date: Mon Jan 30 12:30:36 2023 +0100 9p/xen: fix connection sequence Today the connection sequence of the Xen 9pfs frontend doesn't match the documented sequence. It can work reliably only for a PV 9pfs device having been added at boot time already, as the frontend is not waiting for the backend to have set its state to "XenbusStateInitWait" before reading the backend properties from Xenstore. Fix that by following the documented sequence [1] (the documentation has a bug, so the reference is for the patch fixing that). [1]: https://lore.kernel.org/xen-devel/20230130090937.31623-1-jgross@suse.com/T/#u Link: https://lkml.kernel.org/r/20230130113036.7087-3-jgross@suse.com Fixes: 868eb122739a ("xen/9pfs: introduce Xen 9pfs transport driver") Signed-off-by: Juergen Gross Reviewed-by: Simon Horman Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit f1956f4ec15195ec60976d9b5625326285ab102e Author: Juergen Gross Date: Mon Jan 30 12:30:35 2023 +0100 9p/xen: fix version parsing When connecting the Xen 9pfs frontend to the backend, the "versions" Xenstore entry written by the backend is parsed in a wrong way. The "versions" entry is defined to contain the versions supported by the backend separated by commas (e.g. "1,2"). Today only version "1" is defined. Unfortunately the frontend doesn't look for "1" being listed in the entry, but it is expecting the entry to have the value "1". This will result in failure as soon as the backend will support e.g. versions "1" and "2". Fix that by scanning the entry correctly. Link: https://lkml.kernel.org/r/20230130113036.7087-2-jgross@suse.com Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Juergen Gross Reviewed-by: Simon Horman Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit b5bfa7277ee7d944421e0ef193586c6e34d7492c Author: Nuno Sá Date: Fri Feb 24 11:45:51 2023 +0100 ASoC: adau7118: don't disable regulators on device unbind The regulators are supposed to be controlled through the set_bias_level() component callback. Moreover, the regulators are not enabled during probe and so, this would lead to a regulator unbalanced use count. Fixes: ca514c0f12b02 ("ASOC: Add ADAU7118 8 Channel PDM-to-I2S/TDM Converter driver") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20230224104551.1139981-1-nuno.sa@analog.com Signed-off-by: Mark Brown commit ac3ad19584b26fae9ac86e4faebe790becc74491 Author: Eric Dumazet Date: Thu Feb 23 08:38:45 2023 +0000 net: fix __dev_kfree_skb_any() vs drop monitor dev_kfree_skb() is aliased to consume_skb(). When a driver is dropping a packet by calling dev_kfree_skb_any() we should propagate the drop reason instead of pretending the packet was consumed. Note: Now we have enum skb_drop_reason we could remove enum skb_free_reason (for linux-6.4) v2: added an unlikely(), suggested by Yunsheng Lin. Fixes: e6247027e517 ("net: introduce dev_consume_skb_any()") Signed-off-by: Eric Dumazet Cc: Yunsheng Lin Reviewed-by: Yunsheng Lin Signed-off-by: David S. Miller commit 1862de92c81c2a74ff05819aca20b0b83192c83b Author: Tariq Toukan Date: Thu Feb 23 09:26:56 2023 +0200 netdev-genl: fix repeated typo oflloading -> offloading Fix a repeated copy/paste typo. Fixes: d3d854fd6a1d ("netdev-genl: create a simple family for netdev stuff") Signed-off-by: Tariq Toukan Acked-by: Lorenzo Bianconi Signed-off-by: David S. Miller commit c276a706ea1f51cf9723ed8484feceaf961b8f89 Author: Herbert Xu Date: Tue Feb 21 13:54:00 2023 +0800 xfrm: Allow transport-mode states with AF_UNSPEC selector xfrm state selectors are matched against the inner-most flow which can be of any address family. Therefore middle states in nested configurations need to carry a wildcard selector in order to work at all. However, this is currently forbidden for transport-mode states. Fix this by removing the unnecessary check. Fixes: 13996378e658 ("[IPSEC]: Rename mode to outer_mode and add inner_mode") Reported-by: David George Signed-off-by: Herbert Xu Signed-off-by: Steffen Klassert commit d2980d8d826554fa6981d621e569a453787472f8 Merge: 3822a7c40997d 817013880a688 Author: Linus Torvalds Date: Thu Feb 23 17:55:40 2023 -0800 Merge tag 'mm-nonmm-stable-2023-02-20-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: "There is no particular theme here - mainly quick hits all over the tree. Most notable is a set of zlib changes from Mikhail Zaslonko which enhances and fixes zlib's use of S390 hardware support: 'lib/zlib: Set of s390 DFLTCC related patches for kernel zlib'" * tag 'mm-nonmm-stable-2023-02-20-15-29' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (55 commits) Update CREDITS file entry for Jesper Juhl sparc: allow PM configs for sparc32 COMPILE_TEST hung_task: print message when hung_task_warnings gets down to zero. arch/Kconfig: fix indentation scripts/tags.sh: fix the Kconfig tags generation when using latest ctags nilfs2: prevent WARNING in nilfs_dat_commit_end() lib/zlib: remove redundation assignement of avail_in dfltcc_gdht() lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default lib/zlib: DFLTCC always switch to software inflate for Z_PACKET_FLUSH option lib/zlib: DFLTCC support inflate with small window lib/zlib: Split deflate and inflate states for DFLTCC lib/zlib: DFLTCC not writing header bits when avail_out == 0 lib/zlib: fix DFLTCC ignoring flush modes when avail_in == 0 lib/zlib: fix DFLTCC not flushing EOBS when creating raw streams lib/zlib: implement switching between DFLTCC and software lib/zlib: adjust offset calculation for dfltcc_state nilfs2: replace WARN_ONs for invalid DAT metadata block requests scripts/spelling.txt: add "exsits" pattern and fix typo instances fs: gracefully handle ->get_block not mapping bh in __mpage_writepage cramfs: Kconfig: fix spelling & punctuation ... commit 3822a7c40997dc86b1458766a3f146d62393f084 Merge: e4bc158895067 f9366f4c2a29d Author: Linus Torvalds Date: Thu Feb 23 17:09:35 2023 -0800 Merge tag 'mm-stable-2023-02-20-13-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - Daniel Verkamp has contributed a memfd series ("mm/memfd: add F_SEAL_EXEC") which permits the setting of the memfd execute bit at memfd creation time, with the option of sealing the state of the X bit. - Peter Xu adds a patch series ("mm/hugetlb: Make huge_pte_offset() thread-safe for pmd unshare") which addresses a rare race condition related to PMD unsharing. - Several folioification patch serieses from Matthew Wilcox, Vishal Moola, Sidhartha Kumar and Lorenzo Stoakes - Johannes Weiner has a series ("mm: push down lock_page_memcg()") which does perform some memcg maintenance and cleanup work. - SeongJae Park has added DAMOS filtering to DAMON, with the series "mm/damon/core: implement damos filter". These filters provide users with finer-grained control over DAMOS's actions. SeongJae has also done some DAMON cleanup work. - Kairui Song adds a series ("Clean up and fixes for swap"). - Vernon Yang contributed the series "Clean up and refinement for maple tree". - Yu Zhao has contributed the "mm: multi-gen LRU: memcg LRU" series. It adds to MGLRU an LRU of memcgs, to improve the scalability of global reclaim. - David Hildenbrand has added some userfaultfd cleanup work in the series "mm: uffd-wp + change_protection() cleanups". - Christoph Hellwig has removed the generic_writepages() library function in the series "remove generic_writepages". - Baolin Wang has performed some maintenance on the compaction code in his series "Some small improvements for compaction". - Sidhartha Kumar is doing some maintenance work on struct page in his series "Get rid of tail page fields". - David Hildenbrand contributed some cleanup, bugfixing and generalization of pte management and of pte debugging in his series "mm: support __HAVE_ARCH_PTE_SWP_EXCLUSIVE on all architectures with swap PTEs". - Mel Gorman and Neil Brown have removed the __GFP_ATOMIC allocation flag in the series "Discard __GFP_ATOMIC". - Sergey Senozhatsky has improved zsmalloc's memory utilization with his series "zsmalloc: make zspage chain size configurable". - Joey Gouly has added prctl() support for prohibiting the creation of writeable+executable mappings. The previous BPF-based approach had shortcomings. See "mm: In-kernel support for memory-deny-write-execute (MDWE)". - Waiman Long did some kmemleak cleanup and bugfixing in the series "mm/kmemleak: Simplify kmemleak_cond_resched() & fix UAF". - T.J. Alumbaugh has contributed some MGLRU cleanup work in his series "mm: multi-gen LRU: improve". - Jiaqi Yan has provided some enhancements to our memory error statistics reporting, mainly by presenting the statistics on a per-node basis. See the series "Introduce per NUMA node memory error statistics". - Mel Gorman has a second and hopefully final shot at fixing a CPU-hog regression in compaction via his series "Fix excessive CPU usage during compaction". - Christoph Hellwig does some vmalloc maintenance work in the series "cleanup vfree and vunmap". - Christoph Hellwig has removed block_device_operations.rw_page() in ths series "remove ->rw_page". - We get some maple_tree improvements and cleanups in Liam Howlett's series "VMA tree type safety and remove __vma_adjust()". - Suren Baghdasaryan has done some work on the maintainability of our vm_flags handling in the series "introduce vm_flags modifier functions". - Some pagemap cleanup and generalization work in Mike Rapoport's series "mm, arch: add generic implementation of pfn_valid() for FLATMEM" and "fixups for generic implementation of pfn_valid()" - Baoquan He has done some work to make /proc/vmallocinfo and /proc/kcore better represent the real state of things in his series "mm/vmalloc.c: allow vread() to read out vm_map_ram areas". - Jason Gunthorpe rationalized the GUP system's interface to the rest of the kernel in the series "Simplify the external interface for GUP". - SeongJae Park wishes to migrate people from DAMON's debugfs interface over to its sysfs interface. To support this, we'll temporarily be printing warnings when people use the debugfs interface. See the series "mm/damon: deprecate DAMON debugfs interface". - Andrey Konovalov provided the accurately named "lib/stackdepot: fixes and clean-ups" series. - Huang Ying has provided a dramatic reduction in migration's TLB flush IPI rates with the series "migrate_pages(): batch TLB flushing". - Arnd Bergmann has some objtool fixups in "objtool warning fixes". * tag 'mm-stable-2023-02-20-13-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (505 commits) include/linux/migrate.h: remove unneeded externs mm/memory_hotplug: cleanup return value handing in do_migrate_range() mm/uffd: fix comment in handling pte markers mm: change to return bool for isolate_movable_page() mm: hugetlb: change to return bool for isolate_hugetlb() mm: change to return bool for isolate_lru_page() mm: change to return bool for folio_isolate_lru() objtool: add UACCESS exceptions for __tsan_volatile_read/write kmsan: disable ftrace in kmsan core code kasan: mark addr_has_metadata __always_inline mm: memcontrol: rename memcg_kmem_enabled() sh: initialize max_mapnr m68k/nommu: add missing definition of ARCH_PFN_OFFSET mm: percpu: fix incorrect size in pcpu_obj_full_size() maple_tree: reduce stack usage with gcc-9 and earlier mm: page_alloc: call panic() when memoryless node allocation fails mm: multi-gen LRU: avoid futile retries migrate_pages: move THP/hugetlb migration support check to simplify code migrate_pages: batch flushing TLB migrate_pages: share more code between _unmap and _move ... commit bd78acc89d4147aa4897a4c43e2a74c7df999b12 Author: Song Chen Date: Fri Dec 30 14:33:53 2022 +0800 kernel/trace: extract common part in process_fetch_insn Each probe has an instance of process_fetch_insn respectively, but they have something in common. This patch aims to extract the common part into process_common_fetch_insn which can be shared by each probe, and they only need to focus on their special cases. Signed-off-by: Song Chen Suggested-by: Masami Hiramatsu Acked-by: Masami Hiramatsu Signed-off-by: Masami Hiramatsu commit 672a2bf84061f0f19acfc5869f5b3689759a55a8 Author: Song Chen Date: Fri Dec 30 14:33:38 2022 +0800 kernel/trace: Provide default impelentations defined in trace_probe_tmpl.h There are 6 function definitions in trace_probe_tmpl.h, they are: 1, fetch_store_strlen 2, fetch_store_string 3, fetch_store_strlen_user 4, fetch_store_string_user 5, probe_mem_read 6, probe_mem_read_user Every C file which includes trace_probe_tmpl.h has to implement them, otherwise it gets warnings and errors. However, some of them are identical, like kprobe and eprobe, as a result, there is a lot redundant code in those 2 files. This patch would like to provide default behaviors for those functions which kprobe and eprobe can share by just including trace_probe_kernel.h with trace_probe_tmpl.h together. It removes redundant code, increases readability, and more importantly, makes it easier to introduce a new feature based on trace probe (it's possible). Link: https://lore.kernel.org/all/1672382018-18347-1-git-send-email-chensong_2000@189.cn/ Signed-off-by: Song Chen Reported-by: kernel test robot Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 196b6389a363e0d7e6b6f2654b9889f9c821b9d3 Author: Song Chen Date: Fri Dec 30 14:33:19 2022 +0800 kernel/trace: Introduce trace_probe_print_args and use it in *probes print_probe_args is currently inplemented in trace_probe_tmpl.h and included by *probes, as a result, each probe has an identical copy. This patch will move it to trace_probe.c as an new API, each probe calls it to print their args in trace file. Link: https://lore.kernel.org/all/1672382000-18304-1-git-send-email-chensong_2000@189.cn/ Signed-off-by: Song Chen Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit a6b811cb402f4beb7c8a56345a40bf6c65bd771d Author: Gal Pressman Date: Wed Feb 22 15:01:59 2023 -0800 net/mlx5e: Remove hairpin write debugfs files Per the discussion in [1], hairpin parameters will be exposed using devlink, remove the debugfs files. [1] https://lore.kernel.org/all/20230111194608.7f15b9a1@kernel.org/ Signed-off-by: Gal Pressman Signed-off-by: Saeed Mahameed Link: https://lore.kernel.org/all/20230222230202.523667-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 3acd9db9293f3b33ac04e8d44ed05b604ad1ac26 Author: Deepak R Varma Date: Wed Feb 22 18:58:48 2023 +0530 octeontx2-pf: Use correct struct reference in test condition Fix the typo/copy-paste error by replacing struct variable ah_esp_mask name by ah_esp_hdr. Issue identified using doublebitand.cocci Coccinelle semantic patch. Fixes: b7cf966126eb ("octeontx2-pf: Add flow classification using IP next level protocol") Link: https://lore.kernel.org/all/20210111112537.3277-1-naveenm@marvell.com/ Signed-off-by: Deepak R Varma Link: https://lore.kernel.org/r/Y/YYkKddeHOt80cO@ubun2204.myguest.virtualbox.org Signed-off-by: Jakub Kicinski commit e4bc15889506723d7b93c053ad4a75cd58248d74 Merge: 025cf4dc5d76d 056f65c3938bf Author: Linus Torvalds Date: Thu Feb 23 15:09:31 2023 -0800 Merge tag 'leds-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "Removed Drivers: - HTC ASIC3 LED New Functionality: - Provide generic led_get() which can be used by both DT and !DT platforms Fix-ups: - Convert a bunch of I2C subsystem users to the new probing API - Explicitly provide missing include files - Make use of led_init_default_state_get() and rid the custom variants - Use simplified fwnode_device_is_compatible() API - Provide some Device Tree additions / adaptions - Fix some trivial spelling issues Bug Fixes: - Prevent device refcount leak during led_put() and of_led_get() - Clear previous data from temporary led_pwm structure before processing next child - Fix Clang's warning about incompatible function types when using devm_add_action*()" * tag 'leds-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (41 commits) leds: Remove ide-disk trigger dt-bindings: leds: Add disk write/read and usb-host/usb-gadget Documentation: leds: Correct spelling dt-bindings: leds: Document Bluetooth and WLAN triggers leds: Remove asic3 driver leds: simatic-ipc-leds-gpio: Make sure we have the GPIO providing driver leds: tca6507: Convert to use fwnode_device_is_compatible() leds: syscon: Get rid of custom led_init_default_state_get() leds: pm8058: Get rid of custom led_init_default_state_get() leds: pca955x: Get rid of custom led_init_default_state_get() leds: mt6360: Get rid of custom led_init_default_state_get() leds: mt6323: Get rid of custom led_init_default_state_get() leds: bcm6358: Get rid of custom led_init_default_state_get() leds: bcm6328: Get rid of custom led_init_default_state_get() leds: an30259a: Get rid of custom led_init_default_state_get() leds: Move led_init_default_state_get() to the global header leds: Add missing includes and forward declarations in leds.h leds: is31fl319x: Wrap mutex_destroy() for devm_add_action_or_rest() leds: turris-omnia: Convert to i2c's .probe_new() leds: tlc591xx: Convert to i2c's .probe_new() ... commit 025cf4dc5d76d89952eb29405f964c93cb13d7b9 Merge: c2c23dc7d5f86 ad614f81d2e8b Author: Linus Torvalds Date: Thu Feb 23 15:06:28 2023 -0800 Merge tag 'backlight-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Drivers: - Add support for Kinetic KTZ8866 Backlight Removed Drivers: - Toshiba Sharp SL-6000 LCD and Backlight Fix-ups: - Provide some profiling optimisations with respect to pwm_get_state() and pwm_apply_state() - Make use of the dev_err_probe() API - Provide some Device Tree documentation additions / adaptions - Drop fall-back legacy PWM probing support - Convert over to new I2C probing API - Fix incorrect documentation - Make use of backlight_get_brightness() API Bug Fixes: - Fix disabling backlight on i.MX6 when inverted PWMs are used" * tag 'backlight-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: ktz8866: Convert to i2c's .probe_new() backlight: ktz8866: Add support for Kinetic KTZ8866 backlight dt-bindings: leds: backlight: Add Kinetic KTZ8866 backlight backlight: pwm_bl: Don't rely on a disabled PWM emiting inactive state backlight: pwm_bl: Configure pwm only once per backlight toggle backlight: Remove pxa tosa support backlight: aat2870: Use backlight helper backlight: ipaq_micro: Use backlight helper backlight: arcxcnn: Use backlight helper backlight: sky81452: Fix sky81452_bl_platform_data kernel-doc backlight: pwm_bl: Drop support for legacy PWM probing dt-bindings: backlight: qcom-wled: Add PMI8950 compatible backlight: ktd253: Switch to use dev_err_probe() helper backlight: backlight: Fix doc for backlight_device_get_by_name commit c2c23dc7d5f866a8bec3db638fae7f63789303ac Merge: 06e1a81c4806d 59c54c5997464 Author: Linus Torvalds Date: Thu Feb 23 15:03:05 2023 -0800 Merge tag 'mfd-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "Core Framework: - Change MFD support status from Supported to Maintained New Drivers: - Add support for the Intel Platform Management Component Interface (PMCI) Removed Drivers: - HTC PASIC3 LED/DS1WM - Toshiba T7L66XB, TC6387XB and TC6393XB TMIO New Device Support: - Add support for N6000 Flash to Intel M10 BMC PMCI - Add support for Lenovo Yoga Tab 3 to Intel CHTWC PMIC New Functionality: - Provide Reset support to Syscon Fix-ups: - Explicitly provide missing include files - Pass platform type data/info via the SPI/I2C/DT registration strategy - Lots of DT documentation / adaptions - Replace scnprintf() with preferred sysfs_emit() - Remove unused / superfluous code - Fix some trivial whitesspace / spelling / grammatical issues - Replace pm_power_off with new and improved register_sys_off_handler() API Bug Fixes: - Reintroduce RK808-clkout registration - fixing Wi-Fi and Bluetooth - Repair the order of AXPxxx IRQ PEK RISE/FALL definitions - Refuse to build CS5535 on unsupported UML architectures - Fix memory leaks in error return paths - Prevent refcount leaks in error return paths" * tag 'mfd-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (40 commits) dt-bindings: mfd: qcom,tcsr: Add compatible for IPQ5332 dt-bindings: mfd: Add NXP BBNSM mfd: ntxec: Add version number for EC in Tolino Vision dt-bindings: mfd: syscon: Add mt8365-syscfg mfd: Remove toshiba tmio drivers mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak mfd: syscon: Allow reset control for syscon devices dt-bindings: mfd/syscon: Add resets property dt-bindings: mfd: syscon: Add amd,pensando-elba-syscon compatible dt-bindings: mfd: qcom,tcsr: Add compatible for MSM8226 mfd: simple-mfd-i2c: Fix incoherent comment regarding DT registration mfd: axp20x: Switch to the sys-off handler API mfd: core: Spelling s/compement/complement/ mfd: max8925: Remove the unused function irq_to_max8925() mfd: qcom-pm8xxx: Remove set but unused variable 'rev' dt-bindings: mfd: syscon: Document GXP register compatible mfd: twl4030-power: Drop empty platform remove function mfd: twl: Fix TWL6032 phy vbus detection mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() MAINTAINERS: Move MFD from a Supported to Maintaied state ... commit e90ff8ede777b98b44611b416b1ae6be94258335 Author: Sean Anderson Date: Thu Dec 22 16:45:31 2022 -0500 rtc: abx80x: Add nvmem support This adds support for the 256-byte internal RAM. There are two windows which can be used to access this RAM: 64 bytes at 0x40 (the "standard" address space) and 128 bytes at 0x80 (the "alternate" address space). We use the standard address space because it is also accessible over SPI (if such a port is ever done). We are limited to 32-byte reads for SMBus compatibility, so there's no advantage to using the alternate address space. There are some reserved bits in the EXTRAM register, and the datasheet doesn't say what to do with them. I've opted to skip a read/modify/write and just write the whole thing. If this driver is ever converted to regmap, this would be a good place to use regmap_update_bits. Signed-off-by: Sean Anderson Link: https://lore.kernel.org/r/20221222214532.1873718-1-sean.anderson@seco.com Signed-off-by: Alexandre Belloni commit 06e1a81c4806d0b7f75f9d742ebf410718244e03 Merge: f2b98d0af217f e1d447157f232 Author: Linus Torvalds Date: Thu Feb 23 14:41:48 2023 -0800 Merge tag 'efi-next-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "A healthy mix of EFI contributions this time: - Performance tweaks for efifb earlycon (Andy) - Preparatory refactoring and cleanup work in the efivar layer, which is needed to accommodate the Snapdragon arm64 laptops that expose their EFI variable store via a TEE secure world API (Johan) - Enhancements to the EFI memory map handling so that Xen dom0 can safely access EFI configuration tables (Demi Marie) - Wire up the newly introduced IBT/BTI flag in the EFI memory attributes table, so that firmware that is generated with ENDBR/BTI landing pads will be mapped with enforcement enabled - Clean up how we check and print the EFI revision exposed by the firmware - Incorporate EFI memory attributes protocol definition and wire it up in the EFI zboot code (Evgeniy) This ensures that these images can execute under new and stricter rules regarding the default memory permissions for EFI page allocations (More work is in progress here) - CPER header cleanup (Dan Williams) - Use a raw spinlock to protect the EFI runtime services stack on arm64 to ensure the correct semantics under -rt (Pierre) - EFI framebuffer quirk for Lenovo Ideapad (Darrell)" * tag 'efi-next-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (24 commits) firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 arm64: efi: Make efi_rt_lock a raw_spinlock efi: Add mixed-mode thunk recipe for GetMemoryAttributes efi: x86: Wire up IBT annotation in memory attributes table efi: arm64: Wire up BTI annotation in memory attributes table efi: Discover BTI support in runtime services regions efi/cper, cxl: Remove cxl_err.h efi: Use standard format for printing the EFI revision efi: Drop minimum EFI version check at boot efi: zboot: Use EFI protocol to remap code/data with the right attributes efi/libstub: Add memory attribute protocol definitions efi: efivars: prevent double registration efi: verify that variable services are supported efivarfs: always register filesystem efi: efivars: add efivars printk prefix efi: Warn if trying to reserve memory under Xen efi: Actually enable the ESRT under Xen efi: Apply allowlist to EFI configuration tables when running under Xen efi: xen: Implement memory descriptor lookup based on hypercall efi: memmap: Disregard bogus entries instead of returning them ... commit 344504e912ea49033d012dad9de3f68e20c07634 Author: Eric Van Hensbergen Date: Thu Dec 8 02:03:32 2022 +0000 fs/9p: Expand setup of writeback cache to all levels If cache is enabled, make sure we are putting the right things in place (mainly impacts mmap). This also sets us up for more cache levels. Signed-off-by: Eric Van Hensbergen Reviewed-by: Dominique Martinet commit 2a03472262c05f965d7ba394ed35dc9867ba3095 Author: Eric Van Hensbergen Date: Mon Nov 28 00:38:36 2022 +0000 net/9p: Adjust maximum MSIZE to account for p9 header Add maximum p9 header size to MSIZE to make sure we can have page aligned data. Signed-off-by: Eric Van Hensbergen Reviewed-by: Dominique Martinet commit 424b3d7582a2a4a7c45d405225ac70cff97f2e4a Author: Guchun Chen Date: Tue Feb 21 12:35:25 2023 +0800 drm/amd/pm: downgrade log level upon SMU IF version mismatch SMU IF version mismatch as a warning message exists widely after asic production, however, due to this log level setting, such mismatch warning will be caught by automation test like IGT and reported as a fake error after checking. As such mismatch does not break anything, to reduce confusion, downgrade it from dev_warn to dev_info. Signed-off-by: Guchun Chen Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit b1e9a718af2ec3d21734a8357e8f22aa3bb68bfb Author: Candice Li Date: Mon Jan 16 16:18:21 2023 +0800 drm/amdgpu: Add ecc info query interface for umc v8_10 Support ecc info query for umc v8_10. v2: Simplied by convert_error_address. v3: Remove unused variable and invalid checking. Signed-off-by: Candice Li Reviewed-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit 2d53b579f3f217d5b88fb6708dcaef28f7b9fc0b Author: Candice Li Date: Wed Feb 15 21:16:56 2023 +0800 drm/amdgpu: Add convert_error_address function for umc v8_10 Add convert_error_address for umc v8_10. Signed-off-by: Candice Li Reviewed-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit 22106ed0be0d6c5b4aa07e18b63c1245bdb719c9 Author: Tao Zhou Date: Tue Feb 21 16:03:49 2023 +0800 drm/amdgpu: add bad_page_threshold check in ras_eeprom_check_err bad_page_threshold controls page retirement behavior and it should be also checked. v2: simplify the condition of bad page handling path. Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit f3cbe70e215a87dcfdf028582a2fa94b24a08efe Author: Tao Zhou Date: Tue Feb 21 15:25:01 2023 +0800 drm/amdgpu: change default behavior of bad_page_threshold parameter Ignore ras umc bad page threshold by default, GPU initialization won't be stopped in this mode. v2: refine the description of bad_page_threshold. Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit 4d33e0f1340b3d08002ff8f9bcbf256cfdc4f3ba Author: Tao Zhou Date: Fri Feb 10 16:33:58 2023 +0800 drm/amdgpu: exclude duplicate pages from UMC RAS UE count If a UMC bad page is reserved but not freed by an application, the application may trigger uncorrectable error repeatly by accessing the page. v2: add specific function to do the check. v3: remove duplicate pages, calculate new added bad page number. v4: reuse save_bad_pages to calculate new added bad page number. Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit e69c785723ed88a930d332e13bc9140dce48f359 Author: Tao Zhou Date: Fri Feb 17 11:16:10 2023 +0800 drm/amdgpu: add umc retire unit element It records how many bad pages are retired in one uncorrectable error. Signed-off-by: Tao Zhou Reviewed-by: Stanley.Yang Signed-off-by: Alex Deucher commit 6761c4bfee681c306bbe6599951e74826660be47 Author: Evan Quan Date: Tue Feb 21 15:21:19 2023 +0800 drm/amd/pm: no pptable resetup on runpm exiting It is assumed the pptable used before runpm is same as the one used afterwards. Thus, we can reuse the stored copy and do not need to resetup the pptable again. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit edddc6fd542ffbae680c2201bbf6763f1693db4f Author: Evan Quan Date: Tue Feb 21 15:17:43 2023 +0800 drm/amd/pm: correct the baco state setting for ArmD3 scenario The check for baco support relies on the correct baco state. Signed-off-by: Evan Quan Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher commit b299221faf9b62166413526be2438d21257f019e Author: Marek Olšák Date: Sun Jan 29 23:00:59 2023 -0500 drm/amdgpu: add more fields into device info, caches sizes, etc. AMDGPU_IDS_FLAGS_CONFORMANT_TRUNC_COORD: important for conformance on gfx11 Other fields are exposed from IP discovery. enabled_rb_pipes_mask_hi is added for future chips, currently 0. Mesa MR: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/21403 Signed-off-by: Marek Olšák Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 4fc8fff378b2f2039f2a666d9f8c570f4e58352c Author: Qu Huang Date: Tue Feb 21 11:35:16 2023 +0000 drm/amdkfd: Fix an illegal memory access In the kfd_wait_on_events() function, the kfd_event_waiter structure is allocated by alloc_event_waiters(), but the event field of the waiter structure is not initialized; When copy_from_user() fails in the kfd_wait_on_events() function, it will enter exception handling to release the previously allocated memory of the waiter structure; Due to the event field of the waiters structure being accessed in the free_waiters() function, this results in illegal memory access and system crash, here is the crash log: localhost kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0 localhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082 localhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000 localhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0 localhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64 localhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002 localhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698 localhost kernel: FS: 0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 localhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0 localhost kernel: Call Trace: localhost kernel: _raw_spin_lock_irqsave+0x30/0x40 localhost kernel: remove_wait_queue+0x12/0x50 localhost kernel: kfd_wait_on_events+0x1b6/0x490 [hydcu] localhost kernel: ? ftrace_graph_caller+0xa0/0xa0 localhost kernel: kfd_ioctl+0x38c/0x4a0 [hydcu] localhost kernel: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu] localhost kernel: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu] localhost kernel: ? ftrace_graph_caller+0xa0/0xa0 localhost kernel: __x64_sys_ioctl+0x8e/0xd0 localhost kernel: ? syscall_trace_enter.isra.18+0x143/0x1b0 localhost kernel: do_syscall_64+0x33/0x80 localhost kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9 localhost kernel: RIP: 0033:0x152a4dff68d7 Allocate the structure with kcalloc, and remove redundant 0-initialization and a redundant loop condition check. Signed-off-by: Qu Huang Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 6dcb38a19efaa71c95c017652177cecb5be4191d Author: Jane Jian Date: Wed Feb 15 16:48:47 2023 +0800 drm/amdgpu/vcn: set and use harvest config in early init to set harvest config if the vcn0/1 is disabled rather than hard-code the ring attributes as before did Signed-off-by: Jane Jian Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit ca47518663973083c513cd6b2801dcda0bfaaa99 Author: Mario Limonciello Date: Mon Feb 13 15:10:30 2023 -0600 drm/amd: Don't allow s0ix on APUs older than Raven APUs before Raven didn't support s0ix. As we just relieved some of the safety checks for s0ix to improve power consumption on APUs that support it but that are missing BIOS support a new blind spot was introduced that a user could "try" to run s0ix. Plug this hole so that if users try to run s0ix on anything older than Raven it will just skip suspend of the GPU. Fixes: cf488dcd0ab7 ("drm/amd: Allow s0ix without BIOS support") Suggested-by: Alexander Deucher Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit f9c35f4fffc6cb5bbb23f546f48c045aef012518 Author: Hawking Zhang Date: Mon Feb 20 09:06:53 2023 +0800 drm/amdgpu: fix incorrect active rb bitmap for gfx11 GFX v11 changes RB_BACKEND_DISABLE related registers from per SA to global ones. The approach to query active rb bitmap needs to be changed accordingly. Query per SE setting returns wrong active RB bitmap especially in the case when some of SA are disabled. With the new approach, driver will generate the active rb bitmap based on active SA bitmap and global active RB bitmap. Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Signed-off-by: Alex Deucher commit 2866cc09617991cb4f9f36fbebdbba966fe5a21a Author: Shane Xiao Date: Sat Feb 18 11:58:45 2023 +0800 drm/amdgpu: optimize VRAM allocation when using drm buddy Since the VRAM manager changed from drm mm to drm buddy. It's not necessary to allocate 2MB aligned VRAM for more than 2MB unaligned size, and then do trim. This method improves the allocation efficiency and reduces memory fragmentation. v2: Correct the remainder operation Signed-off-by: Shane Xiao Reviewed-by: Arunpravin Paneer Selvam Signed-off-by: Alex Deucher commit c105518679b6e87232874ffc989ec403bee59664 Author: Shane Xiao Date: Wed Feb 15 13:23:44 2023 +0800 drm/amdgpu: remove TOPDOWN flags when allocating VRAM in large bar system Since VRAM manager is changed from drm mm to drm buddy, the TOP_DOWN flag should not be set by default in the large bar system. Removing this flag helps improve drm buddy allocator efficiency and reduce the risk of splitting higher order block into lower order. Signed-off-by: Shane Xiao Reviewed-by: Christian K�nig Signed-off-by: Alex Deucher commit 455ad25997ba6e6b4c5fb9b4f3cd54ec415df969 Author: Harry Wentland Date: Mon Feb 13 13:17:16 2023 -0500 drm/amdgpu: Select DRM_DISPLAY_HDCP_HELPER in amdgpu Keeps this selection with the rest of the DRM HELPER selection. Signed-off-by: Harry Wentland Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit 6d9b6dceaa513c19a968c523f4d68477a33a98c9 Author: Hamza Mahfooz Date: Tue Feb 14 13:51:08 2023 -0500 drm/amd/display: only warn once in dce110_edp_wait_for_hpd_ready() Since, hot plugging eDP displays isn't supported, it is sufficient for us to warn about the lack of a connected display once. So, use ASSERT() in dce110_edp_wait_for_hpd_ready() instead of DC_LOG_WARNING(). Reviewed-by: Harry Wentland Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit d9e1e14f42337ea11b2dfc0bab99485a8f7fa210 Author: Kenneth Feng Date: Wed Feb 15 14:42:08 2023 +0800 drm/amd/pm: re-enable ac/dc on smu_v13_0_0/10 re-enable ac/dc on smu_v13_0_0/10 Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 08c6ab7fb4d98694df5a9954a42a365cc538f9b0 Author: Jesse Zhang Date: Thu Feb 16 14:11:33 2023 +0800 drm/amdgpu: add tmz support for GC 10.3.6 this patch to add tmz support for GC 10.3.6 Signed-off-by: Jesse Zhang Reviewed-by: Yifan Zhang Signed-off-by: Alex Deucher commit 2e2b9baf008ec795fe750a48b42e787cf31486df Author: Ruili Ji Date: Mon Feb 6 18:35:50 2023 +0800 drm/amdkfd: To fix sdma page fault issue for GC 11 For the MQD memory, KMD would always allocate 4K memory, and mes scheduler would write to the end of MQD for unmap flag. Signed-off-by: Ruili Ji Signed-off-by: Alex Deucher commit f2b98d0af217f64b96bc549457018117ba6b7509 Merge: fcc77d7c8ef64 6c40624930c58 Author: Linus Torvalds Date: Thu Feb 23 14:27:01 2023 -0800 Merge tag 'bootconfig-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig updates from Masami Hiramatsu: - Fix ftrace2bconf.sh tool for checking event enable status correctly - Add CONFIG_BOOT_CONFIG_FORCE to apply bootconfig without 'bootconfig' boot parameter - Enable CONFIG_BOOT_CONFIG_FORCE by default if a bootconfig is embedded in the kernel - Increase max number of nodes of bootconfig to 8192 * tag 'bootconfig-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support bootconfig: Default BOOT_CONFIG_FORCE to y if BOOT_CONFIG_EMBED Allow forcing unconditional bootconfig processing tools/bootconfig: fix single & used for logical condition commit fcc77d7c8ef6478844547d50dd3d03270c86116c Merge: c538944d8efb1 f1aa2eb5ea05c Author: Linus Torvalds Date: Thu Feb 23 14:16:56 2023 -0800 Merge tag 'sysctl-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl update from Luis Chamberlain: "Just one fix which just came in. Sadly the eager beavers willing to help with the sysctl moves have slowed" * tag 'sysctl-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: sysctl: fix proc_dobool() usability commit c538944d8efb14e9809b685608490b017bfc2d48 Merge: 7dd86cf80127a f412eef03938d Author: Linus Torvalds Date: Thu Feb 23 14:05:08 2023 -0800 Merge tag 'modules-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull modules updates from Luis Chamberlain: "Nothing exciting at all for modules for v6.3. The biggest change is just the change of INSTALL_MOD_DIR from "extra" to "updates" which I found lingered for ages for no good reason while testing the CXL mock driver [0]. The CXL mock driver has no kconfig integration and requires building an external module... and re-building the *rest* of the production drivers. This mock driver when loaded but not the production ones will crash. All this can obviously be fixed by integrating kconfig semantics into such test module, however that's not desirable by the maintainer, and so sensible defaults must be used to ensure a default "make modules_install" will suffice for most distros which do not have a file like /etc/depmod.d/dist.conf with something like `search updates extra built-in`. Since most distros rely on kmod and since its inception the "updates" directory is always in the search path it makes more sense to use that than the "extra" which only *some* RH based systems rely on. All this stuff has been on linux-next for a while" [0] https://lkml.kernel.org/r/20221209062919.1096779-1-mcgrof@kernel.org * tag 'modules-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: Documentation: livepatch: module-elf-format: Remove local klp_modinfo definition module.h: Document klp_modinfo struct using kdoc module: Use kstrtobool() instead of strtobool() kernel/params.c: Use kstrtobool() instead of strtobool() test_kmod: stop kernel-doc warnings kbuild: Modify default INSTALL_MOD_DIR from extra to updates commit 7dd86cf80127aeef8a447c81228a77f0f25cc211 Merge: d8763154455e9 0c05e7bd2d017 Author: Linus Torvalds Date: Thu Feb 23 14:00:10 2023 -0800 Merge tag 'livepatching-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching updates from Petr Mladek: - Allow reloading a livepatched module by clearing livepatch-specific relocations in the livepatch module. Otherwise, the repeated load would fail on consistency checks. * tag 'livepatching-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch,x86: Clear relocation targets on a module removal x86/module: remove unused code in __apply_relocate_add commit d8763154455e92a2ffed256e48fa46bb35ef3bdf Merge: cd43b5068647f 392143c9f2a31 Author: Linus Torvalds Date: Thu Feb 23 13:49:45 2023 -0800 Merge tag 'printk-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Refactor printk code for formatting messages that are shown on consoles. This is a preparatory step for introducing atomic consoles which could not share the global buffers - Prevent memory leak when removing printk index in debugfs - Dump also the newest printk message by the sample gdbmacro - Fix a compiler warning * tag 'printk-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printf: fix errname.c list kernel/printk/index.c: fix memory leak with using debugfs_lookup() printk: Use scnprintf() to print the message about the dropped messages on a console printk: adjust string limit macros printk: use printk_buffers for devkmsg printk: introduce console_prepend_dropped() for dropped messages printk: introduce printk_get_next_message() and printk_message printk: introduce struct printk_buffers console: Document struct console console: Use BIT() macros for @flags values printk: move size limit macros into internal.h docs: gdbmacros: print newest record commit cd43b5068647f47d6936ffef4d15d99518fcab94 Merge: 2b79eb73e2c4b b45bc2e09906a Author: Linus Torvalds Date: Thu Feb 23 13:41:55 2023 -0800 Merge tag 'slab-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: "This time it's just a bunch of smaller cleanups and fixes for SLAB and SLUB: - Make it possible to use kmem_cache_alloc_bulk() early in boot when interrupts are not yet enabled, as code doing that started to appear via new maple tree users (Thomas Gleixner) - Fix debugfs-related memory leak in SLUB (Greg Kroah-Hartman) - Use the standard idiom to get head page of folio (SeongJae Park) - Simplify and inline is_debug_pagealloc_cache() in SLAB (lvqian) - Remove unused variable in SLAB (Gou Hao)" * tag 'slab-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm, slab/slub: Ensure kmem_cache_alloc_bulk() is available early mm/slub: fix memory leak with using debugfs_lookup() mm/slab.c: cleanup is_debug_pagealloc_cache() mm/sl{a,u}b: fix wrong usages of folio_page() for getting head pages mm/slab: remove unused slab_early_init commit 2b79eb73e2c4b362a2a261b7b2f718385fb478e4 Merge: 0df82189bc420 c96abaec78f34 Author: Linus Torvalds Date: Thu Feb 23 13:03:08 2023 -0800 Merge tag 'probes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull kprobes updates from Masami Hiramatsu: - Skip negative return code check for snprintf in eprobe - Add recursive call test cases for kprobe unit test - Add 'char' type to probe events to show it as the character instead of value - Update kselftest kprobe-event testcase to ignore '__pfx_' symbols - Fix kselftest to check filter on eprobe event correctly - Add filter on eprobe to the README file in tracefs - Fix optprobes to check whether there is 'under unoptimizing' optprobe when optimizing another kprobe correctly - Fix optprobe to check whether there is 'under unoptimizing' optprobe when fetching the original instruction correctly - Fix optprobe to free 'forcibly unoptimized' optprobe correctly * tag 'probes-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/eprobe: no need to check for negative ret value for snprintf test_kprobes: Add recursed kprobe test case tracing/probe: add a char type to show the character value of traced arguments selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols selftests/ftrace: Fix eprobe syntax test case to check filter support tracing/eprobe: Fix to add filter on eprobe description in README file x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range x86/kprobes: Fix __recover_optprobed_insn check optimizing logic kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list commit 68ba44639537de6f91fe32783766322d41848127 Author: Xin Long Date: Wed Feb 22 12:07:21 2023 -0500 sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop With this refcnt added in sctp_stream_priorities, we don't need to traverse all streams to check if the prio is used by other streams when freeing one stream's prio in sctp_sched_prio_free_sid(). This can avoid a nested loop (up to 65535 * 65535), which may cause a stuck as Ying reported: watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136] Call Trace: sctp_sched_prio_free_sid+0xab/0x100 [sctp] sctp_stream_free_ext+0x64/0xa0 [sctp] sctp_stream_free+0x31/0x50 [sctp] sctp_association_free+0xa5/0x200 [sctp] Note that it doesn't need to use refcount_t type for this counter, as its accessing is always protected under the sock lock. v1->v2: - add a check in sctp_sched_prio_set to avoid the possible prio_head refcnt overflow. Fixes: 9ed7bfc79542 ("sctp: fix memory leak in sctp_stream_outq_migrate()") Reported-by: Ying Xu Acked-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Link: https://lore.kernel.org/r/825eb0c905cb864991eba335f4a2b780e543f06b.1677085641.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 6ccbe33a39523f6d62b22c5ee99c6695993c935e Author: Melody Olvera Date: Mon Feb 13 10:52:11 2023 -0800 dt-bindings: mailbox: qcom-ipcc: Add compatible for QDU1000/QRU1000 Document the compatible for the QDU1000 mailbox. Signed-off-by: Melody Olvera Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 1261a6626a08071b7c9fa3025deb569c91eb55ae Author: Kathiravan T Date: Thu Feb 2 20:22:07 2023 +0530 mailbox: qcom-apcs-ipc: add IPQ5332 APSS clock support IPQ5332 has the APSS clock controller utilizing the same register space as the APCS, so provide access to the APSS utilizing a child device like other IPQ chipsets. Like IPQ6018, the same controller and driver is used, so utilize IPQ6018 match data for IPQ5332. Signed-off-by: Kathiravan T Reviewed-by: Konrad Dybcio Signed-off-by: Jassi Brar commit df4c17aa3ea0a8128747f5234b06d7375642f9db Author: Kathiravan T Date: Fri Feb 17 14:03:07 2023 +0530 dt-bindings: mailbox: qcom: add compatible for the IPQ5332 SoC Add the mailbox compatible for the IPQ5332 SoC. Since the IPQ5332 mailbox is compatible with the IPQ6018, lets create the fallback to ipq6018 compatible, so that we don't bloat the of_device_id table in the driver. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kathiravan T Signed-off-by: Jassi Brar commit b114f13591597314660949d5da1fd79127643445 Author: Krzysztof Kozlowski Date: Wed Feb 8 11:15:44 2023 +0100 dt-bindings: remoteproc: qcom,glink-rpm-edge: convert to DT schema Convert Qualcomm G-Link RPM edge binding to DT schema. Move it to remoteproc as it better suits the purpose - communication channel with remote processor. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Jassi Brar commit adb239f340935b854ce56035fee2035345f9d633 Author: Dmitry Baryshkov Date: Fri Jan 27 01:03:18 2023 +0200 mailbox: qcom-apcs-ipc: enable APCS clock device for MSM8996 MSM8996 also has the clock-related part of the APCS mailbox device. Follow the usual pattern and create a child device to handle these clocks. Signed-off-by: Dmitry Baryshkov Signed-off-by: Jassi Brar commit 9e9a6a8eeef97f089147dd07b940646771f27c2c Author: Dmitry Baryshkov Date: Fri Jan 27 01:03:17 2023 +0200 dt-bindings: mailbox: qcom: add #clock-cells to msm8996 example Add the #clock-cells property to the MSM8996 example, as the APCS block is going to provide the `sys_apcs_aux' clock to the consumers. Acked-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Signed-off-by: Jassi Brar commit 8b5c7a06d0ace0ea816c407482d27117b8ba8d51 Author: Dmitry Baryshkov Date: Fri Jan 27 01:03:16 2023 +0200 dt-bindings: mailbox: qcom: add missing platforms to conditional clauses Add missing platforms to the conditional clauses selecting whether the clocks/clock-names properties are required or whether they must be omitted. Acked-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Signed-off-by: Jassi Brar commit 98c2de9e7949358abff45009be44959a0bc5862b Author: Dmitry Baryshkov Date: Fri Jan 27 01:03:15 2023 +0200 dt-bindings: mailbox: qcom: correct the list of platforms using clocks The schema incorrectly lists some of the platforms in the statement requiring clocks/clock-names. Correct this by moving platforms not requiring additional clocks to the separate clause. Fixes: 0d17014e9189 ("dt-bindings: mailbox: Add binding for SDX55 APCS") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Signed-off-by: Jassi Brar commit 9d8b7e64ac73858dd29f41e95492c0fd59f14820 Author: Dmitry Baryshkov Date: Fri Jan 27 01:03:14 2023 +0200 dt-bindings: mailbox: qcom: enable syscon compatible for msm8976 On msm8976 platform APCS also uses syscon compatible, so move it to the block of compatibles using SoC-compat together with syscon. Fixes: 60545466180e ("dt-bindings: mailbox: qcom,apcs-kpss-global: Add syscon const for relevant entries") Acked-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Signed-off-by: Jassi Brar commit dff1082bf561f8760d7c10b7eba87a19f62eac7f Author: Dmitry Baryshkov Date: Fri Jan 27 01:03:13 2023 +0200 dt-bindings: mailbox: qcom: add SDX55 compatible The commit 0d17014e9189 ("dt-bindings: mailbox: Add binding for SDX55 APCS") added SDX55 compatible string to one of clock-selection conditions, but failed to add one to the main schema's compatible list. Fix this omission. Fixes: 0d17014e9189 ("dt-bindings: mailbox: Add binding for SDX55 APCS") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Dmitry Baryshkov Signed-off-by: Jassi Brar commit c31508c56618aaa52fa3503e9f061df8bf728df7 Author: Bartosz Golaszewski Date: Tue Feb 14 10:27:12 2023 +0100 dt-bindings: mailbox: qcom-ipcc: document the sa8775p platform Add a compatible for the ipcc on sa8775p platforms. Signed-off-by: Bartosz Golaszewski Reviewed-by: Manivannan Sadhasivam Acked-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 3a87af1c7d766fda6cbf2e12f063be167d93f1b1 Author: Alain Volmat Date: Tue Feb 14 21:49:44 2023 +0100 dt-bindings: mailbox: sti-mailbox: convert to DT schema Convert the sti-mailbox.txt file into st,sti-mailbox.yaml Signed-off-by: Alain Volmat Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit 043f85ce81cb1714e14d31c322c5646513dde3fb Author: Christophe JAILLET Date: Sun Nov 20 09:25:54 2022 +0100 mailbox: zynq: Switch to flexible array to simplify code Using flexible array is more straight forward. It - saves 1 pointer in the 'zynqmp_ipi_pdata' structure - saves an indirection when using this array - saves some LoC and avoids some always spurious pointer arithmetic Signed-off-by: Christophe JAILLET Signed-off-by: Jassi Brar commit 901578a45950bcc4d5055a24e9016d61b84dc1a2 Author: Thorsten Leemhuis Date: Tue Feb 14 11:13:51 2023 +0100 docs: recommend using Link: whenever using Reported-by: Encourage developers to place Link: tag pointing to the report when they are using Reported-by: tags. Those links are often extremely useful for any code archaeologist that wants to know more about the backstory of a change than the commit message provides. That includes maintainers higher up in the patch-flow hierarchy, which is why Linus asks developers to add such links [1, 2, 3]. To quote [1]: > Again, the commit has a link to the patch *submission*, which is > almost entirely useless. There's no link to the actual problem the > patch fixes. > > [...] > > Put another way: I can see that > > Reported-by: Zhangfei Gao > > in the commit, but I don't have a clue what the actual report was, and > there really isn't enough information in the commit itself, except for > a fairly handwavy "Device drivers might, for instance, still need to > flush operations.." > > I don't want to know what device drivers _might_ do. I would want to > have an actual pointer to what they do and where. Another reason why these links are wanted: the ongoing regression tracking efforts can only scale with them, as they allow the regression tracking bot 'regzbot' to automatically connect tracked reports with patches that are posted or committed to fix tracked regressions. Link: https://lore.kernel.org/all/CAHk-=wjMmSZzMJ3Xnskdg4+GGz=5p5p+GSYyFBTh0f-DgvdBWg@mail.gmail.com/ [1] Link: https://lore.kernel.org/all/CAHk-=wgs38ZrfPvy=nOwVkVzjpM3VFU1zobP37Fwd_h9iAD5JQ@mail.gmail.com/ [2] Link: https://lore.kernel.org/all/CAHk-=wjxzafG-=J8oT30s7upn4RhBs6TX-uVFZ5rME+L5_DoJA@mail.gmail.com/ [3] Signed-off-by: Thorsten Leemhuis Link: https://lore.kernel.org/r/9a07ec640d809723492f8ade4f54705914e80419.1676369564.git.linux@leemhuis.info Signed-off-by: Jonathan Corbet commit b8885e2615f4d623334855e7fad20e49b0e0f96d Author: Randy Dunlap Date: Tue Feb 14 16:57:26 2023 -0800 Documentation: front page: use recommended heading adornments Convert the Documentation front page to use the heading adornments that are documented in doc-guide/sphinx.rst for document title and chapters. I.e., convert most section headings to chapters. This leaves "Indices and tables" as a chapter entry at the same level as the other chapters. The only visual difference from before to after is that the "Indices and tables" heading is smaller and has more vertical whitespace preceding it (although that may depend on the web browser being used). Fixes: 0c7b4366f1ab ("docs: Rewrite the front page") Signed-off-by: Randy Dunlap Cc: Mauro Carvalho Chehab Link: https://lore.kernel.org/r/20230215005726.27320-1-rdunlap@infradead.org Signed-off-by: Jonathan Corbet commit 1481df6cbd0d606fa1a26b752e2e1aba0b650093 Author: Carlos Bilbao Date: Tue Feb 7 16:08:44 2023 -0600 docs/sp_SP: Add process programming-language translation Translate Documentation/process/programming-language.rst into Spanish. Signed-off-by: Carlos Bilbao Link: https://lore.kernel.org/r/20230207220844.2661295-1-carlos.bilbao@amd.com Signed-off-by: Jonathan Corbet commit 01178ee713100c7d7e738992134545acff472d1d Author: Lukas Bulwahn Date: Mon Feb 20 17:57:49 2023 +0100 docs: locking: refer to the actual existing config names The config is actually called CONFIG_RT_MUTEXES, not CONFIG_RT_MUTEX. The config CONFIG_LOCK_TORTURE_TEST should be connected by underscore, for the sake of consistent referencing to configs in the kernel documentation. Address those issues. Signed-off-by: Lukas Bulwahn Acked-by: Waiman Long Link: https://lore.kernel.org/r/20230220165749.12850-1-lukas.bulwahn@gmail.com Signed-off-by: Jonathan Corbet commit eb52bc2ae5b8413619a326f47ed635365883343a Author: Sumeet Pawnikar Date: Wed Feb 15 18:02:49 2023 +0530 powercap: RAPL: Add Power Limit4 support for Meteor Lake SoC Add Meteor Lake SoC to the list of processor models for which Power Limit4 is supported by the Intel RAPL driver. Signed-off-by: Sumeet Pawnikar Signed-off-by: Rafael J. Wysocki commit b64baafa24d2c430513329daf5ebb821620d0c03 Merge: 60950df7b4a8a 8ffba409f495b 90039f3773f68 Author: Stephen Boyd Date: Thu Feb 23 11:04:25 2023 -0800 Merge branches 'clk-loongson' and 'clk-qcom' into clk-next * clk-loongson: dt-bindings: clock: add loongson-2 clock dt-bindings: clock: add loongson-2 clock include file * clk-qcom: (143 commits) clk: qcom: apcs-msm8986: Include bitfield.h for FIELD_PREP clk: qcom: Revert sync_state based clk_disable_unused dt-bindings: clock: Merge qcom,gpucc-sm8350 into qcom,gpucc.yaml clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC dt-bindings: clock: qcom,sa8775p-gcc: add the power-domains property clk: qcom: cpu-8996: add missing cputype include clk: qcom: gcc-sa8775p: remove unused variables clk: qcom: smd-rpm: provide RPM_SMD_XO_CLK_SRC on MSM8996 platform clk: qcom: add msm8996 Core Bus Framework (CBF) support dt-bindings: clock: qcom,msm8996-cbf: Describe the MSM8996 CBF clock controller clk: qcom: add the driver for the MSM8996 APCS clocks clk: qcom: gcc-qcs404: fix duplicate initializer warning clk: qcom: cpu-8996: change setup sequence to follow vendor kernel clk: qcom: cpu-8996: fix PLL clock ops clk: qcom: cpu-8996: fix ACD initialization clk: qcom: cpu-8996: fix PLL configuration sequence clk: qcom: cpu-8996: move qcom_cpu_clk_msm8996_acd_init call clk: qcom: cpu-8996: setup PLLs before registering clocks clk: qcom: cpu-8996: simplify the cpu_clk_notifier_cb ... commit 60950df7b4a8a5fa18be936bdac4edab23fef4bc Merge: 792d6827288b0 9645ccfaad4d6 633ff55419948 b30a027779a50 02d7bd1efb428 79200d5851c8e Author: Stephen Boyd Date: Thu Feb 23 11:04:12 2023 -0800 Merge branches 'clk-microchip', 'clk-allwinner', 'clk-mediatek', 'clk-imx' and 'clk-core' into clk-next - Various cleanups and improvements to Mediatek clk drivers to reduce code size and modernize the drivers - Support for Mediatek MT7891 SoC clks * clk-microchip: clk: at91: do not compile dt-compat.c for sama7g5 and sam9x60 clk: at91: mark ddr clocks as critical * clk-allwinner: clk: sunxi-ng: d1: Add CAN bus gates and resets dt-bindings: clock: Add D1 CAN bus gates and resets clk: sunxi-ng: d1: Mark cpux clock as critical clk: sunxi-ng: d1: Allow building for R528/T113 clk: sunxi-ng: Move SoC driver conditions to dependencies clk: sunxi-ng: Remove duplicate ARCH_SUNXI dependencies clk: sunxi-ng: Avoid computing the rate twice clk: sunxi-ng: h3/h5: Model H3 CLK_DRAM as a fixed clock clk: sunxi-ng: fix ccu_mmc_timing.c kernel-doc issues * clk-mediatek: (29 commits) clk: mediatek: clk-mtk: Remove unneeded semicolon clk: mediatek: remove MT8195 vppsys/0/1 simple_probe dt-bindings: arm: mediatek: migrate MT8195 vppsys0/1 to mtk-mmsys driver clk: mediatek: add MT7981 clock support dt-bindings: clock: mediatek: add mt7981 clock IDs dt-bindings: clock: Add compatibles for MT7981 clk: mediatek: clk-mt7986-topckgen: Migrate to mtk_clk_simple_probe() clk: mediatek: clk-mt7986-topckgen: Properly keep some clocks enabled clk: mediatek: clk-mt6795-topckgen: Migrate to mtk_clk_simple_probe() clk: mediatek: clk-mt8186-topckgen: Migrate to mtk_clk_simple_probe() clk: mediatek: clk-mt8192: Migrate topckgen to mtk_clk_simple_probe() clk: mediatek: clk-mtk: Register MFG notifier in mtk_clk_simple_probe() clk: mediatek: clk-mt8183: Join top_aud_muxes and top_aud_divs clk: mediatek: mt8186: Join top_adj_div and top_muxes clk: mediatek: mt8192: Join top_adj_divs and top_muxes clk: mediatek: clk-mt8192: Move CLK_TOP_CSW_F26M_D2 in top_divs clk: mediatek: mt8173: Migrate pericfg/topckgen to mtk_clk_simple_probe() clk: mediatek: clk-mtk: Extend mtk_clk_simple_probe() clk: mediatek: Switch to mtk_clk_simple_probe() where possible clk: mediatek: mt8173: Break down clock drivers and allow module build ... * clk-imx: clk: imx: pll14xx: fix recalc_rate for negative kdiv MAINTAINERS: clk: imx: Add Peng Fan as reviewer clk: imx: fix compile testing imxrt1050 clk: imx: set imx_clk_gpr_mux_ops storage-class-specifier to static clk: imx6ul: add ethernet refclock mux support clk: imx6ul: fix enet1 gate configuration clk: imx: add imx_obtain_fixed_of_clock() clk: imx6q: add ethernet refclock mux support clk: imx: add clk-gpr-mux driver dt-bindings: imx8ulp: clock: no spaces before tabs clk: imx6sll: add proper spdx license identifier clk: imx: imx93: invoke imx_register_uart_clocks clk: imx: remove clk_count of imx_register_uart_clocks clk: imx: get stdout clk count from device tree clk: imx: avoid memory leak * clk-core: clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled() commit 792d6827288b05df93e487013118986fd14aee5c Merge: d065155ec876a 2c3aa5b1f20a9 3ef6d9b31af26 def70790be528 df43ce489d339 Author: Stephen Boyd Date: Thu Feb 23 11:03:54 2023 -0800 Merge branches 'clk-cleanup', 'clk-bindings', 'clk-renesas', 'clk-versa' and 'clk-amlogic' into clk-next - Support for Versa 5P49V60 clks * clk-cleanup: clk: rs9: Drop unused pin_xin field clk: sprd: Add dependency for SPRD_UMS512_CLK clk: ralink: fix 'mt7621_gate_is_enabled()' function dt-bindings: clock: remove stih416 bindings drivers/clk: Remove "select SRCU" * clk-bindings: dt-bindings: clock: qcom,sm8450-camcc: constrain required-opps dt-bindings: clock: imx8m-clock: correct i.MX8MQ node name * clk-renesas: clk: renesas: rcar-gen3: Disable R-Car H3 ES1.* clk: renesas: r8a779g0: Add CAN-FD clocks clk: renesas: r8a779g0: Tidy up DMAC name on SYS-DMAC clk: renesas: r8a779a0: Tidy up DMAC name on SYS-DMAC clk: renesas: r8a779g0: Add custom clock for PLL2 clk: renesas: cpg-mssr: Remove superfluous check in resume code clk: renesas: r9a06g032: Handle h2mode setting based on USBF presence clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed clk: renesas: r9a07g044: Add clock and reset entries for CRU clk: renesas: r9a09g011: Add SDHI/eMMC clock and reset entries clk: renesas: r9a09g011: Add USB clock and reset entries clk: renesas: r9a09g011: Add TIM clock and reset entries clk: renesas: r8a779g0: Add display related clocks clk: renesas: rcar-gen4: Restore PLL enum sort order clk: renesas: r8a779g0: Fix OSC predividers clk: renesas: r9a09g011: Add PWM clock and reset entries * clk-versa: dt-bindings: clock: versaclock5: Document 5P49V60 compatible string clk: vc5: Add support for 5P49V60 clk: vc5: Use `clamp()` to restrict PLL range * clk-amlogic: clk: meson: clk-cpu-dyndiv: switch from .round_rate to .determine_rate clk: meson: sclk-div: switch from .round_rate to .determine_rate clk: meson: dualdiv: switch from .round_rate to .determine_rate clk: meson: mpll: Switch from .round_rate to .determine_rate commit fa0746b11ba04d3df04adddb283cab3cc1d90ec3 Author: Nick Alcock Date: Fri Feb 17 14:10:40 2023 +0000 cpufreq: amd-pstate: remove MODULE_LICENSE in non-modules Since commit 8b41fc4454e ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, uses of the macro in non-modules will cause modprobe to misidentify their containing object file as a module when it is not (false positives), and modprobe might succeed rather than failing with a suitable error message. So remove it in amd-pstate.c which cannot be built as a module. Signed-off-by: Nick Alcock Suggested-by: Luis Chamberlain [ rjw: Subject and changelog adjustments ] Signed-off-by: Rafael J. Wysocki commit 70ba26cbe02635461c91fa7133941da685e2f08d Author: Thomas Weißschuh Date: Mon Feb 20 23:28:54 2023 +0000 cpufreq: schedutil: make kobj_type structure constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definition to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit 7af78020e28a532262d00d94de708a705d636e91 Author: Kai-Heng Feng Date: Thu Feb 23 15:02:52 2023 +0800 cpufreq: amd-pstate: Let user know amd-pstate is disabled Commit 202e683df37c ("cpufreq: amd-pstate: add amd-pstate driver parameter for mode selection") changed the driver to be disabled by default, and this can surprise users. Let users know what happened so they can decide what to do next. Link: https://bugs.launchpad.net/bugs/2006942 Signed-off-by: Kai-Heng Feng Acked-by: Huang Rui Reviewed-by: Yuan Perry Signed-off-by: Rafael J. Wysocki commit 60675225ebeecea248035fd3a0efc82ae9038a98 Author: Srinivas Pandruvada Date: Tue Feb 21 22:45:26 2023 -0800 cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids While the majority of server OS distributions are deployed with the "performance" governor as the default, some distributions like Ubuntu use the "powersave" governor by default. While using the "powersave" governor in its default configuration on Sapphire Rapids systems leads to much lower power, the performance is lower by more than 25% for several workloads relative to the "performance" governor. A 37% difference has been reported by www.Phoronix.com [1]. This is a consequence of using a relatively high EPP value in the default configuration of the "powersave" governor and the performance can be made much closer to the "performance" governor's level by adjusting the default EPP value. Based on experiments, with EPP of 0x00, 0x10, 0x20, the performance delta between the "powersave" governor and the "performance" one is around 12%. However, the EPP of 0x20 reduces average power by 18% with respect to the lower EPP values. [Note that raising min_perf_pct in sysfs as high as 50% in addition to adjusting EPP does not improve the performance any further.] For this reason, change the EPP value corresponding to the the default balance_performance setting for Sapphire Rapids to 0x20, which is straightforward, because analogous default EPP adjustment has been applied to Alder Lake and there is a way to set the balance_performance EPP value in intel_pstate based on the processor model already. The goal here is to limit the mean performance delta between the "powersave" governor in the default configuration and the "performance" governor for a wide variety of server workloadsto to around 10-12%. For some bursty workloads, this delta can be still large, as the frequency ramp-up will still lag when the "powersave" governor is in use irrespective of the EPP setting, because the performance governor always requests the maximum possible frequency. Link: https://www.phoronix.com/review/centos-clear-spr/6 # [1] Signed-off-by: Srinivas Pandruvada [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 0df82189bc42037678fa590a77ed0116f428c90d Merge: b72b5fecc1b8a f9fa0778ee734 Author: Linus Torvalds Date: Thu Feb 23 10:29:51 2023 -0800 Merge tag 'perf-tools-for-v6.3-1-2023-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools updates from Arnaldo Carvalho de Melo: "Miscellaneous: - Add Ian Rogers to MAINTAINERS as a perf tools reviewer. - Add support for retire latency feature (pipeline stall of a instruction compared to the previous one, in cycles) present on some Intel processors. - Add 'perf c2c' report option to show false sharing with adjacent cachelines, to be used in machines with cacheline prefetching, where accesses to a cacheline brings the next one too. - Skip 'perf test bpf' when the required kernel-debuginfo package isn't installed. - Avoid d3-flame-graph package dependency in 'perf script flamegraph', making this feature more generally available. - Add JSON metric events to present CPI stall cycles in Power10. - Assorted improvements/refactorings on the JSON metrics parsing code. perf lock contention: - Add -o/--lock-owner option: $ sudo ./perf lock contention -abo -- ./perf bench sched pipe # Running 'sched/pipe' benchmark: # Executed 1000000 pipe operations between two processes Total time: 4.766 [sec] 4.766540 usecs/op 209795 ops/sec contended total wait max wait avg wait pid owner 403 565.32 us 26.81 us 1.40 us -1 Unknown 4 27.99 us 8.57 us 7.00 us 1583145 sched-pipe 1 8.25 us 8.25 us 8.25 us 1583144 sched-pipe 1 2.03 us 2.03 us 2.03 us 5068 chrome The owner is unknown in most cases. Filtering only for the mutex locks, it will more likely get the owners. - -S/--callstack-filter is to limit display entries having the given string in the callstack: $ sudo ./perf lock contention -abv -S net sleep 1 ... contended total wait max wait avg wait type caller 5 70.20 us 16.13 us 14.04 us spinlock __dev_queue_xmit+0xb6d 0xffffffffa5dd1c60 _raw_spin_lock+0x30 0xffffffffa5b8f6ed __dev_queue_xmit+0xb6d 0xffffffffa5cd8267 ip6_finish_output2+0x2c7 0xffffffffa5cdac14 ip6_finish_output+0x1d4 0xffffffffa5cdb477 ip6_xmit+0x457 0xffffffffa5d1fd17 inet6_csk_xmit+0xd7 0xffffffffa5c5f4aa __tcp_transmit_skb+0x54a 0xffffffffa5c6467d tcp_keepalive_timer+0x2fd Please note that to have the -b option (BPF) working above one has to build with BUILD_BPF_SKEL=1. - Add more 'perf test' entries to test these new features. perf script: - Add 'cgroup' field for 'perf script' output: $ perf record --all-cgroups -- true $ perf script -F comm,pid,cgroup true 337112 /user.slice/user-657345.slice/user@657345.service/... true 337112 /user.slice/user-657345.slice/user@657345.service/... true 337112 /user.slice/user-657345.slice/user@657345.service/... true 337112 /user.slice/user-657345.slice/user@657345.service/... - Add support for showing branch speculation information in 'perf script' and in the 'perf report' raw dump (-D). perf record: - Fix 'perf record' segfault with --overwrite and --max-size. perf test/bench: - Switch basic BPF filtering test to use syscall tracepoint to avoid the variable number of probes inserted when using the previous probe point (do_epoll_wait) that happens on different CPU architectures. - Fix DWARF unwind test by adding non-inline to expected function in a backtrace. - Use 'grep -c' where the longer form 'grep | wc -l' was being used. - Add getpid and execve benchmarks to 'perf bench syscall'. Intel PT: - Add support for synthesizing "cycle" events from Intel PT traces as we support "instruction" events when Intel PT CYC packets are available. This enables much more accurate profiles than when using the regular 'perf record -e cycles' (the default) when the workload lasts for very short periods (<10ms). - .plt symbol handling improvements, better handling IBT (in the past MPX) done in the context of decoding Intel PT processor traces, IFUNC symbols on x86_64, static executables, understanding .plt.got symbols on x86_64. - Add a 'perf test' to test symbol resolution, part of the .plt improvements series, this tests things like symbol size in contexts where only the symbol start is available (kallsyms), etc. - Better handle auxtrace/Intel PT data when using pipe mode (perf record sleep 1|perf report). - Fix symbol lookup with kcore with multiple segments match stext, getting the symbol resolution to just show DSOs as unknown. ARM: - Timestamp improvements for ARM64 systems with ETMv4 (Embedded Trace Macrocell v4). - Ensure ARM64 CoreSight timestamps don't go backwards. - Document that ARM64 SPE (Statistical Profiling Extension) is used with 'perf c2c/mem'. - Add raw decoding for ARM64 SPEv1.2 previous branch address. - Update neoverse-n2-v2 ARM vendor events (JSON tables): topdown L1, TLB, cache, branch, PE utilization and instruction mix metrics. - Update decoder code for OpenCSD version 1.4, on ARM64 systems. - Fix command line auto-complete of CPU events on aarch64. Build: - Fix 'perf probe' and 'perf test' when libtraceevent isn't linked, as several tests use tracepoints, those should be skipped. - More fallout fixes for the removal of tools/lib/traceevent/. - Fix build error when linking with libpfm" * tag 'perf-tools-for-v6.3-1-2023-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (114 commits) perf tests stat_all_metrics: Change true workload to sleep workload for system wide check perf vendor events power10: Add JSON metric events to present CPI stall cycles in powerpc perf intel-pt: Synthesize cycle events perf c2c: Add report option to show false sharing in adjacent cachelines perf record: Fix segfault with --overwrite and --max-size perf stat: Avoid merging/aggregating metric counts twice perf tools: Fix perf tool build error in util/pfm.c perf tools: Fix auto-complete on aarch64 perf lock contention: Support old rw_semaphore type perf lock contention: Add -o/--lock-owner option perf lock contention: Fix to save callstack for the default modified perf test bpf: Skip test if kernel-debuginfo is not present perf probe: Update the exit error codes in function try_to_find_probe_trace_event perf script: Fix missing Retire Latency fields option documentation perf event x86: Add retire_lat when synthesizing PERF_SAMPLE_WEIGHT_STRUCT perf test x86: Support the retire_lat (Retire Latency) sample_type check perf test bpf: Check for libtraceevent support perf script: Support Retire Latency perf report: Support Retire Latency perf lock contention: Support filters for different aggregation ... commit b72b5fecc1b8a2e595bd03d7d257c88ea3f9fd45 Merge: 9191423872f76 7568a21e52f60 Author: Linus Torvalds Date: Thu Feb 23 10:20:49 2023 -0800 Merge tag 'trace-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Add function names as a way to filter function addresses - Add sample module to test ftrace ops and dynamic trampolines - Allow stack traces to be passed from beginning event to end event for synthetic events. This will allow seeing the stack trace of when a task is scheduled out and recorded when it gets scheduled back in. - Add trace event helper __get_buf() to use as a temporary buffer when printing out trace event output. - Add kernel command line to create trace instances on boot up. - Add enabling of events to instances created at boot up. - Add trace_array_puts() to write into instances. - Allow boot instances to take a snapshot at the end of boot up. - Allow live patch modules to include trace events - Minor fixes and clean ups * tag 'trace-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (31 commits) tracing: Remove unnecessary NULL assignment tracepoint: Allow livepatch module add trace event tracing: Always use canonical ftrace path tracing/histogram: Fix stacktrace histogram Documententation tracing/histogram: Fix stacktrace key tracing/histogram: Fix a few problems with stacktrace variable printing tracing: Add BUILD_BUG() to make sure stacktrace fits in strings tracing/histogram: Don't use strlen to find length of stacktrace variables tracing: Allow boot instances to have snapshot buffers tracing: Add trace_array_puts() to write into instance tracing: Add enabling of events to boot instances tracing: Add creation of instances at boot command line tracing: Fix trace_event_raw_event_synth() if else statement samples: ftrace: Make some global variables static ftrace: sample: avoid open-coded 64-bit division samples: ftrace: Include the nospec-branch.h only for x86 tracing: Acquire buffer from temparary trace sequence tracing/histogram: Wrap remaining shell snippets in code blocks tracing/osnoise: No need for schedule_hrtimeout range bpf/tracing: Use stage6 of tracing to not duplicate macros ... commit 9191423872f764dccc024d6bc4b68dfd138ccc38 Merge: d392e49ad8905 8843e06f67b14 Author: Linus Torvalds Date: Thu Feb 23 10:08:01 2023 -0800 Merge tag 'trace-v6.2-rc7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: "Fix race that causes a warning of corrupt ring buffer With the change that allows to read the "trace" file without disabling writing to the ring buffer, there was an integrity check of the ring buffer in the iterator read code, that expected the ring buffer to be write disabled. This caused the integrity check to trigger when stress reading the "trace" file while writing was happening. The integrity check is a bit aggressive (and has never triggered in practice). Change it so that it checks just the integrity of the linked pages without clearing the flags inside the pointers. This removes the warning that was being triggered" [ Heh. This was supposed to have gone in last week before the 6.2 release, but Steven forgot to actually add me to the participants of the pull request, so here it is, a week later - Linus ] * tag 'trace-v6.2-rc7-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Handle race between rb_move_tail and rb_check_pages commit d392e49ad89059624a2b24daea3c64d0e0fb4124 Merge: 2562af68f0550 5dc3750e747f9 Author: Linus Torvalds Date: Thu Feb 23 10:04:24 2023 -0800 Merge tag 'trace-tools-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt: - Use total duration to calculate average in rtla osnoise_hist - Use 2 digit precision for displaying average - Print an intuitive auto analysis of timerlat results - Add auto analysis to timerlat top - Add hwnoise, which is the same as osnoise but focuses on hardware - Small clean ups * tag 'trace-tools-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: Documentation/rtla: Add hwnoise man page rtla: Add hwnoise tool Documentation/rtla: Add timerlat-top auto-analysis options rtla/timerlat: Add auto-analysis support to timerlat top rtla/timerlat: Add auto-analysis core tools/tracing/rtla: osnoise_hist: display average with two-digit precision tools/tracing/rtla: osnoise_hist: use total duration for average calculation tools/rv: Remove unneeded semicolon commit ee0a735fd97ccde766ab557d1fc722c92cebacda Author: Sean Anderson Date: Wed Feb 22 15:42:41 2023 -0500 net: sunhme: Fix region request devm_request_region is for I/O regions. Use devm_request_mem_region instead. This fixes the driver failing to probe since 99df45c9e0a4 ("sunhme: fix an IS_ERR() vs NULL check in probe"), which checked the result. Fixes: 914d9b2711dd ("sunhme: switch to devres") Signed-off-by: Sean Anderson Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230222204242.2658247-1-seanga2@gmail.com Signed-off-by: Jakub Kicinski commit 2562af68f0550317fbd3d5f520069c69d0cf5115 Merge: 89f1a2440a200 7dc8e24f0e098 Author: Linus Torvalds Date: Thu Feb 23 09:49:00 2023 -0800 Merge tag 'ktest-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest updates from Steven Rostedt: - Fix three instances that the tty is not given back to the console on exit. Forcing the user to do a "reset" to get the console back. - Fix the console monitor to not hang when too much data is given by the ssh output. * tag 'ktest-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest: Restore stty setting at first in dodie ktest.pl: Add RUN_TIMEOUT option with default unlimited ktest.pl: Give back console on Ctrt^C on monitor ktest.pl: Fix missing "end_monitor" when machine check fails commit 89f1a2440a200918676f9e1eeb765b337f735d86 Merge: d6296cb65320b 82649c7c0da43 Author: Linus Torvalds Date: Thu Feb 23 09:40:14 2023 -0800 Merge tag 'linux-kselftest-kunit-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit update from Shuah Khan: - add Function Redirection API to isolate the code being tested from other parts of the kernel. Documentation/dev-tools/kunit/api/functionredirection.rst has the details. * tag 'linux-kselftest-kunit-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: Add printf attribute to fail_current_test_impl lib/hashtable_test.c: add test for the hashtable structure Documentation: Add Function Redirection API docs kunit: Expose 'static stub' API to redirect functions kunit: Add "hooks" to call into KUnit when it's built as a module kunit: kunit.py extract handlers tools/testing/kunit/kunit.py: remove redundant double check commit d6296cb65320be16dbf20f2fd584ddc25f3437cd Merge: f01d4c8a22908 0eb15a47bf437 Author: Linus Torvalds Date: Thu Feb 23 09:37:29 2023 -0800 Merge tag 'linux-kselftest-next-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest update from Shuah Khan: - several patches to fix incorrect kernel headers search path from Mathieu Desnoyers - a few follow-on fixes found during testing the above change - miscellaneous fixes - support for filtering and enumerating tests * tag 'linux-kselftest-next-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (40 commits) selftests/user_events: add a note about user_events.h dependency selftests/mount_setattr: fix to make run_tests failure selftests/mount_setattr: fix redefine struct mount_attr build error selftests/sched: fix warn_unused_result build warns selftests/ptp: Remove clean target from Makefile selftests: use printf instead of echo -ne selftests/ftrace: Fix bash specific "==" operator selftests: tpm2: remove redundant ord() selftests: find echo binary to use -ne options selftests: Fix spelling mistake "allright" -> "all right" selftests: tdx: Use installed kernel headers search path selftests: ptrace: Use installed kernel headers search path selftests: memfd: Use installed kernel headers search path selftests: iommu: Use installed kernel headers search path selftests: x86: Fix incorrect kernel headers search path selftests: vm: Fix incorrect kernel headers search path selftests: user_events: Fix incorrect kernel headers search path selftests: sync: Fix incorrect kernel headers search path selftests: seccomp: Fix incorrect kernel headers search path selftests: sched: Fix incorrect kernel headers search path ... commit f01d4c8a22908956f4018ed334bb6713e41b37c1 Merge: 525445efacdfe c54ba4178159e Author: Linus Torvalds Date: Thu Feb 23 09:33:01 2023 -0800 Merge tag 'nolibc.2023.02.06a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc updates from Paul McKenney: - Add s390 support - Add support for the ARM Thumb1 instruction set - Fix O_* flags definitions for open() and fcntl() - Make errno a weak symbol instead of a static variable - Export environ as a weak symbol - Export _auxv as a weak symbol for auxilliary vector retrieval - Implement getauxval() and getpagesize() - Further improve self tests, including permitting userland testing of the nolibc library * tag 'nolibc.2023.02.06a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (28 commits) selftests/nolibc: Add a "run-user" target to test the program in user land selftests/nolibc: Support "x86_64" for arch name selftests/nolibc: Add `getpagesize(2)` selftest nolibc/sys: Implement `getpagesize(2)` function nolibc/stdlib: Implement `getauxval(3)` function tools/nolibc: add auxiliary vector retrieval for s390 tools/nolibc: add auxiliary vector retrieval for mips tools/nolibc: add auxiliary vector retrieval for riscv tools/nolibc: add auxiliary vector retrieval for arm tools/nolibc: add auxiliary vector retrieval for arm64 tools/nolibc: add auxiliary vector retrieval for x86_64 tools/nolibc: add auxiliary vector retrieval for i386 tools/nolibc: export environ as a weak symbol on s390 tools/nolibc: export environ as a weak symbol on riscv tools/nolibc: export environ as a weak symbol on mips tools/nolibc: export environ as a weak symbol on arm tools/nolibc: export environ as a weak symbol on arm64 tools/nolibc: export environ as a weak symbol on i386 tools/nolibc: export environ as a weak symbol on x86_64 tools/nolibc: make errno a weak symbol instead of a static one ... commit f7482d8285b638be87a594a30edaaf1341135c1a Author: Krishna Yarlagadda Date: Thu Feb 23 21:56:34 2023 +0530 spi: tegra210-quad: set half duplex flag Tegra QSPI controller only supports half duplex transfers. Set half duplex constrain flag. Signed-off-by: Krishna Yarlagadda Link: https://lore.kernel.org/r/20230223162635.19747-3-kyarlagadda@nvidia.com Signed-off-by: Mark Brown commit 525445efacdfeed71329ce8bc5f558859a894b8b Merge: 192a5e0a19712 344da544f177f Author: Linus Torvalds Date: Thu Feb 23 09:28:37 2023 -0800 Merge tag 'nmi.2023.02.14a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull x86 NMI diagnostics from Paul McKenney: "Add diagnostics to the x86 NMI handler to help detect NMI-handler bugs on the one hand and failing hardware on the other" * tag 'nmi.2023.02.14a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: x86/nmi: Print reasons why backtrace NMIs are ignored x86/nmi: Accumulate NMI-progress evidence in exc_nmi() commit 192a5e0a19712a079f456954c203ce9dd2b889fa Merge: a5c95ca18a98d 9ba7d3b3b826e Author: Linus Torvalds Date: Thu Feb 23 09:24:25 2023 -0800 Merge tag 'lkmm.2023.02.15a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull LKMM (Linux Kernel Memory Model) updates from Paul McKenney: "Documentation updates. Add read-modify-write sequences, which means that stronger primitives more consistently result in stronger ordering, while still remaining in the envelope of the hardware that supports Linux. Address, data, and control dependencies used to ignore data that was stored in temporaries. This update extends these dependency chains to include unmarked intra-thread stores and loads. Note that these unmarked stores and loads should not be concurrently accessed from multiple threads, and doing so will cause LKMM to flag such accesses as data races" * tag 'lkmm.2023.02.15a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: tools: memory-model: Make plain accesses carry dependencies Documentation: Fixed a typo in atomic_t.txt tools: memory-model: Add rmw-sequences to the LKMM locking/memory-barriers.txt: Improve documentation for writel() example commit 37f5b858a66543b2b67c0288280af623985abc29 Author: Danny Kaehn Date: Fri Feb 10 11:00:44 2023 -0600 HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded The CP2112 generates interrupts from a polling routine on a thread, and can only support threaded interrupts. This patch configures the gpiochip irq chip with this flag, disallowing consumers to request a hard IRQ from this driver, which resulted in a segfault previously. Signed-off-by: Danny Kaehn Link: https://lore.kernel.org/r/20230210170044.11835-1-kaehndan@gmail.com Signed-off-by: Benjamin Tissoires commit ad32ab9604f29827494024828f527228e84fbd2c Author: Juergen Gross Date: Thu Feb 23 09:38:00 2023 +0100 irqdomain: Add missing NULL pointer check in irq_domain_create_hierarchy() The recent switch to per-domain locking caused a NULL dereference in irq_domain_create_hierarchy(), as Xen code is calling msi_create_irq_domain() with a NULL parent pointer. Fix that by testing parent to be set before dereferencing it. For a non-existing parent the irqdomain's root will stay to point to itself. Fixes: 9dbb8e3452ab ("irqdomain: Switch to per-domain locking") Signed-off-by: Juergen Gross Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230223083800.31347-1-jgross@suse.com commit 5931e4eb55f904a4a221b57ff7d24afc0e463957 Merge: ce7980ae9080f 6f3ee0e22b4c6 Author: Thomas Gleixner Date: Thu Feb 23 15:49:31 2023 +0100 Merge branch 'irq/core' into irq/urgent Pull in the upstream changes so a fix for them can be applied. commit 22ef7d7be4dc071712ddf0ae09df6ee39b4901a0 Author: Benjamin Tissoires Date: Thu Feb 23 15:17:26 2023 +0100 selftest: hid: fix hid_bpf not set in config Now that CONFIG_HID_BPF is not automatically implied by HID, we need to set it properly in the selftests config. Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina commit 3de34f85bf437e47556044191f0bd7d0eb644e21 Author: Ian Rogers Date: Wed Feb 22 23:18:18 2023 -0800 perf test: Avoid counting commas in json linter Commas may appear in events like: cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/ which causes the count of commas to see more items than expected. Switch to counting the entries in the dictionary, which is 1 more than the number of commas. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Claire Jensen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sumanth Korikkar Cc: Thomas Richter Link: https://lore.kernel.org/r/20230223071818.329671-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit d3e104bb024e01a7da6af3b270a7b46054b74ac9 Author: Ian Rogers Date: Wed Feb 22 23:18:17 2023 -0800 perf tests stat+csv_output: Switch CSV separator to @ Commas may appear in events like: cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/ which causes the commachecker to see more fields than expected. Use @ as the CSV separator to avoid this. Signed-off-by: Ian Rogers Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Claire Jensen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sumanth Korikkar Cc: Thomas Richter Link: https://lore.kernel.org/r/20230223071818.329671-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit ce9f1c05d2edfa6cdf2c1a510495d333e11810a8 Author: Namhyung Kim Date: Wed Feb 22 23:01:55 2023 -0800 perf inject: Fix --buildid-all not to eat up MMAP2 When MMAP2 has the PERF_RECORD_MISC_MMAP_BUILD_ID flag, it means the record already has the build-id info. So it marks the DSO as hit, to skip if the same DSO is not processed if it happens to miss the build-id later. But it missed to copy the MMAP2 record itself so it'd fail to symbolize samples for those regions. For example, the following generates 249 MMAP2 events. $ perf record --buildid-mmap -o- true | perf report --stat -i- | grep MMAP2 MMAP2 events: 249 (86.8%) Adding perf inject should not change the number of events like this $ perf record --buildid-mmap -o- true | perf inject -b | \ > perf report --stat -i- | grep MMAP2 MMAP2 events: 249 (86.5%) But when --buildid-all is used, it eats most of the MMAP2 events. $ perf record --buildid-mmap -o- true | perf inject -b --buildid-all | \ > perf report --stat -i- | grep MMAP2 MMAP2 events: 1 ( 2.5%) With this patch, it shows the original number now. $ perf record --buildid-mmap -o- true | perf inject -b --buildid-all | \ > perf report --stat -i- | grep MMAP2 MMAP2 events: 249 (86.5%) Committer testing: Before: $ perf record --buildid-mmap -o- perf stat --null sleep 1 2> /dev/null | perf inject -b | perf report --stat -i- | grep MMAP2 MMAP2 events: 58 (36.2%) $ perf record --buildid-mmap -o- perf stat --null sleep 1 2> /dev/null | perf report --stat -i- | grep MMAP2 MMAP2 events: 58 (36.2%) $ perf record --buildid-mmap -o- perf stat --null sleep 1 2> /dev/null | perf inject -b --buildid-all | perf report --stat -i- | grep MMAP2 MMAP2 events: 2 ( 1.9%) $ After: $ perf record --buildid-mmap -o- perf stat --null sleep 1 2> /dev/null | perf inject -b | perf report --stat -i- | grep MMAP2 MMAP2 events: 58 (29.3%) $ perf record --buildid-mmap -o- perf stat --null sleep 1 2> /dev/null | perf report --stat -i- | grep MMAP2 MMAP2 events: 58 (34.3%) $ perf record --buildid-mmap -o- perf stat --null sleep 1 2> /dev/null | perf inject -b --buildid-all | perf report --stat -i- | grep MMAP2 MMAP2 events: 58 (38.4%) $ Fixes: f7fc0d1c915a74ff ("perf inject: Do not inject BUILD_ID record if MMAP2 has it") Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230223070155.54251-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit edea0c5a994b7829c9ada8f5bc762c4e32f4f797 Author: Geetha sowjanya Date: Wed Feb 22 17:06:00 2023 +0530 octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet When checksum offload is disabled in the driver via ethtool, the PTP 1-step sync packets contain incorrect checksum, since the stack calculates the checksum before driver updates PTP timestamp field in the packet. This results in PTP packets getting dropped at the other end. This patch fixes the issue by re-calculating the UDP checksum after updating PTP timestamp field in the driver. Fixes: 2958d17a8984 ("octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon") Signed-off-by: Geetha sowjanya Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Link: https://lore.kernel.org/r/20230222113600.1965116-1-saikrishnag@marvell.com Signed-off-by: Paolo Abeni commit 1e30373ea59ef47a7aa406cab64c852200f4bac3 Merge: c749e3f82a15e 186b1da76b727 Author: Paolo Abeni Date: Thu Feb 23 13:43:26 2023 +0100 Merge branch 'net-phy-eee-fixes' Oleksij Rempel says: ==================== net: phy: EEE fixes changes v3: - add kernel test robot tags to commit log - reword comment for genphy_c45_an_config_eee_aneg() function changes v2: - restore previous ethtool set logic for the case where advertisements are not provided by user space. - use ethtool_convert_legacy_u32_to_link_mode() where possible - genphy_c45_an_config_eee_aneg(): move adv initialization in to the if scope. Different EEE related fixes. ==================== Link: https://lore.kernel.org/r/20230222055043.113711-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit 186b1da76b7271d65b48af5abae10a53d679c776 Author: Oleksij Rempel Date: Wed Feb 22 06:50:43 2023 +0100 net: phy: c45: genphy_c45_ethtool_set_eee: validate EEE link modes Currently, it is possible to let some PHYs to advertise not supported EEE link modes. So, validate them before overwriting existing configuration. Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Signed-off-by: Paolo Abeni commit 3eeca4e199cee2066c65b872391cecee5cbbbb81 Author: Oleksij Rempel Date: Wed Feb 22 06:50:42 2023 +0100 net: phy: do not force EEE support With following patches: commit 9b01c885be36 ("net: phy: c22: migrate to genphy_c45_write_eee_adv()") commit 5827b168125d ("net: phy: c45: migrate to genphy_c45_write_eee_adv()") we set the advertisement to potentially supported values. This behavior may introduce new regressions on systems where EEE was disabled by default (BIOS or boot loader configuration or by other ways.) At same time, with this patches, we would overwrite EEE advertisement configuration made over ethtool. To avoid this issues, we need to cache initial and ethtool advertisement configuration and store it for later use. Fixes: 9b01c885be36 ("net: phy: c22: migrate to genphy_c45_write_eee_adv()") Fixes: 5827b168125d ("net: phy: c45: migrate to genphy_c45_write_eee_adv()") Fixes: 022c3f87f88e ("net: phy: add genphy_c45_ethtool_get/set_eee() support") Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Signed-off-by: Paolo Abeni commit b6478b8c93304fa0483e4657779b44634a1711c7 Author: Oleksij Rempel Date: Wed Feb 22 06:50:41 2023 +0100 net: phy: c45: add genphy_c45_an_config_eee_aneg() function Add new genphy_c45_an_config_eee_aneg() function and replace some of genphy_c45_write_eee_adv() calls. This will be needed by the next patch. Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Signed-off-by: Paolo Abeni commit e209519b623391465c0b37caca89bf0ffff91f53 Author: Oleksij Rempel Date: Wed Feb 22 06:50:40 2023 +0100 net: phy: c45: use "supported_eee" instead of supported for access validation Make sure we use proper variable to validate access to potentially not supported registers. Otherwise we will get false read/write errors. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-lkp/202302211644.c12d19de-yujie.liu@intel.com Fixes: 022c3f87f88e ("net: phy: add genphy_c45_ethtool_get/set_eee() support") Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Signed-off-by: Paolo Abeni commit 5d2fdb255c52989e95704b5556dbf0ad833bddd2 Merge: 85636167e3206 0b93efca3659f Author: Jani Nikula Date: Thu Feb 23 14:05:43 2023 +0200 Merge tag 'gvt-next-fixes-2023-02-23' of https://github.com/intel/gvt-linux into drm-intel-next-fixes gvt-next-fixes-2023-02-23 - use debugfs attribute for gvt debugfs entries (Deepak R Varma) - fix memory leak in vgpu destroy for debugfs_lookup() then remove (Greg KH) - fix DRM_I915_GVT kconfig symbol to unbreak menu presentation (Randy Dunlap) - fix typos (Deepak R Varma, Colin Ian King) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/Y/co4cy10KM1/2uX@debian-scheme commit 85636167e3206c3fbd52254fc432991cc4e90194 Author: John Harrison Date: Wed Feb 15 17:11:01 2023 -0800 drm/i915: Don't use BAR mappings for ring buffers with LLC Direction from hardware is that ring buffers should never be mapped via the BAR on systems with LLC. There are too many caching pitfalls due to the way BAR accesses are routed. So it is safest to just not use it. Signed-off-by: John Harrison Fixes: 9d80841ea4c9 ("drm/i915: Allow ringbuffers to be bound anywhere") Cc: Chris Wilson Cc: Joonas Lahtinen Cc: Jani Nikula Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: intel-gfx@lists.freedesktop.org Cc: # v4.9+ Tested-by: Jouni Högander Reviewed-by: Daniele Ceraolo Spurio Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-3-John.C.Harrison@Intel.com (cherry picked from commit 65c08339db1ada87afd6cfe7db8e60bb4851d919) Signed-off-by: Jani Nikula commit 690e0ec8e63da9a29b39fedc6ed5da09c7c82651 Author: John Harrison Date: Wed Feb 15 17:11:00 2023 -0800 drm/i915: Don't use stolen memory for ring buffers with LLC Direction from hardware is that stolen memory should never be used for ring buffer allocations on platforms with LLC. There are too many caching pitfalls due to the way stolen memory accesses are routed. So it is safest to just not use it. Signed-off-by: John Harrison Fixes: c58b735fc762 ("drm/i915: Allocate rings from stolen") Cc: Chris Wilson Cc: Joonas Lahtinen Cc: Jani Nikula Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: intel-gfx@lists.freedesktop.org Cc: # v4.9+ Tested-by: Jouni Högander Reviewed-by: Daniele Ceraolo Spurio Link: https://patchwork.freedesktop.org/patch/msgid/20230216011101.1909009-2-John.C.Harrison@Intel.com (cherry picked from commit f54c1f6c697c4297f7ed94283c184acc338a5cf8) Signed-off-by: Jani Nikula commit 5e438bf7f9a1705ebcae5fa89cdbfbc6932a7871 Author: Mavroudis Chatzilaridis Date: Wed Feb 1 18:51:25 2023 +0000 drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv This laptop uses inverted backlight PWM. Thus, without this quirk, backlight brightness decreases as the brightness value increases and vice versa. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8013 Cc: stable@vger.kernel.org Signed-off-by: Mavroudis Chatzilaridis Reviewed-by: Jani Nikula Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230201184947.8835-1-mavchatz@protonmail.com (cherry picked from commit 83e7d6fd330d413cb2064e680ffea91b0512a520) commit 33c25354939099b76ecb6c82d1c7c50400fbcca6 Author: Matt Roper Date: Mon Feb 13 16:19:06 2023 -0800 drm/i915/xelpmp: Consider GSI offset when doing MCR lookups MCR range tables use the final MMIO offset of a register (including the 0x380000 GSI offset when applicable). Since the i915_mcr_reg_t passed as a parameter during steering lookup does not include the GSI offset, we need to add it back in for GSI registers before searching the tables. Fixes: a7ec65fc7e83 ("drm/i915/xelpmp: Add multicast steering for media GT") Signed-off-by: Matt Roper Reviewed-by: Radhakrishna Sripada Link: https://patchwork.freedesktop.org/patch/msgid/20230214001906.1477370-1-matthew.d.roper@intel.com (cherry picked from commit d6683bbe70d4cdbf3da6acecf7d569cc6f0b4382) Signed-off-by: Jani Nikula commit 078a5517d22342eb0474046d3e891427a2552e3c Author: Dhruva Gole Date: Thu Feb 23 15:22:02 2023 +0530 spi: spi-sn-f-ospi: fix duplicate flag while assigning to mode_bits Replace the SPI_TX_OCTAL flag that appeared two time with SPI_RX_OCTAL in the chain of '|' operators while assigning to mode_bits Fixes: 1b74dd64c861 ("spi: Add Socionext F_OSPI SPI flash controller driver") Reported-by: David Binderman Link: https://lore.kernel.org/all/DB6P189MB0568F3BE9384315F5C8C1A3E9CA49@DB6P189MB0568.EURP189.PROD.OUTLOOK.COM/ Cc: stable@vger.kernel.org Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230223095202.924626-1-d-gole@ti.com Signed-off-by: Mark Brown commit 152ac60677aa3760d0850de0db33d495f55e8aba Author: Hongbin Ji Date: Wed Feb 22 17:21:28 2023 +0800 spi: cadence-quadspi: Fix cancel the indirect read mask This is to cancel the indirect read transfer process, so should be use CQSPI_REG_INDIRECTRD_CANCEL_MASK Signed-off-by: Hongbin Ji Link: https://lore.kernel.org/r/20230222092128.4237-1-jhb_ee@163.com Signed-off-by: Mark Brown commit 80d2c29e09e663761c2778167a625b25ffe01b6f Author: Matthias Kaehlcke Date: Thu Feb 23 00:33:30 2023 +0000 regulator: core: Use ktime_get_boottime() to determine how long a regulator was off For regulators with 'off-on-delay-us' the regulator framework currently uses ktime_get() to determine how long the regulator has been off before re-enabling it (after a delay if needed). A problem with using ktime_get() is that it doesn't account for the time the system is suspended. As a result a regulator with a longer 'off-on-delay' (e.g. 500ms) that was switched off during suspend might still incurr in a delay on resume before it is re-enabled, even though the regulator might have been off for hours. ktime_get_boottime() accounts for suspend time, use it instead of ktime_get(). Fixes: a8ce7bd89689 ("regulator: core: Fix off_on_delay handling") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Matthias Kaehlcke Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20230223003301.v2.1.I9719661b8eb0a73b8c416f9c26cf5bd8c0563f99@changeid Signed-off-by: Mark Brown commit 1c5d4221240a233df2440fe75c881465cdf8da07 Author: Lee Jones Date: Mon Jan 23 12:39:12 2023 +0000 HID: uhid: Over-ride the default maximum data buffer value with our own The default maximum data buffer size for this interface is UHID_DATA_MAX (4k). When data buffers are being processed, ensure this value is used when ensuring the sanity, rather than a value between the user provided value and HID_MAX_BUFFER_SIZE (16k). Signed-off-by: Lee Jones Signed-off-by: Jiri Kosina commit b1a37ed00d7908a991c1d0f18a8cba3c2aa99bdc Author: Lee Jones Date: Mon Jan 23 12:39:11 2023 +0000 HID: core: Provide new max_buffer_size attribute to over-ride the default Presently, when a report is processed, its proposed size, provided by the user of the API (as Report Size * Report Count) is compared against the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some low-level HID drivers allocate a reduced amount of memory to their buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending this check inadequate in some cases. In these circumstances, if the received report ends up being smaller than the proposed report size, the remainder of the buffer is zeroed. That is, the space between sizeof(csize) (size of the current report) and the rsize (size proposed i.e. Report Size * Report Count), which can be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset() shoots straight past the end of the buffer boundary and starts zeroing out in-use values, often resulting in calamity. This patch introduces a new variable into 'struct hid_ll_driver' where individual low-level drivers can over-ride the default maximum value of HID_MAX_BUFFER_SIZE (16k) with something more sympathetic to the interface. Signed-off-by: Lee Jones Signed-off-by: Jiri Kosina commit c749e3f82a15e10a798bb55f60368ee102c793cb Author: Patrisious Haddad Date: Wed Feb 22 11:06:40 2023 +0200 net/mlx5: Fix memory leak in IPsec RoCE creation During IPsec RoCE TX creation a struct for the flow group creation is allocated, but never freed. Free that struct once it is no longer in use. Fixes: 22551e77e550 ("net/mlx5: Configure IPsec steering for egress RoCEv2 traffic") Signed-off-by: Patrisious Haddad Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/a69739482cca7176d3a466f87bbf5af1250b09bb.1677056384.git.leon@kernel.org Signed-off-by: Paolo Abeni commit 44bd0394fe10903757da0863e0cf62c2d9846ea6 Author: Lu Wei Date: Wed Feb 22 16:36:29 2023 +0800 selftests: fib_tests: Add test cases for IPv4/IPv6 in route notify Add tests to check whether the total fib info length is calculated corretly in route notify process. Signed-off-by: Lu Wei Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230222083629.335683-3-luwei32@huawei.com Signed-off-by: Paolo Abeni commit 4cc59f386991ec9374cb4bc83dbe1c0b5a95033f Author: Lu Wei Date: Wed Feb 22 16:36:28 2023 +0800 ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the number of siblings. However if the fib6_info has no lwtunnel but the siblings have lwtunnels, the nexthop length is less than it should be, and it will trigger a warning in inet6_rt_notify() as follows: WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130 ...... Call Trace: fib6_add_rt2node+0x685/0xa30 fib6_add+0x96/0x1b0 ip6_route_add+0x50/0xd0 inet6_rtm_newroute+0x97/0xa0 rtnetlink_rcv_msg+0x156/0x3d0 netlink_rcv_skb+0x5a/0x110 netlink_unicast+0x246/0x350 netlink_sendmsg+0x250/0x4c0 sock_sendmsg+0x66/0x70 ___sys_sendmsg+0x7c/0xd0 __sys_sendmsg+0x5d/0xb0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This bug can be reproduced by script: ip -6 addr add 2002::2/64 dev ens2 ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100 for i in 10 20 30 40 50 60 70; do ip link add link ens2 name ipv_$i type ipvlan ip -6 addr add 2002::$i/64 dev ipv_$i ifconfig ipv_$i up done for i in 10 20 30 40 50 60; do ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1 dev ipv_$i metric 100 done ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100 This patch fixes it by adding nexthop_len of every siblings using rt6_nh_nlmsg_size(). Fixes: beb1afac518d ("net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attribute") Signed-off-by: Lu Wei Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230222083629.335683-2-luwei32@huawei.com Signed-off-by: Paolo Abeni commit f4440abc08917d9a7032abb8a6a5d4b36ca979b6 Merge: 27121864ab366 ef3e6327ff04a Author: Miquel Raynal Date: Thu Feb 23 10:28:29 2023 +0100 Merge tag 'nand/for-6.3' into mtd/next NAND core changes: * Check the data only read pattern only once * Prepare the late addition of supported operation checks * Support for sequential cache reads * Fix nand_chip kdoc Raw NAND changes: * Fsl_elbc: Propagate HW ECC settings to HW * Marvell: Add missing layouts * Pasemi: Don't use static data to track per-device state * Sunxi: - Fix the size of the last OOB region - Remove an unnecessary check - Remove an unnecessary check - Clean up chips after failed init - Precompute the ECC_CTL register value - Embed sunxi_nand_hw_ecc by value - Update OOB layout to match hardware * tmio_nand: Remove driver * vf610_nfc: Use regular comments for functions SPI-NAND changes: * Add support for AllianceMemory AS5F34G04SND * Macronix: use scratch buffer for DMA operation NAND ECC changes: * Mediatek: - Add ECC support fot MT7986 IC - Add compatible for MT7986 - dt-bindings: Split ECC engine with rawnand controller commit 27121864ab366992583d894961ecdc6e2ffe0ca1 Merge: 84549c816dc31 f047382519ca4 Author: Miquel Raynal Date: Thu Feb 23 10:27:32 2023 +0100 Merge tag 'spi-nor/for-6.3' into mtd/next SPI NOR changes: * small fixes on core and spansion driver. commit 00c8f01c4e84637c3db76f368b8687cb61f4dd9d Author: Josh Poimboeuf Date: Thu Feb 16 12:34:41 2023 -0800 objtool: Fix ORC 'signal' propagation There have been some recently reported ORC unwinder warnings like: WARNING: can't access registers at entry_SYSCALL_64_after_hwframe+0x63/0xcd WARNING: stack going in the wrong direction? at __sys_setsockopt+0x2c6/0x5b0 net/socket.c:2271 And a KASAN warning: BUG: KASAN: stack-out-of-bounds in unwind_next_frame (arch/x86/include/asm/ptrace.h:136 arch/x86/kernel/unwind_orc.c:455) It turns out the 'signal' bit isn't getting propagated from the unwind hints to the ORC entries, making the unwinder confused at times. Fixes: ffb1b4a41016 ("x86/unwind/orc: Add 'signal' field to ORC metadata") Reported-by: kernel test robot Reported-by: Dmitry Vyukov Signed-off-by: Josh Poimboeuf Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/97eef9db60cd86d376a9a40d49d77bb67a8f6526.1676579666.git.jpoimboe@kernel.org commit 1c34496e5856886d565665fb64029ecdeb080ffb Author: Peter Zijlstra Date: Wed Feb 8 18:18:05 2023 +0100 objtool: Remove instruction::list Replace the instruction::list by allocating instructions in arrays of 256 entries and stringing them together by (amortized) find_insn(). This shrinks instruction by 16 bytes and brings it down to 128. struct instruction { - struct list_head list; /* 0 16 */ - struct hlist_node hash; /* 16 16 */ - struct list_head call_node; /* 32 16 */ - struct section * sec; /* 48 8 */ - long unsigned int offset; /* 56 8 */ - /* --- cacheline 1 boundary (64 bytes) --- */ - long unsigned int immediate; /* 64 8 */ - unsigned int len; /* 72 4 */ - u8 type; /* 76 1 */ - - /* Bitfield combined with previous fields */ + struct hlist_node hash; /* 0 16 */ + struct list_head call_node; /* 16 16 */ + struct section * sec; /* 32 8 */ + long unsigned int offset; /* 40 8 */ + long unsigned int immediate; /* 48 8 */ + u8 len; /* 56 1 */ + u8 prev_len; /* 57 1 */ + u8 type; /* 58 1 */ + s8 instr; /* 59 1 */ + u32 idx:8; /* 60: 0 4 */ + u32 dead_end:1; /* 60: 8 4 */ + u32 ignore:1; /* 60: 9 4 */ + u32 ignore_alts:1; /* 60:10 4 */ + u32 hint:1; /* 60:11 4 */ + u32 save:1; /* 60:12 4 */ + u32 restore:1; /* 60:13 4 */ + u32 retpoline_safe:1; /* 60:14 4 */ + u32 noendbr:1; /* 60:15 4 */ + u32 entry:1; /* 60:16 4 */ + u32 visited:4; /* 60:17 4 */ + u32 no_reloc:1; /* 60:21 4 */ - u16 dead_end:1; /* 76: 8 2 */ - u16 ignore:1; /* 76: 9 2 */ - u16 ignore_alts:1; /* 76:10 2 */ - u16 hint:1; /* 76:11 2 */ - u16 save:1; /* 76:12 2 */ - u16 restore:1; /* 76:13 2 */ - u16 retpoline_safe:1; /* 76:14 2 */ - u16 noendbr:1; /* 76:15 2 */ - u16 entry:1; /* 78: 0 2 */ - u16 visited:4; /* 78: 1 2 */ - u16 no_reloc:1; /* 78: 5 2 */ + /* XXX 10 bits hole, try to pack */ - /* XXX 2 bits hole, try to pack */ - /* Bitfield combined with next fields */ - - s8 instr; /* 79 1 */ - struct alt_group * alt_group; /* 80 8 */ - struct instruction * jump_dest; /* 88 8 */ - struct instruction * first_jump_src; /* 96 8 */ + /* --- cacheline 1 boundary (64 bytes) --- */ + struct alt_group * alt_group; /* 64 8 */ + struct instruction * jump_dest; /* 72 8 */ + struct instruction * first_jump_src; /* 80 8 */ union { - struct symbol * _call_dest; /* 104 8 */ - struct reloc * _jump_table; /* 104 8 */ - }; /* 104 8 */ - struct alternative * alts; /* 112 8 */ - struct symbol * sym; /* 120 8 */ - /* --- cacheline 2 boundary (128 bytes) --- */ - struct stack_op * stack_ops; /* 128 8 */ - struct cfi_state * cfi; /* 136 8 */ + struct symbol * _call_dest; /* 88 8 */ + struct reloc * _jump_table; /* 88 8 */ + }; /* 88 8 */ + struct alternative * alts; /* 96 8 */ + struct symbol * sym; /* 104 8 */ + struct stack_op * stack_ops; /* 112 8 */ + struct cfi_state * cfi; /* 120 8 */ - /* size: 144, cachelines: 3, members: 28 */ - /* sum members: 142 */ - /* sum bitfield members: 14 bits, bit holes: 1, sum bit holes: 2 bits */ - /* last cacheline: 16 bytes */ + /* size: 128, cachelines: 2, members: 29 */ + /* sum members: 124 */ + /* sum bitfield members: 22 bits, bit holes: 1, sum bit holes: 10 bits */ }; pre: 5:38.18 real, 213.25 user, 124.90 sys, 23449040 mem post: 5:03.34 real, 210.75 user, 88.80 sys, 20241232 mem Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.851307606@infradead.org commit 6ea17e848a8ba5138b30e936c4b71877bc972c13 Author: Peter Zijlstra Date: Wed Feb 8 18:18:04 2023 +0100 x86: Fix FILL_RETURN_BUFFER With overlapping alternative validation fixed, objtool promptly complains: vmlinux.o: warning: objtool: __switch_to_asm+0x2c: stack layout conflict in alternatives: .altinstr_replacement+0x47 .rela.altinstructions: 000000000000009c 0000000200000002 R_X86_64_PC32 0000000000000000 .text + 16dc 00000000000000a0 0000000600000002 R_X86_64_PC32 0000000000000000 .altinstr_replacement + 3a 00000000000000a8 0000000200000002 R_X86_64_PC32 0000000000000000 .text + 16dc 00000000000000ac 0000000600000002 R_X86_64_PC32 0000000000000000 .altinstr_replacement + 66 .text: 00000000000016b0 <__switch_to_asm>: 16b0: f3 0f 1e fa endbr64 16b4: 55 push %rbp 16b5: 53 push %rbx 16b6: 41 54 push %r12 16b8: 41 55 push %r13 16ba: 41 56 push %r14 16bc: 41 57 push %r15 16be: 48 89 a7 18 0b 00 00 mov %rsp,0xb18(%rdi) 16c5: 48 8b a6 18 0b 00 00 mov 0xb18(%rsi),%rsp 16cc: 48 8b 9e 28 05 00 00 mov 0x528(%rsi),%rbx 16d3: 65 48 89 1c 25 00 00 00 00 mov %rbx,%gs:0x0 16d8: R_X86_64_32S fixed_percpu_data+0x28 16dc: eb 2a jmp 1708 <__switch_to_asm+0x58> 16de: 90 nop 16df: 90 nop 16e0: 90 nop 16e1: 90 nop 16e2: 90 nop 16e3: 90 nop 16e4: 90 nop 16e5: 90 nop 16e6: 90 nop 16e7: 90 nop 16e8: 90 nop 16e9: 90 nop 16ea: 90 nop 16eb: 90 nop 16ec: 90 nop 16ed: 90 nop 16ee: 90 nop 16ef: 90 nop 16f0: 90 nop 16f1: 90 nop 16f2: 90 nop 16f3: 90 nop 16f4: 90 nop 16f5: 90 nop 16f6: 90 nop 16f7: 90 nop 16f8: 90 nop 16f9: 90 nop 16fa: 90 nop 16fb: 90 nop 16fc: 90 nop 16fd: 90 nop 16fe: 90 nop 16ff: 90 nop 1700: 90 nop 1701: 90 nop 1702: 90 nop 1703: 90 nop 1704: 90 nop 1705: 90 nop 1706: 90 nop 1707: 90 nop 1708: 41 5f pop %r15 170a: 41 5e pop %r14 170c: 41 5d pop %r13 170e: 41 5c pop %r12 1710: 5b pop %rbx 1711: 5d pop %rbp 1712: e9 00 00 00 00 jmp 1717 <__switch_to_asm+0x67> 1713: R_X86_64_PLT32 __switch_to-0x4 .altinstr_replacement: 3a: 49 c7 c4 10 00 00 00 mov $0x10,%r12 41: e8 01 00 00 00 call 47 <.altinstr_replacement+0x47> 46: cc int3 47: e8 01 00 00 00 call 4d <.altinstr_replacement+0x4d> 4c: cc int3 4d: 48 83 c4 10 add $0x10,%rsp 51: 49 ff cc dec %r12 54: 75 eb jne 41 <.altinstr_replacement+0x41> 56: 0f ae e8 lfence 59: 65 48 c7 04 25 00 00 00 00 ff ff ff ff movq $0xffffffffffffffff,%gs:0x0 5e: R_X86_64_32S pcpu_hot+0x10 66: e8 01 00 00 00 call 6c <.altinstr_replacement+0x6c> 6b: cc int3 6c: 48 83 c4 08 add $0x8,%rsp 70: 0f ae e8 lfence As can be seen from the two alternatives, when overlaid, the NOP after the shorter (starting at 66) coinsides with the call at 47, leading to conflicting CFI state for that instruction. By offsetting the shorter alternative by 2 bytes, this alignment is undone. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.783099843@infradead.org commit a706bb08c81ac878982e41d4b6abcc42258bd39e Author: Peter Zijlstra Date: Wed Feb 8 18:18:03 2023 +0100 objtool: Fix overlapping alternatives Things like ALTERNATIVE_{2,3}() generate multiple alternatives on the same place, objtool would override the first orig_alt_group with the second (or third), failing to check the CFI among all the different variants. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.711471461@infradead.org commit c6f5dc28fb3d736fa8d7f7d31e0664a9c772c299 Author: Peter Zijlstra Date: Wed Feb 8 18:18:02 2023 +0100 objtool: Union instruction::{call_dest,jump_table} The instruction call_dest and jump_table members can never be used at the same time, their usage depends on type. struct instruction { struct list_head list; /* 0 16 */ struct hlist_node hash; /* 16 16 */ struct list_head call_node; /* 32 16 */ struct section * sec; /* 48 8 */ long unsigned int offset; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ long unsigned int immediate; /* 64 8 */ unsigned int len; /* 72 4 */ u8 type; /* 76 1 */ /* Bitfield combined with previous fields */ u16 dead_end:1; /* 76: 8 2 */ u16 ignore:1; /* 76: 9 2 */ u16 ignore_alts:1; /* 76:10 2 */ u16 hint:1; /* 76:11 2 */ u16 save:1; /* 76:12 2 */ u16 restore:1; /* 76:13 2 */ u16 retpoline_safe:1; /* 76:14 2 */ u16 noendbr:1; /* 76:15 2 */ u16 entry:1; /* 78: 0 2 */ u16 visited:4; /* 78: 1 2 */ u16 no_reloc:1; /* 78: 5 2 */ /* XXX 2 bits hole, try to pack */ /* Bitfield combined with next fields */ s8 instr; /* 79 1 */ struct alt_group * alt_group; /* 80 8 */ - struct symbol * call_dest; /* 88 8 */ - struct instruction * jump_dest; /* 96 8 */ - struct instruction * first_jump_src; /* 104 8 */ - struct reloc * jump_table; /* 112 8 */ - struct alternative * alts; /* 120 8 */ + struct instruction * jump_dest; /* 88 8 */ + struct instruction * first_jump_src; /* 96 8 */ + union { + struct symbol * _call_dest; /* 104 8 */ + struct reloc * _jump_table; /* 104 8 */ + }; /* 104 8 */ + struct alternative * alts; /* 112 8 */ + struct symbol * sym; /* 120 8 */ /* --- cacheline 2 boundary (128 bytes) --- */ - struct symbol * sym; /* 128 8 */ - struct stack_op * stack_ops; /* 136 8 */ - struct cfi_state * cfi; /* 144 8 */ + struct stack_op * stack_ops; /* 128 8 */ + struct cfi_state * cfi; /* 136 8 */ - /* size: 152, cachelines: 3, members: 29 */ - /* sum members: 150 */ + /* size: 144, cachelines: 3, members: 28 */ + /* sum members: 142 */ /* sum bitfield members: 14 bits, bit holes: 1, sum bit holes: 2 bits */ - /* last cacheline: 24 bytes */ + /* last cacheline: 16 bytes */ }; pre: 5:39.35 real, 215.58 user, 123.69 sys, 23448736 mem post: 5:38.18 real, 213.25 user, 124.90 sys, 23449040 mem Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.640914454@infradead.org commit 0932dbe1f5680481e612cafe0c7d0f1796f68612 Author: Peter Zijlstra Date: Wed Feb 8 18:18:01 2023 +0100 objtool: Remove instruction::reloc Instead of caching the reloc for each instruction, only keep a negative cache of not having a reloc (by far the most common case). struct instruction { struct list_head list; /* 0 16 */ struct hlist_node hash; /* 16 16 */ struct list_head call_node; /* 32 16 */ struct section * sec; /* 48 8 */ long unsigned int offset; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ long unsigned int immediate; /* 64 8 */ unsigned int len; /* 72 4 */ u8 type; /* 76 1 */ /* Bitfield combined with previous fields */ u16 dead_end:1; /* 76: 8 2 */ u16 ignore:1; /* 76: 9 2 */ u16 ignore_alts:1; /* 76:10 2 */ u16 hint:1; /* 76:11 2 */ u16 save:1; /* 76:12 2 */ u16 restore:1; /* 76:13 2 */ u16 retpoline_safe:1; /* 76:14 2 */ u16 noendbr:1; /* 76:15 2 */ u16 entry:1; /* 78: 0 2 */ u16 visited:4; /* 78: 1 2 */ + u16 no_reloc:1; /* 78: 5 2 */ - /* XXX 3 bits hole, try to pack */ + /* XXX 2 bits hole, try to pack */ /* Bitfield combined with next fields */ s8 instr; /* 79 1 */ struct alt_group * alt_group; /* 80 8 */ struct symbol * call_dest; /* 88 8 */ struct instruction * jump_dest; /* 96 8 */ struct instruction * first_jump_src; /* 104 8 */ struct reloc * jump_table; /* 112 8 */ - struct reloc * reloc; /* 120 8 */ + struct alternative * alts; /* 120 8 */ /* --- cacheline 2 boundary (128 bytes) --- */ - struct alternative * alts; /* 128 8 */ - struct symbol * sym; /* 136 8 */ - struct stack_op * stack_ops; /* 144 8 */ - struct cfi_state * cfi; /* 152 8 */ + struct symbol * sym; /* 128 8 */ + struct stack_op * stack_ops; /* 136 8 */ + struct cfi_state * cfi; /* 144 8 */ - /* size: 160, cachelines: 3, members: 29 */ - /* sum members: 158 */ - /* sum bitfield members: 13 bits, bit holes: 1, sum bit holes: 3 bits */ - /* last cacheline: 32 bytes */ + /* size: 152, cachelines: 3, members: 29 */ + /* sum members: 150 */ + /* sum bitfield members: 14 bits, bit holes: 1, sum bit holes: 2 bits */ + /* last cacheline: 24 bytes */ }; pre: 5:48.89 real, 220.96 user, 127.55 sys, 24834672 mem post: 5:39.35 real, 215.58 user, 123.69 sys, 23448736 mem Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.572145269@infradead.org commit 8b2de412158ecdb312c707918432e6650df808cc Author: Peter Zijlstra Date: Wed Feb 8 18:18:00 2023 +0100 objtool: Shrink instruction::{type,visited} Since we don't have that many types in enum insn_type, force it into a u8 and re-arrange member to get rid of the holes, saves another 8 bytes. struct instruction { struct list_head list; /* 0 16 */ struct hlist_node hash; /* 16 16 */ struct list_head call_node; /* 32 16 */ struct section * sec; /* 48 8 */ long unsigned int offset; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ - unsigned int len; /* 64 4 */ - enum insn_type type; /* 68 4 */ - long unsigned int immediate; /* 72 8 */ - u16 dead_end:1; /* 80: 0 2 */ - u16 ignore:1; /* 80: 1 2 */ - u16 ignore_alts:1; /* 80: 2 2 */ - u16 hint:1; /* 80: 3 2 */ - u16 save:1; /* 80: 4 2 */ - u16 restore:1; /* 80: 5 2 */ - u16 retpoline_safe:1; /* 80: 6 2 */ - u16 noendbr:1; /* 80: 7 2 */ - u16 entry:1; /* 80: 8 2 */ + long unsigned int immediate; /* 64 8 */ + unsigned int len; /* 72 4 */ + u8 type; /* 76 1 */ - /* XXX 7 bits hole, try to pack */ + /* Bitfield combined with previous fields */ - s8 instr; /* 82 1 */ - u8 visited; /* 83 1 */ + u16 dead_end:1; /* 76: 8 2 */ + u16 ignore:1; /* 76: 9 2 */ + u16 ignore_alts:1; /* 76:10 2 */ + u16 hint:1; /* 76:11 2 */ + u16 save:1; /* 76:12 2 */ + u16 restore:1; /* 76:13 2 */ + u16 retpoline_safe:1; /* 76:14 2 */ + u16 noendbr:1; /* 76:15 2 */ + u16 entry:1; /* 78: 0 2 */ + u16 visited:4; /* 78: 1 2 */ - /* XXX 4 bytes hole, try to pack */ + /* XXX 3 bits hole, try to pack */ + /* Bitfield combined with next fields */ - struct alt_group * alt_group; /* 88 8 */ - struct symbol * call_dest; /* 96 8 */ - struct instruction * jump_dest; /* 104 8 */ - struct instruction * first_jump_src; /* 112 8 */ - struct reloc * jump_table; /* 120 8 */ + s8 instr; /* 79 1 */ + struct alt_group * alt_group; /* 80 8 */ + struct symbol * call_dest; /* 88 8 */ + struct instruction * jump_dest; /* 96 8 */ + struct instruction * first_jump_src; /* 104 8 */ + struct reloc * jump_table; /* 112 8 */ + struct reloc * reloc; /* 120 8 */ /* --- cacheline 2 boundary (128 bytes) --- */ - struct reloc * reloc; /* 128 8 */ - struct alternative * alts; /* 136 8 */ - struct symbol * sym; /* 144 8 */ - struct stack_op * stack_ops; /* 152 8 */ - struct cfi_state * cfi; /* 160 8 */ + struct alternative * alts; /* 128 8 */ + struct symbol * sym; /* 136 8 */ + struct stack_op * stack_ops; /* 144 8 */ + struct cfi_state * cfi; /* 152 8 */ - /* size: 168, cachelines: 3, members: 29 */ - /* sum members: 162, holes: 1, sum holes: 4 */ - /* sum bitfield members: 9 bits, bit holes: 1, sum bit holes: 7 bits */ - /* last cacheline: 40 bytes */ + /* size: 160, cachelines: 3, members: 29 */ + /* sum members: 158 */ + /* sum bitfield members: 13 bits, bit holes: 1, sum bit holes: 3 bits */ + /* last cacheline: 32 bytes */ }; pre: 5:48.86 real, 220.30 user, 128.34 sys, 24834672 mem post: 5:48.89 real, 220.96 user, 127.55 sys, 24834672 mem Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.501847188@infradead.org commit d54066546121426ecd7ad01a53ae429c4e37a9d5 Author: Peter Zijlstra Date: Wed Feb 8 18:17:59 2023 +0100 objtool: Make instruction::alts a single-linked list struct instruction { struct list_head list; /* 0 16 */ struct hlist_node hash; /* 16 16 */ struct list_head call_node; /* 32 16 */ struct section * sec; /* 48 8 */ long unsigned int offset; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ unsigned int len; /* 64 4 */ enum insn_type type; /* 68 4 */ long unsigned int immediate; /* 72 8 */ u16 dead_end:1; /* 80: 0 2 */ u16 ignore:1; /* 80: 1 2 */ u16 ignore_alts:1; /* 80: 2 2 */ u16 hint:1; /* 80: 3 2 */ u16 save:1; /* 80: 4 2 */ u16 restore:1; /* 80: 5 2 */ u16 retpoline_safe:1; /* 80: 6 2 */ u16 noendbr:1; /* 80: 7 2 */ u16 entry:1; /* 80: 8 2 */ /* XXX 7 bits hole, try to pack */ s8 instr; /* 82 1 */ u8 visited; /* 83 1 */ /* XXX 4 bytes hole, try to pack */ struct alt_group * alt_group; /* 88 8 */ struct symbol * call_dest; /* 96 8 */ struct instruction * jump_dest; /* 104 8 */ struct instruction * first_jump_src; /* 112 8 */ struct reloc * jump_table; /* 120 8 */ /* --- cacheline 2 boundary (128 bytes) --- */ struct reloc * reloc; /* 128 8 */ - struct list_head alts; /* 136 16 */ - struct symbol * sym; /* 152 8 */ - struct stack_op * stack_ops; /* 160 8 */ - struct cfi_state * cfi; /* 168 8 */ + struct alternative * alts; /* 136 8 */ + struct symbol * sym; /* 144 8 */ + struct stack_op * stack_ops; /* 152 8 */ + struct cfi_state * cfi; /* 160 8 */ - /* size: 176, cachelines: 3, members: 29 */ - /* sum members: 170, holes: 1, sum holes: 4 */ + /* size: 168, cachelines: 3, members: 29 */ + /* sum members: 162, holes: 1, sum holes: 4 */ /* sum bitfield members: 9 bits, bit holes: 1, sum bit holes: 7 bits */ - /* last cacheline: 48 bytes */ + /* last cacheline: 40 bytes */ }; pre: 5:58.50 real, 229.64 user, 128.65 sys, 26221520 mem post: 5:48.86 real, 220.30 user, 128.34 sys, 24834672 mem Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.430556498@infradead.org commit 3ee88df1b063962e39d7798ccc3b18fd10cea813 Author: Peter Zijlstra Date: Wed Feb 8 18:17:58 2023 +0100 objtool: Make instruction::stack_ops a single-linked list struct instruction { struct list_head list; /* 0 16 */ struct hlist_node hash; /* 16 16 */ struct list_head call_node; /* 32 16 */ struct section * sec; /* 48 8 */ long unsigned int offset; /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ unsigned int len; /* 64 4 */ enum insn_type type; /* 68 4 */ long unsigned int immediate; /* 72 8 */ u16 dead_end:1; /* 80: 0 2 */ u16 ignore:1; /* 80: 1 2 */ u16 ignore_alts:1; /* 80: 2 2 */ u16 hint:1; /* 80: 3 2 */ u16 save:1; /* 80: 4 2 */ u16 restore:1; /* 80: 5 2 */ u16 retpoline_safe:1; /* 80: 6 2 */ u16 noendbr:1; /* 80: 7 2 */ u16 entry:1; /* 80: 8 2 */ /* XXX 7 bits hole, try to pack */ s8 instr; /* 82 1 */ u8 visited; /* 83 1 */ /* XXX 4 bytes hole, try to pack */ struct alt_group * alt_group; /* 88 8 */ struct symbol * call_dest; /* 96 8 */ struct instruction * jump_dest; /* 104 8 */ struct instruction * first_jump_src; /* 112 8 */ struct reloc * jump_table; /* 120 8 */ /* --- cacheline 2 boundary (128 bytes) --- */ struct reloc * reloc; /* 128 8 */ struct list_head alts; /* 136 16 */ struct symbol * sym; /* 152 8 */ - struct list_head stack_ops; /* 160 16 */ - struct cfi_state * cfi; /* 176 8 */ + struct stack_op * stack_ops; /* 160 8 */ + struct cfi_state * cfi; /* 168 8 */ - /* size: 184, cachelines: 3, members: 29 */ - /* sum members: 178, holes: 1, sum holes: 4 */ + /* size: 176, cachelines: 3, members: 29 */ + /* sum members: 170, holes: 1, sum holes: 4 */ /* sum bitfield members: 9 bits, bit holes: 1, sum bit holes: 7 bits */ - /* last cacheline: 56 bytes */ + /* last cacheline: 48 bytes */ }; pre: 5:58.22 real, 226.69 user, 131.22 sys, 26221520 mem post: 5:58.50 real, 229.64 user, 128.65 sys, 26221520 mem Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.362196959@infradead.org commit 20a554638dd2665a88d3d68a68f7981480a27f36 Author: Peter Zijlstra Date: Wed Feb 8 18:17:57 2023 +0100 objtool: Change arch_decode_instruction() signature In preparation to changing struct instruction around a bit, avoid passing it's members by pointer and instead pass the whole thing. A cleanup in it's own right too. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Acked-by: Josh Poimboeuf Tested-by: Nathan Chancellor # build only Tested-by: Thomas Weißschuh # compile and run Link: https://lore.kernel.org/r/20230208172245.291087549@infradead.org commit 585a78c1f77be305b1f6adad392f16047fb66ffd Merge: 37064583f63ec 69308402ca6f5 Author: Ingo Molnar Date: Thu Feb 23 09:16:39 2023 +0100 Merge branch 'linus' into objtool/core, to pick up Xen dependencies Pick up dependencies - freshly merged upstream via xen-next - before applying dependent objtool changes. Signed-off-by: Ingo Molnar commit 99a7bcafbd0d04555074554573019096a8c10450 Author: Krister Johansen Date: Wed Feb 22 09:54:56 2023 -0800 x86/xen/time: cleanup xen_tsc_safe_clocksource Modifies xen_tsc_safe_clocksource() to use newly defined constants from arch/x86/include/asm/xen/cpuid.h. This replaces a numeric value with XEN_CPUID_TSC_MODE_NEVER_EMULATE, and deletes a comment that is now self explanatory. There should be no change in the function's behavior. Signed-off-by: Krister Johansen Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/a69ca370fecf85d312d2db633d9438ace2af6e5b.1677038165.git.kjlx@templeofstupid.com Signed-off-by: Juergen Gross commit 5f6e839ebc951c50f1ca06791d016c256f0285a9 Author: Krister Johansen Date: Wed Feb 22 09:54:42 2023 -0800 xen: update arch/x86/include/asm/xen/cpuid.h Update arch/x86/include/asm/xen/cpuid.h from the Xen tree to get newest definitions. This picks up some TSC mode definitions and comment formatting changes. Signed-off-by: Krister Johansen Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/94b9046dd0db3794f0633d134b7108508957758d.1677038165.git.kjlx@templeofstupid.com Signed-off-by: Juergen Gross commit 0b93efca3659f6d55ed31cff6722dca5f6e4d6e2 Author: Randy Dunlap Date: Tue Feb 14 20:45:33 2023 -0800 drm/i915: move a Kconfig symbol to unbreak the menu presentation Inserting a Kconfig symbol that does not have a dependency (DRM_I915_GVT) into a list of other symbols that do have a dependency (on DRM_I915) breaks the driver menu presentation in 'make *config'. Relocate the DRM_I915_GVT symbol so that it does not cause this problem. Fixes: 8b750bf74418 ("drm/i915/gvt: move the gvt code into kvmgt.ko") Signed-off-by: Randy Dunlap Cc: Christoph Hellwig Cc: Zhi Wang Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: Zhenyu Wang Cc: intel-gfx@lists.freedesktop.org Cc: intel-gvt-dev@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Christoph Hellwig Acked-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20230215044533.4847-1-rdunlap@infradead.org commit 9203a648c951af31b11823056c18b7981135524d Author: Colin Ian King Date: Thu Feb 2 12:50:18 2023 +0000 i915/gvt: Fix spelling mistake "vender" -> "vendor" There is a spelling mistake in a literal string. Fix it. Signed-off-by: Colin Ian King Acked-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20230202125018.285523-1-colin.i.king@gmail.com commit d989bf543d8aea77c90a3eb8d2e30f9304570810 Author: Greg Kroah-Hartman Date: Thu Feb 2 15:13:09 2023 +0100 i915: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Cc: Zhenyu Wang Cc: Zhi Wang Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: David Airlie Cc: Daniel Vetter Cc: intel-gvt-dev@lists.freedesktop.org Cc: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Greg Kroah-Hartman Reviewed-by: Rodrigo Vivi Reviewed-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20230202141309.2293834-1-gregkh@linuxfoundation.org commit dd62071ff792cd4c2134b1211ba85efc6cd73ce3 Author: Deepak R Varma Date: Sat Jan 14 21:12:39 2023 +0530 drm/i915/gvt: Remove extra semicolon Remove the extra semicolon at end. Issue identified using semicolon.cocci Coccinelle semantic patch. Signed-off-by: Deepak R Varma Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/Y8LNbzgTf/1kYJX/@ubun2204.myguest.virtualbox.org Reviewed-by: Zhenyu Wang commit 84edc94edb25caf8bcd5f4744bf24b82c6b805df Author: Deepak R Varma Date: Thu Jan 19 01:53:07 2023 +0530 drm/i915/gvt: Avoid full proxy f_ops for debugfs attributes Using DEFINE_SIMPLE_ATTRIBUTE macro with the debugfs_create_file() function adds the overhead of introducing a proxy file operation functions to wrap the original read/write inside file removal protection functions. This adds significant overhead in terms of introducing and managing the proxy factory file operations structure and function wrapping at runtime. As a replacement, a combination of DEFINE_DEBUGFS_ATTRIBUTE macro paired with debugfs_create_file_unsafe() is suggested to be used instead. The DEFINE_DEBUGFS_ATTRIBUTE utilises debugfs_file_get() and debugfs_file_put() wrappers to protect the original read and write function calls for the debug attributes. There is no need for any runtime proxy file operations to be managed by the debugfs core. Following coccicheck make command helped identify this change: make coccicheck M=drivers/gpu/drm/i915/ MODE=patch COCCI=./scripts/coccinelle/api/debugfs/debugfs_simple_attr.cocci Signed-off-by: Deepak R Varma Reviewed-by: Rodrigo Vivi Acked-by: Zhenyu Wang Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/Y8hVK6wuqm50iADP@ubun2204.myguest.virtualbox.org commit fd2a55e74a991ae5ff531c9da52963277dc7fbd5 Merge: 67d93ffc0f3c4 0af8c09c89681 Author: Jakub Kicinski Date: Wed Feb 22 21:25:23 2023 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net 1) Fix broken listing of set elements when table has an owner. 2) Fix conntrack refcount leak in ctnetlink with related conntrack entries, from Hangyu Hua. 3) Fix use-after-free/double-free in ctnetlink conntrack insert path, from Florian Westphal. 4) Fix ip6t_rpfilter with VRF, from Phil Sutter. 5) Fix use-after-free in ebtables reported by syzbot, also from Florian. 6) Use skb->len in xt_length to deal with IPv6 jumbo packets, from Xin Long. 7) Fix NETLINK_LISTEN_ALL_NSID with ctnetlink, from Florian Westphal. 8) Fix memleak in {ip_,ip6_,arp_}tables in ENOMEM error case, from Pavel Tikhomirov. * git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: x_tables: fix percpu counter block leak on error path when creating new netns netfilter: ctnetlink: make event listener tracking global netfilter: xt_length: use skb len to match in length_mt6 netfilter: ebtables: fix table blob use-after-free netfilter: ip6t_rpfilter: Fix regression with VRF interfaces netfilter: conntrack: fix rmmod double-free race netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() netfilter: nf_tables: allow to fetch set elements when table has an owner ==================== Link: https://lore.kernel.org/r/20230222092137.88637-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 67d93ffc0f3c47094750bde6d62e7c5765dc47a6 Author: Íñigo Huguet Date: Tue Feb 21 14:06:16 2023 +0100 ptp: vclock: use mutex to fix "sleep on atomic" bug vclocks were using spinlocks to protect access to its timecounter and cyclecounter. Access to timecounter/cyclecounter is backed by the same driver callbacks that are used for non-virtual PHCs, but the usage of the spinlock imposes a new limitation that didn't exist previously: now they're called in atomic context so they mustn't sleep. Some drivers like sfc or ice may sleep on these callbacks, causing errors like "BUG: scheduling while atomic: ptp5/25223/0x00000002" Fix it replacing the vclock's spinlock by a mutex. It fix the mentioned bug and it doesn't introduce longer delays. I've tested synchronizing various different combinations of clocks: - vclock->sysclock - sysclock->vclock - vclock->vclock - hardware PHC in different NIC -> vclock - created 4 vclocks and launch 4 parallel phc2sys processes with lockdep enabled In all cases, comparing the delays reported by phc2sys, they are in the same range of values than before applying the patch. Link: https://lore.kernel.org/netdev/69d0ff33-bd32-6aa5-d36c-fbdc3c01337c@redhat.com/ Fixes: 5d43f951b1ac ("ptp: add ptp virtual clock driver framework") Reported-by: Yalin Li Suggested-by: Richard Cochran Tested-by: Miroslav Lichvar Signed-off-by: Íñigo Huguet Acked-by: Richard Cochran Link: https://lore.kernel.org/r/20230221130616.21837-1-ihuguet@redhat.com Signed-off-by: Jakub Kicinski commit 9f6ad5d533d1c71e51bdd06a5712c4fbc8768dfa Author: Zhong Jinghua Date: Tue Feb 21 17:50:27 2023 +0800 loop: loop_set_status_from_info() check before assignment In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed to the wrong value, and it will not be changed back. More, the original patch did not solve the problem, the value was set and ioctl returned an error, but the subsequent io used the value in the loop driver, which still caused an alarm: loop_handle_cmd do_req_filebacked loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset; lo_rw_aio cmd->iocb.ki_pos = pos Fixes: c490a0b5a4f3 ("loop: Check for overflow while configuring loop") Signed-off-by: Zhong Jinghua Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20230221095027.3656193-1-zhongjinghua@huaweicloud.com Signed-off-by: Jens Axboe commit a5c95ca18a98d742d0a4a04063c32556b5b66378 Merge: 307e14c039063 a48bba98380cb Author: Linus Torvalds Date: Wed Feb 22 18:28:03 2023 -0800 Merge tag 'drm-next-2023-02-23' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "There are a bunch of changes all over in the usual places. Highlights: - habanalabs moves from misc to accel - first accel driver for Intel VPU (Versatile Processing Unit) inference engine - dropped all the ancient legacy DRI1 drivers. I think it's been at least 10 years since anyone has heard about these. - Intel DG2 updates and prelim Meteorlake enablement - etnaviv adds support for Versilicon NPU device (a GPU like engine with inference accelerators) Detailed summary: Removals: - remove legacy dri1 drivers: i810, mga, r128, savage, sis, tdfx, via New driver: - intel VPU accelerator driver - habanalabs comes via drm tree now drm/core: - use drm_dbg_ helpers in several places - Document defaults for CRTC backgrounds - Document use of drm_minor edid: - improve mode parsing and refactoring connector: - support analog TV mode property media: - add some common formats udmabuf: - add vmap/vunmap methods fourcc: - add XRGB1555 and RGB565 formats - document open source user waiver firmware: - fix color-format selection for system framebuffer format-helper: - Add conversion from XRGB8888 to various sysfb formats - Make XRGB8888 the only driver-emulated legacy format - Add conversion from XRGB8888 to XBGR8888 and ABGR8888 fb-helper: - fix preferred depth and bpp values across drivers - Avoid blank consoles from selecting an incorrect color format probe-helper: - Enable/disable HPD on connectors scheduler: - Fix lockup in drm_sched_entity_kill() - Deprecate drm_sched_resubmit_jobs() bridge: - remove unused functions - implement i2c probe_new in various drivers - ite-it6505: Locking fixes, Cache EDID data - ite-it66121: Support IT6610 chip - lontium-tl9611: Fix HDMI on DragonBoard 845c - parade-ps8640: Use atomic bridge functions - Support i.MX93 LDB plus DT bindings debugfs: - add per device helpers and convert drivers displayport: - mst fixes - add DP adaptive sync DPCD definitions fbdev: - always pick 32bpp as default - remove some unused code simpledrm: - support system memory framebuffers panel: - add orientation quirks for Lenovo Yoga Tab 3 X90F and DynaBook K50 - Use ktime_get_boottime() to measure power-down delay - Fix auto-suspend delay - Visionox VTDR6130 AMOLED DSI - Support Himax HX8394 - Convert many drivers to common generic DSI write-sequence helper - AUO A030JTN01 ttm: - drop bo wait wrapper - fix MIPS build habanalabs: - moved driver to accel subsystem - gaudi2 decoder error improvement - more trace events - Gaudi2 abrupt reset by firmware support - add uAPI to flush memory transactions - add uAPI to pass through userspace reqs to fw - remove dma-buf export by handle amdgpu: - add new INFO queries for peak and min sclk/mclk for profile modes - Add PCIe info to the INFO IOCTL - secure display support for multiple displays - DML optimizations - DCN 3.2 updates - PSR updates - DP 2.1 updates - SR-IOV RAS updates - VCN RAS support - SMU 13.x updates - Switch 1 element arrays to flexible arrays - Add RAS support for DF 4.3 - Stack size improvements - S0ix rework - Allow 0 as a vram limit on APUs - Handle profiling modes for SMU13.x - Fix possible segfault in failure case - Rework FW requests to happen in early_init for all IPs so that we don't lose the sbios console if FW is missing - Fix power reporting on certain firmwares for CZN/RN - Allow S0ix without BIOS support - Enable freesync over PCon - Re-enable the AGP aperture on GMC 11.x amdkfd: - Error handling fixes - PASID fixes - Fix for cleared VRAM BOs - Fix cleanup if GPUVM creation fails - Memory accounting fix - Use resource_size rather than open codeing it - GC11 mGPU fix radeon: - Switch 1 element arrays to flexible arrays - Fix memory leak on shutdown - move to new logging i915: - Meteorlake display/OA/GSC fw/workarounds enabling - DP MST DSC support - Gamma/degamma readout support for the state checker - Enable SDP split support for DP 2.0 - Add probe blocking support to i915.force_probe parameter - Enable Xe HP 4tile support - Avoid display direct calls to uncore - Fix HuC delayed load memory leaks - Add DG2 workarounds Wa_18018764978 and Wa_18019271663 - Improve suspend / resume times with VT-d scanout workaround active - Fix DG2 visual corruption on small BAR systems by not forgetting to copy CCS aux state - Fix TLB invalidation for Gen12.50 video and compute engines - Enable HF-EEODB by switching HDMI, DP and LVDS to use struct drm_edid - Start using unversioned DMC firmware paths for new platforms - ELD refactor: Stop using hardware buffer, precompute ELD - lots of display code refactoring nouveau: - drop legacy ioctl support - replace 0-sized array msm: - dpu/dsi/mdss: Support for SM8350, SM8450 SM8550 and SC8280XP platform - Added bindings for SM8150 - dpu: Partial support for DSC on SM8150 and SM8250 - dpu: Fixed color transformation matrix being lost on suspend/resume - dp: Support SDM845 and SC8280XP platforms - dp: Support for limiting DP link rate via DT property - dsi: Validate display modes according to the DSI OPP table - dsi: DSI PHY support for the SM6375 platform - Add MSM_SUBMIT_BO_NO_IMPLICI - a2xx: Support to load legacy firmware - a6xx: GPU devcore dump updates for a650/a660 - GPU devfreq tuning and fixes - Turn 8960 HDMI PHY into clock provider, - Make 8960 HDMI PHY use PXO clock from DT etnaviv: - experimental versilicon NPU support - report GPU load via fdinfo format - MMU fault message improvements tegra: - rework syncpoint interrupt mediatek: - DSI timing fix - fix config deps ast: - various fixes exynos: - restore bridge chain order fixes gud: - convert to shadow plane buffers - perform flushing synchronously during atomic update - Use new debugfs helpers arm/hdlcd: - Use new debugfs helper ili9486: - Support 16-bit pixel data imx: - Split off IPUv3 driver mipi-dbi: - convert to DRM shadow-plane helpers - rsp driver changes - Support separate I/O-voltage supply mxsfb: - Depend on ARCH_MXS or ARCH_MXC sun4i: - convert to new TV mode property vc4: - convert to new TV mode property - kunit tests - Support RGB565 and RGB666 formats - convert dsi driver to bridge - Various HVS an CRTC fixes v3d: - Do not opencode drm_gem_object_lookup() virtio: - improve tracing vkms: - support small cursors in IGT tests - Fix SEGFAULT from incorrect GEM-buffer mapping rcar-du: - fixes and improvements" * tag 'drm-next-2023-02-23' of git://anongit.freedesktop.org/drm/drm: (1455 commits) msm/fbdev: fix unused variable warning with clang. drm/fb-helper: Remove drm_fb_helper_unprepare() from drm_fb_helper_fini() dma-buf: make kobj_type structure constant drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() drm/amd/display: disable SubVP + DRR to prevent underflow drm/amd/display: Fail atomic_check early on normalize_zpos error drm/amd/pm: avoid unaligned access warnings drm/amd/display: avoid unaligned access warnings drm/amd/display: Remove duplicate/repeating expressions drm/amd/display: Remove duplicate/repeating expression drm/amd/display: Make variables declaration inside ifdef guard drm/amd/display: Fix excess arguments on kernel-doc drm/amd/display: Add previously missing includes drm/amd/amdgpu: Add function prototypes to headers drm/amd/display: Add function prototypes to headers drm/amd/display: Turn global functions into static drm/amd/display: remove unused _calculate_degamma_curve function drm/amd/display: remove unused func declaration from resource headers drm/amd/display: unset initial value for tf since it's never used drm/amd/display: camel case cleanup in color_gamma file ... commit 90039f3773f688922ca267c3e925f61ad6f28e22 Author: Stephen Boyd Date: Wed Feb 22 17:36:42 2023 -0800 clk: qcom: apcs-msm8986: Include bitfield.h for FIELD_PREP Otherwise some configurations fail. Fixes: 027726365906 ("clk: qcom: add the driver for the MSM8996 APCS clocks") Link: https://lore.kernel.org/r/20230223013847.1218900-1-sboyd@kernel.org Signed-off-by: Stephen Boyd commit 307e14c039063f0c9bd7a18a7add8f940580dcc9 Merge: d8ca6dbb8de79 fdbf807215250 Author: Linus Torvalds Date: Wed Feb 22 17:12:44 2023 -0800 Merge tag '6.3-rc-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs client updates from Steve French: "The largest subset of this is from David Howells et al: making the cifs/smb3 driver pass iov_iters down to the lowest layers, directly to the network transport rather than passing lists of pages around, helping multiple areas: - Pin user pages, thereby fixing the race between concurrent DIO read and fork, where the pages containing the DIO read buffer may end up belonging to the child process and not the parent - with the result that the parent might not see the retrieved data. - cifs shouldn't take refs on pages extracted from non-user-backed iterators (eg. KVEC). With these changes, cifs will apply the appropriate cleanup. - Making it easier to transition to using folios in cifs rather than pages by dealing with them through BVEC and XARRAY iterators. - Allowing cifs to use the new splice function The remainder are: - fixes for stable, including various fixes for uninitialized memory, wrong length field causing mount issue to very old servers, important directory lease fixes and reconnect fixes - cleanups (unused code removal, change one element array usage, and a change form strtobool to kstrtobool, and Kconfig cleanups) - SMBDIRECT (RDMA) fixes including iov_iter integration and UAF fixes - reconnect fixes - multichannel fixes, including improving channel allocation (to least used channel) - remove the last use of lock_page_killable by moving to folio_lock_killable" * tag '6.3-rc-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (46 commits) update internal module version number for cifs.ko cifs: update ip_addr for ses only for primary chan setup cifs: use tcon allocation functions even for dummy tcon cifs: use the least loaded channel for sending requests cifs: DIO to/from KVEC-type iterators should now work cifs: Remove unused code cifs: Build the RDMA SGE list directly from an iterator cifs: Change the I/O paths to use an iterator rather than a page list cifs: Add a function to read into an iter from a socket cifs: Add some helper functions cifs: Add a function to Hash the contents of an iterator cifs: Add a function to build an RDMA SGE list from an iterator netfs: Add a function to extract an iterator into a scatterlist netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator cifs: Implement splice_read to pass down ITER_BVEC not ITER_PIPE splice: Export filemap/direct_splice_read() iov_iter: Add a function to extract a page list from an iterator iov_iter: Define flags to qualify page extraction. splice: Add a func to do a splice from an O_DIRECT file without ITER_PIPE splice: Add a func to do a splice from a buffered file without ITER_PIPE ... commit 5270c7a244b457357441281e609c741cbec8ead7 Merge: 1b929c02afd37 c1855dd0a62b7 Author: Stephen Boyd Date: Wed Feb 22 16:32:15 2023 -0800 Merge tag 'qcom-clk-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: Support for requesting the next power_off operation for a genpd to be synchronous is introduced, and implemented in the GDSC driver. To allow the GPU driver to request power_off to wait for the GDSC to actually collapse. Support for QDU1000/QRU1000 Global clock controller, SA8775P Global clock controller, SM8550 TCSR and display clock controller, SM6350 clock controller, nd MSM8996 CBF and APCS clock controllers is introduced. Parent references are updated across a large number of clock drivers, to align with the design changes since those drivers where introduced. Similarly, test clocks has been dropped from a range of drivers. A range of fixes for the MSM8996 CPU clock controller is introduced. MSM8974 GCC is transitioned off the externally defined sleep_clk. GDSC in the global clock controller for QCS404 is added, and various parent definitions are cleaned up. The SDCC core clocks on SM6115 are moved for floor_ops. Programming of clk_dis_wait for GPU CX GDSC on SC7180 and SDM845 are moved to use the recently introduced properties in the GDSC struct. The RPMh clock driver gains SM8550 and SA8775P clocks, and the IPA clock is added on a variety of platforms. The SMD RPM driver receives a big cleanup, in particular a move away from duplicating declaration of identical clocks between multiple platforms. A few missing clocks across msm8998, msm8992, msm8916, qcs404 are added as well. Using devm_pm_runtime_enable() to clean up some duplication is done across SM8250 display and video clock controllers, SM8450 display clock controller and SC7280 LPASS clock controller. Devicetree binding changes for above mentioned additions and changes are introduced. Support for postponing clk_disable_unused() until sync_state was introduced, but later reverted again, awaiting an agreement on the solution. Lastly, a change to pad a few registers in the SM8250 DTS to 8 digits was picked up in the wrong tree and kept here, to avoid rebasing. * tag 'qcom-clk-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (142 commits) clk: qcom: Revert sync_state based clk_disable_unused dt-bindings: clock: Merge qcom,gpucc-sm8350 into qcom,gpucc.yaml clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC dt-bindings: clock: qcom,sa8775p-gcc: add the power-domains property clk: qcom: cpu-8996: add missing cputype include clk: qcom: gcc-sa8775p: remove unused variables clk: qcom: smd-rpm: provide RPM_SMD_XO_CLK_SRC on MSM8996 platform clk: qcom: add msm8996 Core Bus Framework (CBF) support dt-bindings: clock: qcom,msm8996-cbf: Describe the MSM8996 CBF clock controller clk: qcom: add the driver for the MSM8996 APCS clocks clk: qcom: gcc-qcs404: fix duplicate initializer warning clk: qcom: cpu-8996: change setup sequence to follow vendor kernel clk: qcom: cpu-8996: fix PLL clock ops clk: qcom: cpu-8996: fix ACD initialization clk: qcom: cpu-8996: fix PLL configuration sequence clk: qcom: cpu-8996: move qcom_cpu_clk_msm8996_acd_init call clk: qcom: cpu-8996: setup PLLs before registering clocks clk: qcom: cpu-8996: simplify the cpu_clk_notifier_cb clk: qcom: cpu-8996: skip ACD init if the setup is valid ... commit a48bba98380cb0b43dcd01d276c7efc282e3c33f Author: Dave Airlie Date: Thu Feb 23 09:47:29 2023 +1000 msm/fbdev: fix unused variable warning with clang. clang builds showed this: drivers/gpu/drm/msm/msm_fbdev.c:144:6: error: variable 'helper' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] if (!fbdev) ^~~~~~ Fixes: 3fb1f62f80a1 ("drm/fb-helper: Remove drm_fb_helper_unprepare() from drm_fb_helper_fini()") Signed-off-by: Dave Airlie commit 13daf536191e8c484fa21de8fcac4767f7b66e80 Merge: 5582f3c1b14e9 3fb1f62f80a1d Author: Dave Airlie Date: Thu Feb 23 09:32:10 2023 +1000 Merge tag 'drm-misc-next-fixes-2023-02-21' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Short summary of fixes pull: Fixes GEM SHMEM locking and generic fbdev hotplugging. Constifies dma_buf kobj type. Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/Y/S6tu3gdQ0VizR+@linux-uq9g commit d8ca6dbb8de7923fcfb18e0b0b123f37c3225519 Merge: 9fc2f99030b55 1683ed16ff1a5 Author: Linus Torvalds Date: Wed Feb 22 14:47:20 2023 -0800 Merge tag 'nfs-for-6.3-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "New Features: - Convert the read and write paths to use folios Bugfixes and Cleanups: - Fix tracepoint state manager flag printing - Fix disabling swap files - Fix NFSv4 client identifier sysfs path in the documentation - Don't clear NFS_CAP_COPY if server returns NFS4ERR_OFFLOAD_DENIED - Treat GETDEVICEINFO errors as a layout failure - Replace kmap_atomic() calls with kmap_local_page() - Constify sunrpc sysfs kobj_type structures" * tag 'nfs-for-6.3-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (25 commits) fs/nfs: Replace kmap_atomic() with kmap_local_page() in dir.c pNFS/filelayout: treat GETDEVICEINFO errors as layout failure Documentation: Fix sysfs path for the NFSv4 client identifier nfs42: do not fail with EIO if ssc returns NFS4ERR_OFFLOAD_DENIED NFS: fix disabling of swap SUNRPC: make kobj_type structures constant nfs4trace: fix state manager flag printing NFS: Remove unnecessary check in nfs_read_folio() NFS: Improve tracing of nfs_wb_folio() NFS: Enable tracing of nfs_invalidate_folio() and nfs_launder_folio() NFS: fix up nfs_release_folio() to try to release the page NFS: Clean up O_DIRECT request allocation NFS: Fix up nfs_vm_page_mkwrite() for folios NFS: Convert nfs_write_begin/end to use folios NFS: Remove unused function nfs_wb_page() NFS: Convert buffered writes to use folios NFS: Convert the function nfs_wb_page() to use folios NFS: Convert buffered reads to use folios NFS: Add a helper nfs_wb_folio() NFS: Convert the remaining pagelist helper functions to support folios ... commit 9fc2f99030b55027d84723b0dcbbe9f7e21b9c6c Merge: 25ac8c12ff788 4b471a8b847b8 Author: Linus Torvalds Date: Wed Feb 22 14:21:40 2023 -0800 Merge tag 'nfsd-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "Two significant security enhancements are part of this release: - NFSD's RPC header encoding and decoding, including RPCSEC GSS and gssproxy header parsing, has been overhauled to make it more memory-safe. - Support for Kerberos AES-SHA2-based encryption types has been added for both the NFS client and server. This provides a clean path for deprecating and removing insecure encryption types based on DES and SHA-1. AES-SHA2 is also FIPS-140 compliant, so that NFS with Kerberos may now be used on systems with fips enabled. In addition to these, NFSD is now able to handle crossing into an auto-mounted mount point on an exported NFS mount. A number of fixes have been made to NFSD's server-side copy implementation. RPC metrics have been converted to per-CPU variables. This helps reduce unnecessary cross-CPU and cross-node memory bus traffic, and significantly reduces noise when KCSAN is enabled" * tag 'nfsd-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (121 commits) NFSD: Clean up nfsd_symlink() NFSD: copy the whole verifier in nfsd_copy_write_verifier nfsd: don't fsync nfsd_files on last close SUNRPC: Fix occasional warning when destroying gss_krb5_enctypes nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open NFSD: fix problems with cleanup on errors in nfsd4_copy nfsd: fix race to check ls_layouts nfsd: don't hand out delegation on setuid files being opened for write SUNRPC: Remove ->xpo_secure_port() SUNRPC: Clean up the svc_xprt_flags() macro nfsd: remove fs/nfsd/fault_inject.c NFSD: fix leaked reference count of nfsd4_ssc_umount_item nfsd: clean up potential nfsd_file refcount leaks in COPY codepath nfsd: zero out pointers after putting nfsd_files on COPY setup error SUNRPC: Fix whitespace damage in svcauth_unix.c nfsd: eliminate __nfs4_get_fd nfsd: add some kerneldoc comments for stateid preprocessing functions nfsd: eliminate find_deleg_file_locked nfsd: don't take nfsd4_copy ref for OP_OFFLOAD_STATUS SUNRPC: Add encryption self-tests ... commit 25ac8c12ff7886e3d9b99feb85c53302a3cc5556 Merge: 232dd599068ff d3ca9f7aeba79 Author: Linus Torvalds Date: Wed Feb 22 14:17:27 2023 -0800 Merge tag '6.3-rc-ksmbd-fixes' of git://git.samba.org/ksmbd Pull ksmbd server updates from Steve French: - Fix for memory leak - Two important fixes for frame length checks (which are also now stricter) - four minor cleanup fixes - Fix to clarify ksmbd/Kconfig to indent properl - Conversion of the channel list and rpc handle list to xarrays * tag '6.3-rc-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: fix possible memory leak in smb2_lock() ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length ksmbd: fix wrong data area length for smb2 lock request ksmbd: Fix parameter name and comment mismatch ksmbd: Fix spelling mistake "excceed" -> "exceeded" ksmbd: update Kconfig to note Kerberos support and fix indentation ksmbd: Remove duplicated codes ksmbd: fix typo, syncronous->synchronous ksmbd: Implements sess->rpc_handle_list as xarray ksmbd: Implements sess->ksmbd_chann_list as xarray commit 232dd599068ff228a29a4a1a6ab81e6b55198bb0 Merge: b7ee88128242b 2b188a2cfc4d8 Author: Linus Torvalds Date: Wed Feb 22 14:11:54 2023 -0800 Merge tag 'zonefs-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs updates from Damien Le Moal: - Reorganize zonefs code to split file related operations to a new fs/zonefs/file.c file (me) - Modify zonefs to use dynamically allocated inodes and dentries (using the inode and dentry caches) instead of statically allocating everything on mount. This saves a significant amount of memory for very large zoned block devices with 10s of thousands of zones (me) - Make zonefs_sb_ktype a const struct kobj_type (Thomas) * tag 'zonefs-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: make kobj_type structure constant zonefs: Cache zone group directory inodes zonefs: Dynamically create file inodes when needed zonefs: Separate zone information from inode information zonefs: Reduce struct zonefs_inode_info size zonefs: Simplify IO error handling zonefs: Reorganize code commit b7ee88128242b3460b0016a7e42207c9799f73b7 Merge: 28e335208ce90 c1b0c3cfcbad2 Author: Linus Torvalds Date: Wed Feb 22 14:00:53 2023 -0800 Merge tag 'gfs2-v6.2-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Fix a race when disassociating inodes from their glocks after iget_failed() - On filesystems with a block size smaller than the page size, make sure that ->writepages() writes out all buffers of journaled inodes - Various improvements to the way the delete workqueue is drained to speed up unmount and prevent leftover inodes. At unmount time, evict deleted inodes cooperatively across the cluster to avoid unnecessary timeouts - Various minor cleanups and fixes * tag 'gfs2-v6.2-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Convert gfs2_page_add_databufs to folios gfs2: jdata writepage fix gfs2: Improve gfs2_make_fs_rw error handling Revert "GFS2: free disk inode which is deleted by remote node -V2" gfs2: Evict inodes cooperatively gfs2: Flush delete work before shrinking inode cache gfs2: Cease delete work during unmount gfs2: Add SDF_DEACTIVATING super block flag gfs2: check gl_object in rgrp glops gfs2: Split the two kinds of glock "delete" work gfs2: Move delete workqueue into super block gfs2: Get rid of GLF_PENDING_DELETE flag gfs2: Make glock lru list scanning safer gfs2: Clean up gfs2_scan_glock_lru gfs2: Improve gfs2_upgrade_iopen_glock comment gfs2: gl_object races fix commit 28e335208ce90c2cca9990543983b97ccc66f302 Merge: d151e8bea1509 dd07bb8b6baf2 Author: Linus Torvalds Date: Wed Feb 22 13:55:51 2023 -0800 Merge tag 'xfs-6.3-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Darrick Wong: "There's a couple of bug fixes, some cleanups for inconsistent variable names and reduction of struct boxing and unboxing in the logging code. More work is pending, which will begin reworking allocation group lifetimes and finally replace confusing indirect calls to the allocator with actual ... function calls. But I want to let that experience another week of testing. Summary: - Eliminate repeated boxing and unboxing of log item parameters - Clean up some confusing variable names in the log item code - Fix a deadlock when doing unwritten extent conversion that causes a bmbt split when there are sustained memory shortages and the worker pool runs out of worker threads - Fix the panic_mask debug knob not being able to trigger on verifier errors - Constify kobj_type objects" * tag 'xfs-6.3-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: revert commit 8954c44ff477 xfs: make kobj_type structures constant xfs: allow setting full range of panic tags xfs: don't use BMBT btree split workers for IO completion xfs: fix confusing variable names in xfs_refcount_item.c xfs: pass refcount intent directly through the log intent code xfs: fix confusing variable names in xfs_rmap_item.c xfs: pass rmap space mapping directly through the log intent code xfs: fix confusing xfs_extent_item variable names xfs: pass xfs_extent_free_item directly through the log intent code xfs: fix confusing variable names in xfs_bmap_item.c xfs: pass the xfs_bmbt_irec directly through the log intent code xfs: use strscpy() to instead of strncpy() commit d151e8bea1509a6f72a8929882d9ecb66e936b09 Merge: 8762069330316 471859f57d425 Author: Linus Torvalds Date: Wed Feb 22 13:50:13 2023 -0800 Merge tag 'iomap-6.3-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: "This is mostly rearranging things to make life easier for gfs2, nothing all that mindblowing for this release. - Change when the iomap page_done function is called so that we still have a locked folio in the success case. This fixes a writeback race in gfs2 - Change when the iomap page_prepare function is called so that gfs2 can recover from OOM scenarios more gracefully - Rename the iomap page_ops to folio_ops, since they operate on folios now" * tag 'iomap-6.3-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: Rename page_ops to folio_ops iomap: Rename page_prepare handler to get_folio iomap: Add __iomap_get_folio helper iomap/gfs2: Get page in page_prepare handler iomap: Add iomap_get_folio helper iomap: Rename page_done handler to put_folio iomap/gfs2: Unlock and put folio in page_done handler iomap: Add __iomap_put_folio helper commit 8762069330316392331e693befd8a5b632833618 Merge: 6861eaf79155f 833f7d4819a88 Author: Linus Torvalds Date: Wed Feb 22 13:41:41 2023 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (ufs, lpfc, qla2xxx, libsas). The major core change is a rework to remove the two helpers around scsi_execute_cmd and use it as the only submission interface along with other minor fixes and updates" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (142 commits) scsi: ufs: core: Fix an error handling path in ufshcd_read_desc_param() scsi: ufs: core: Fix device management cmd timeout flow scsi: aic94xx: Add missing check for dma_map_single() scsi: smartpqi: Replace one-element array with flexible-array member scsi: mpt3sas: Fix a memory leak scsi: qla2xxx: Remove the unused variable wwn scsi: ufs: core: Fix kernel-doc syntax scsi: ufs: core: Add hibernation callbacks scsi: snic: Fix memory leak with using debugfs_lookup() scsi: ufs: core: Limit DMA alignment check scsi: Documentation: Correct spelling scsi: Documentation: Correct spelling scsi: target: Documentation: Correct spelling scsi: aacraid: Allocate cmd_priv with scsicmd scsi: ufs: qcom: dt-bindings: Add SM8550 compatible string scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5 scsi: ufs: qcom: fix platform_msi_domain_free_irqs() reference scsi: ufs: core: Enable DMA clustering scsi: ufs: exynos: Fix the maximum segment size scsi: ufs: exynos: Fix DMA alignment for PAGE_SIZE != 4096 ... commit 6861eaf79155f0a5544ff989754159f806795c31 Merge: f0b2769a0185c 8844f0aa8dc42 Author: Linus Torvalds Date: Wed Feb 22 13:35:51 2023 -0800 Merge tag 'ata-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ATA updates from Damien Le Moal: - Small cleanup of the pata_octeon driver to drop a useless platform callback (Uwe) - Simplify ata_scsi_cmd_error_handler() code using the fact that ap->ops->error_handler is NULL most of the time (Wenchao) - Several patches improving libata error handling. This is in preparation for supporting the command duration limits (CDL) feature. The changes allow handling corner cases of ATA NCQ errors which do not happen with regular drives but will be triggered with CDL drives (Niklas) - Simplify the qc_fill_rtf operation (me) - Improve SCSI command translation for REPORT_SUPPORTED_OPERATION_CODES command (me) - Cleanup of libata FUA handling. This falls short of enabling FUA for ATA drives that support it by default as there were concerns that old drives would break. The series however fixes several issues with the FUA support to ensure that FUA is reported as being supported only for drives that can handle all possible write cases (NCQ and non-NCQ). A check in the block layer is also added to ensure that we never see read FUA commands (current behavior) (me) - Several patches to move the old PARIDE (parallel port IDE) driver to libata as pata_parport. Given that this driver also needs protocol modules, the driver code resides in its own pata_parport directoy under drivers/ata (Ondrej) * tag 'ata-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_parport: Fix ida_alloc return value error check drivers/block: Move PARIDE protocol modules to drivers/ata/pata_parport drivers/block: Remove PARIDE core and high-level protocols ata: pata_parport: add driver (PARIDE replacement) ata: libata: exclude FUA support for known buggy drives ata: libata: Fix FUA handling in ata_build_rw_tf() ata: libata: cleanup fua support detection ata: libata: Rename and cleanup ata_rwcmd_protocol() ata: libata: Introduce ata_ncq_supported() block: add a sanity check for non-write flush/fua bios ata: libata-scsi: improve ata_scsiop_maint_in() ata: libata-scsi: do not overwrite SCSI ML and status bytes ata: libata: move NCQ related ATA_DFLAGs ata: libata: respect successfully completed commands during errors ata: libata: read the shared status for successful NCQ commands once ata: libata: simplify qc_fill_rtf port operation interface ata: scsi: rename flag ATA_QCFLAG_FAILED to ATA_QCFLAG_EH ata: libata-eh: Cleanup ata_scsi_cmd_error_handler() ata: octeon: Drop empty platform remove function commit f0b2769a0185ccf84842a795b5587afc37274c3d Merge: 23064dfe088e0 d695e44157c8d Author: Linus Torvalds Date: Wed Feb 22 13:21:31 2023 -0800 Merge tag 'for-6.3/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Fix DM cache target to free background tracker work items, otherwise slab BUG will occur when kmem_cache_destroy() is called. - Improve 2 of DM's shrinker names to reflect their use. - Fix the DM flakey target to not corrupt the zero page. Fix dm-flakey on 32-bit hughmem systems by using bvec_kmap_local instead of page_address. Also, fix logic used when imposing the "corrupt_bio_byte" feature. - Stop using WQ_UNBOUND for DM verity target's verify_wq because it causes significant Android latencies on ARM64 (and doesn't show real benefit on other architectures). - Add negative check to catch simple case of a DM table referencing itself. More complex scenarios that use intermediate devices to self-reference still need to be avoided/handled in userspace. - Fix DM core's resize to only send one uevent instead of two. This fixes a race with udev, that if udev wins, will cause udev to miss uevents (which caused premature unmount attempts by systemd). - Add cond_resched() to workqueue functions in DM core, dn-thin and dm-cache so that their loops aren't the cause of unintended cpu scheduling fairness issues. - Fix all of DM's checkpatch errors and warnings (famous last words). Various other small cleanups. * tag 'for-6.3/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (62 commits) dm: remove unnecessary (void*) conversion in event_callback() dm ioctl: remove unnecessary check when using dm_get_mdptr() dm ioctl: assert _hash_lock is held in __hash_remove dm cache: add cond_resched() to various workqueue loops dm thin: add cond_resched() to various workqueue loops dm: add cond_resched() to dm_wq_requeue_work() dm: add cond_resched() to dm_wq_work() dm sysfs: make kobj_type structure constant dm: update targets using system workqueues to use a local workqueue dm: remove flush_scheduled_work() during local_exit() dm clone: prefer kvmalloc_array() dm: declare variables static when sensible dm: fix suspect indent whitespace dm ioctl: prefer strscpy() instead of strlcpy() dm: avoid void function return statements dm integrity: change macros min/max() -> min_t/max_t where appropriate dm: fix use of sizeof() macro dm: avoid 'do {} while(0)' loop in single statement macros dm log: avoid multiple line dereference dm log: avoid trailing semicolon in macro ... commit 23064dfe088e0926e3fc0922f118866dc1564405 Merge: 77bc1bb18463a 6c6cd913accd7 Author: Linus Torvalds Date: Wed Feb 22 12:55:44 2023 -0800 Merge tag 'audit-pr-20230220' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit update from Paul Moore: "Just a single audit patch, and even that patch is pretty trivial as it only updates the mailing list entry in the MAINTAINERS file" * tag 'audit-pr-20230220' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: update the mailing list in MAINTAINERS commit 77bc1bb18463a7fa3742accaddf31845655edf66 Merge: 291a73a8e63a6 ccfd889acb06e Author: Linus Torvalds Date: Wed Feb 22 12:52:59 2023 -0800 Merge tag 'Smack-for-6.3' of https://github.com/cschaufler/smack-next Pull smack update from Casey Schaufler: "One fix for resetting CIPSO labeling" * tag 'Smack-for-6.3' of https://github.com/cschaufler/smack-next: smackfs: Added check catlen commit 291a73a8e63a6a00f2f6863989cd1652a1f5b9a1 Merge: 67e2dcff8b219 1c1ea1c3e21d5 Author: Linus Torvalds Date: Wed Feb 22 12:46:07 2023 -0800 Merge tag 'landlock-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock updates from Mickaël Salaün: "This improves documentation, and makes some tests more flexible to be able to run on systems without overlayfs or with Yama restrictions" * tag 'landlock-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: MAINTAINERS: Update Landlock repository selftests/landlock: Test ptrace as much as possible with Yama selftests/landlock: Skip overlayfs tests when not supported landlock: Explain file descriptor access rights commit 67e2dcff8b21923d48f5ca835773b2f005389e69 Merge: 70756b49be4ea 4958db3245fa6 Author: Linus Torvalds Date: Wed Feb 22 12:36:25 2023 -0800 Merge tag 'integrity-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity update from Mimi Zohar: "One doc and one code cleanup, and two bug fixes" * tag 'integrity-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: Introduce MMAP_CHECK_REQPROT hook ima: Align ima_file_mmap() parameters with mmap_file LSM hook evm: call dump_security_xattr() in all cases to remove code duplication ima: fix ima_delete_rules() kernel-doc warning ima: return IMA digest value only when IMA_COLLECTED flag is set ima: fix error handling logic when file measurement failed commit bf9bec4cb3a401a14c24a7ef937d3c26aff9ad60 Merge: 5b7c4cabbb65f 6338a94d5ab42 Author: Alexei Starovoitov Date: Wed Feb 22 12:34:51 2023 -0800 Merge branch 'bpf: Allow reads from uninit stack' Eduard Zingerman says: ==================== This patch-set modifies BPF verifier to accept programs that read from uninitialized stack locations, but only if executed in privileged mode. This provides significant verification performance gains: 30% to 70% less processed states for big number of test programs. The reason for performance gains comes from treating STACK_MISC and STACK_INVALID as compatible, when cached state is compared to current state in verifier.c:stacksafe(). The change should not affect safety, because any value read from STACK_MISC location has full binary range (e.g. 0x00-0xff for byte-sized reads). Details and measurements are provided in the description for the patch #1. The change was suggested by Andrii Nakryiko, the initial patch was created by Alexei Starovoitov. The discussion could be found at [1]. Changes v1 -> v2 (v1 available at [2]): - Calls to helper functions now convert STACK_INVALID to STACK_MISC (suggested by Andrii); - The test case progs/test_global_func10.c is updated to expect new error message. Before recent commit [3] exact content of error messages was not verified for this test. - Replaced incorrect '//'-style comments in test case asm blocks by '/*...*/'-style comments in order to fix compilation issues; - Changed the tag from "Suggested-By" to "Co-developed-by" for Alexei on patch #1, please let me know if this is appropriate use of the tag. [1] https://lore.kernel.org/bpf/CAADnVQKs2i1iuZ5SUGuJtxWVfGYR9kDgYKhq3rNV+kBLQCu7rA@mail.gmail.com/ [2] https://lore.kernel.org/bpf/20230216183606.2483834-1-eddyz87@gmail.com/ [3] 95ebb376176c ("selftests/bpf: Convert test_global_funcs test to test_loader framework") ==================== Signed-off-by: Alexei Starovoitov commit 6338a94d5ab42a94e96ea36edc5f7df1fe73e68e Author: Eduard Zingerman Date: Sun Feb 19 22:04:27 2023 +0200 selftests/bpf: Tests for uninitialized stack reads Three testcases to make sure that stack reads from uninitialized locations are accepted by verifier when executed in privileged mode: - read from a fixed offset; - read from a variable offset; - passing a pointer to stack to a helper converts STACK_INVALID to STACK_MISC. Signed-off-by: Eduard Zingerman Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20230219200427.606541-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 6715df8d5d24655b9fd368e904028112b54c7de1 Author: Eduard Zingerman Date: Sun Feb 19 22:04:26 2023 +0200 bpf: Allow reads from uninit stack This commits updates the following functions to allow reads from uninitialized stack locations when env->allow_uninit_stack option is enabled: - check_stack_read_fixed_off() - check_stack_range_initialized(), called from: - check_stack_read_var_off() - check_helper_mem_access() Such change allows to relax logic in stacksafe() to treat STACK_MISC and STACK_INVALID in a same way and make the following stack slot configurations equivalent: | Cached state | Current state | | stack slot | stack slot | |------------------+------------------| | STACK_INVALID or | STACK_INVALID or | | STACK_MISC | STACK_SPILL or | | | STACK_MISC or | | | STACK_ZERO or | | | STACK_DYNPTR | This leads to significant verification speed gains (see below). The idea was suggested by Andrii Nakryiko [1] and initial patch was created by Alexei Starovoitov [2]. Currently the env->allow_uninit_stack is allowed for programs loaded by users with CAP_PERFMON or CAP_SYS_ADMIN capabilities. A number of test cases from verifier/*.c were expecting uninitialized stack access to be an error. These test cases were updated to execute in unprivileged mode (thus preserving the tests). The test progs/test_global_func10.c expected "invalid indirect read from stack" error message because of the access to uninitialized memory region. This error is no longer possible in privileged mode. The test is updated to provoke an error "invalid indirect access to stack" because of access to invalid stack address (such error is not verified by progs/test_global_func*.c series of tests). The following tests had to be removed because these can't be made unprivileged: - verifier/sock.c: - "sk_storage_get(map, skb->sk, &stack_value, 1): partially init stack_value" BPF_PROG_TYPE_SCHED_CLS programs are not executed in unprivileged mode. - verifier/var_off.c: - "indirect variable-offset stack access, max_off+size > max_initialized" - "indirect variable-offset stack access, uninitialized" These tests verify that access to uninitialized stack values is detected when stack offset is not a constant. However, variable stack access is prohibited in unprivileged mode, thus these tests are no longer valid. * * * Here is veristat log comparing this patch with current master on a set of selftest binaries listed in tools/testing/selftests/bpf/veristat.cfg and cilium BPF binaries (see [3]): $ ./veristat -e file,prog,states -C -f 'states_pct<-30' master.log current.log File Program States (A) States (B) States (DIFF) -------------------------- -------------------------- ---------- ---------- ---------------- bpf_host.o tail_handle_ipv6_from_host 349 244 -105 (-30.09%) bpf_host.o tail_handle_nat_fwd_ipv4 1320 895 -425 (-32.20%) bpf_lxc.o tail_handle_nat_fwd_ipv4 1320 895 -425 (-32.20%) bpf_sock.o cil_sock4_connect 70 48 -22 (-31.43%) bpf_sock.o cil_sock4_sendmsg 68 46 -22 (-32.35%) bpf_xdp.o tail_handle_nat_fwd_ipv4 1554 803 -751 (-48.33%) bpf_xdp.o tail_lb_ipv4 6457 2473 -3984 (-61.70%) bpf_xdp.o tail_lb_ipv6 7249 3908 -3341 (-46.09%) pyperf600_bpf_loop.bpf.o on_event 287 145 -142 (-49.48%) strobemeta.bpf.o on_event 15915 4772 -11143 (-70.02%) strobemeta_nounroll2.bpf.o on_event 17087 3820 -13267 (-77.64%) xdp_synproxy_kern.bpf.o syncookie_tc 21271 6635 -14636 (-68.81%) xdp_synproxy_kern.bpf.o syncookie_xdp 23122 6024 -17098 (-73.95%) -------------------------- -------------------------- ---------- ---------- ---------------- Note: I limited selection by states_pct<-30%. Inspection of differences in pyperf600_bpf_loop behavior shows that the following patch for the test removes almost all differences: - a/tools/testing/selftests/bpf/progs/pyperf.h + b/tools/testing/selftests/bpf/progs/pyperf.h @ -266,8 +266,8 @ int __on_event(struct bpf_raw_tracepoint_args *ctx) } if (event->pthread_match || !pidData->use_tls) { - void* frame_ptr; - FrameData frame; + void* frame_ptr = 0; + FrameData frame = {}; Symbol sym = {}; int cur_cpu = bpf_get_smp_processor_id(); W/o this patch the difference comes from the following pattern (for different variables): static bool get_frame_data(... FrameData *frame ...) { ... bpf_probe_read_user(&frame->f_code, ...); if (!frame->f_code) return false; ... bpf_probe_read_user(&frame->co_name, ...); if (frame->co_name) ...; } int __on_event(struct bpf_raw_tracepoint_args *ctx) { FrameData frame; ... get_frame_data(... &frame ...) // indirectly via a bpf_loop & callback ... } SEC("raw_tracepoint/kfree_skb") int on_event(struct bpf_raw_tracepoint_args* ctx) { ... ret |= __on_event(ctx); ret |= __on_event(ctx); ... } With regards to value `frame->co_name` the following is important: - Because of the conditional `if (!frame->f_code)` each call to __on_event() produces two states, one with `frame->co_name` marked as STACK_MISC, another with it as is (and marked STACK_INVALID on a first call). - The call to bpf_probe_read_user() does not mark stack slots corresponding to `&frame->co_name` as REG_LIVE_WRITTEN but it marks these slots as BPF_MISC, this happens because of the following loop in the check_helper_call(): for (i = 0; i < meta.access_size; i++) { err = check_mem_access(env, insn_idx, meta.regno, i, BPF_B, BPF_WRITE, -1, false); if (err) return err; } Note the size of the write, it is a one byte write for each byte touched by a helper. The BPF_B write does not lead to write marks for the target stack slot. - Which means that w/o this patch when second __on_event() call is verified `if (frame->co_name)` will propagate read marks first to a stack slot with STACK_MISC marks and second to a stack slot with STACK_INVALID marks and these states would be considered different. [1] https://lore.kernel.org/bpf/CAEf4BzY3e+ZuC6HUa8dCiUovQRg2SzEk7M-dSkqNZyn=xEmnPA@mail.gmail.com/ [2] https://lore.kernel.org/bpf/CAADnVQKs2i1iuZ5SUGuJtxWVfGYR9kDgYKhq3rNV+kBLQCu7rA@mail.gmail.com/ [3] git@github.com:anakryiko/cilium.git Suggested-by: Andrii Nakryiko Co-developed-by: Alexei Starovoitov Signed-off-by: Eduard Zingerman Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/r/20230219200427.606541-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 38892c48e54760be41f16519456d868e14933789 Author: Andy Shevchenko Date: Wed Feb 15 18:50:30 2023 +0200 rtc: rx6110: Remove unused of_gpio,h of_gpio.h provides a single function, which is not used in this driver. Remove unused header. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230215165030.83621-1-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit 668a2abf91143caa226b3ccd0bd4d79ea85935a6 Author: Ard Biesheuvel Date: Fri Feb 17 15:23:38 2023 +0100 rtc: efi: Avoid spamming the log on RTC read failure There are cases where the EFI runtime services may end up in a funny state, e.g., due to a crash in the variable services, and this affects other EFI runtime services as well. That means that, even though GetTime() should not return an error, there are cases where it might, and there is no point in logging such an occurrence multiple times. This works around an issue where user space -apparently- keeps hitting on /dev/rtc if it fails to read the h/w clock, resulting in a tsunami of log spam and a non-responsive system as a result. Cc: Pierre Gondois Cc: Alexandru Elisei Link: https://lore.kernel.org/all/Y2o1hdZK9GGDVJsS@monolith.localdoman/ Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20230217142338.1444509-1-ardb@kernel.org Signed-off-by: Alexandre Belloni commit 303eac653a181be59674920725142cfbdd5ba4cd Author: Andy Shevchenko Date: Tue Jan 10 16:08:06 2023 +0200 rtc: isl12022: sort header inclusion alphabetically Sort header inclusion alphabetically for better maintenance. Signed-off-by: Andy Shevchenko Acked-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20230110140806.87432-6-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit 9bb1e189d7d2c3838938efcc497333803b946081 Author: Andy Shevchenko Date: Tue Jan 10 16:08:05 2023 +0200 rtc: isl12022: Join string literals back For easy grepping on debug purposes join string literals back in the messages. While at it, drop __func__ parameter from unique enough dev_dbg() message as Dynamic Debug can retrieve this at run time. Signed-off-by: Andy Shevchenko Acked-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20230110140806.87432-5-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit c8ae2735cb3d28892fd734804b60e5abf1f6fa91 Author: Andy Shevchenko Date: Tue Jan 10 16:08:04 2023 +0200 rtc: isl12022: Drop unneeded OF guards and of_match_ptr() Drop unneeded OF guards and of_match_ptr(). This allows use of the driver with other types of firmware such as ACPI PRP0001 based probing. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230110140806.87432-4-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit 93219a4fb8bdf279f749b5eef40bef1bbe805fc3 Author: Andy Shevchenko Date: Tue Jan 10 16:08:03 2023 +0200 rtc: isl12022: Explicitly use __le16 type for ISL12022_REG_TEMP_L We are reading 10-bit value in a 16-bit register in LE format. Make this explicit by using __le16 type for it and corresponding conversion function. Signed-off-by: Andy Shevchenko Acked-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20230110140806.87432-3-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit f525b210e9d4dcefb88594d50e426068e62840f4 Author: Andy Shevchenko Date: Tue Jan 10 16:08:02 2023 +0200 rtc: isl12022: Get rid of unneeded private struct isl12022 First of all, the struct rtc_device pointer is kept in the managed resources, no need to keep it outside (no users in the driver). Second, replace private struct isl12022 with a regmap. Signed-off-by: Andy Shevchenko Acked-by: Rasmus Villemoes Link: https://lore.kernel.org/r/20230110140806.87432-2-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit 70756b49be4ea8bf36a664322df6e7e89895fa60 Merge: bc009f9382bd0 cc29eadef921f Author: Linus Torvalds Date: Wed Feb 22 12:00:20 2023 -0800 Merge tag 'docs-6.3' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "It has been a moderately calm cycle for documentation; the significant changes include: - Some significant additions to the memory-management documentation - Some improvements to navigation in the HTML-rendered docs - More Spanish and Chinese translations ... and the usual set of typo fixes and such" * tag 'docs-6.3' of git://git.lwn.net/linux: (68 commits) Documentation/watchdog/hpwdt: Fix Format Documentation/watchdog/hpwdt: Fix Reference Documentation: core-api: padata: correct spelling docs/mm: Physical Memory: correct spelling in reference to CONFIG_PAGE_EXTENSION docs: Use HTML comments for the kernel-toc SPDX line docs: Add more information to the HTML sidebar Documentation: KVM: Update AMD memory encryption link printk: Document that CONFIG_BOOT_PRINTK_DELAY required for boot_delay= Documentation: userspace-api: correct spelling Documentation: sparc: correct spelling Documentation: driver-api: correct spelling Documentation: admin-guide: correct spelling docs: add workload-tracing document to admin-guide docs/admin-guide/mm: remove useless markup docs/mm: remove useless markup docs/mm: Physical Memory: remove useless markup docs/sp_SP: Add process magic-number translation docs: ftrace: always use canonical ftrace path Doc/damon: fix the data path error dma-buf: Add "dma-buf" to title of documentation ... commit 3eb5d0f26f4ea604e83ca499a72c0d33638f4765 Merge: 90fb1a36528b5 9574d57f2d433 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:32 2023 -0600 Merge branch 'pci/misc' - Drop bogus kernel-doc marker in pci_endpoint_test.c (Randy Dunlap) - Fix epf_ntb_mw_bar_clear() kernel-doc (Yang Yingliang) - Constify struct kobj_type pci_slot_ktype (Thomas Weißschuh) * pci/misc: PCI: hv: Drop duplicate PCI_MSI dependency PCI/sysfs: Constify struct kobj_type pci_slot_ktype PCI: endpoint: pci-epf-vntb: Add epf_ntb_mw_bar_clear() num_mws kernel-doc misc: pci_endpoint_test: Drop initial kernel-doc marker commit 90fb1a36528b5a52583c49483ca597beeb7f5435 Merge: 69ed52bec3926 f492edb40b548 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:31 2023 -0600 Merge branch 'pci/controller/vmd' - Add pci_enable_link_state() to allow drivers to enable ASPM link state (Michael Bottini) - Add quirk to enable all ASPM link states and program LTR for devices below VMD (David E. Box) * pci/controller/vmd: PCI: vmd: Add quirk to configure PCIe ASPM and LTR PCI: vmd: Create feature grouping for client products PCI: vmd: Use PCI_VDEVICE in device list PCI/ASPM: Add pci_enable_link_state() commit 69ed52bec39265072a5efe8fb851d3831129bec2 Merge: 0784d32c3dec4 6f5e55dfcb061 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:31 2023 -0600 Merge branch 'pci/controller/uniphier' - Clean up uniphier-ep reg, clocks, resets, and their names (Kunihiko Hayashi) * pci/controller/uniphier: dt-bindings: PCI: uniphier-ep: Clean up reg, clocks, resets, and their names commit 0784d32c3dec4f0c78674857010fd2a72d52f210 Merge: b237474a90c1c ddc10938e08cd Author: Bjorn Helgaas Date: Wed Feb 22 13:47:31 2023 -0600 Merge branch 'pci/controller/switchtec' - Return -EFAULT instead of unrelated codes for copy_to_user() errors (Bjorn Helgaas) * pci/controller/switchtec: PCI: switchtec: Return -EFAULT for copy_to_user() errors PCI: switchtec: Simplify switchtec_dma_mrpc_isr() commit b237474a90c1c4cd8391bb8dbb5f32a82867a8da Merge: 7cfd342bd1914 f356132229b18 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:30 2023 -0600 Merge branch 'pci/controller/qcom' - Add DT compatible for qcom MSM8998 (Krzysztof Kozlowski) - Unify qcom MSM8996 and MSM8998 clock orderings (Krzysztof Kozlowski) - Correct qcom,perst-regs (Krzysztof Kozlowski) - Add qcom SM8350 DT binding and driver support (Dmitry Baryshkov) - Add qcom_pcie_host_deinit() so the PHY is powered off and regulators and clocks are disabled on late host-init errors (Johan Hovold) - Add IPQ8074 Gen3 port DT binding and driver support (the Gen2 port was already supported) (Robert Marko) * pci/controller/qcom: PCI: qcom: Add IPQ8074 Gen3 port support dt-bindings: PCI: qcom: Add IPQ8074 Gen3 port dt-bindings: PCI: qcom: Sort compatibles alphabetically PCI: qcom: Fix host-init error handling PCI: qcom: Add SM8350 support dt-bindings: PCI: qcom: Add SM8350 dt-bindings: PCI: qcom-ep: Correct qcom,perst-regs dt-bindings: PCI: qcom: Unify MSM8996 and MSM8998 clock order dt-bindings: PCI: qcom: Add MSM8998 specific compatible dt-bindings: PCI: qcom: Add oneOf to compatible match commit 7cfd342bd1914758f6d1b806d0415ab177a6a37a Merge: 181a60a0ee881 b3574f579ece2 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:30 2023 -0600 Merge branch 'pci/controller/mvebu' - Mark mvebu driver as broken (Pali Rohár) * pci/controller/mvebu: PCI: mvebu: Mark driver as BROKEN commit 181a60a0ee881d54f3e100efff842c4d076f7419 Merge: a9cd360245af1 0cb2a8f3456ff Author: Bjorn Helgaas Date: Wed Feb 22 13:47:29 2023 -0600 Merge branch 'pci/controller/mt7621' - Delay PHY initialization to make boots reliable for ZBT WE1326 and ZBT WF3526-P and some Netgear models (Sergio Paracuellos) * pci/controller/mt7621: PCI: mt7621: Delay phy ports initialization commit a9cd360245af188f29e3b5cd1d1c7a60f8249b1f Merge: 5256d493809d4 c435669a41dd4 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:29 2023 -0600 Merge branch 'pci/controller/imx6' - Add i.MX8MM, i.MX8MQ, i.MX8MP endpoint mode DT binding and driver support (Richard Zhu) * pci/controller/imx6: PCI: imx6: Add i.MX8MP PCIe EP support PCI: imx6: Add i.MX8MM PCIe EP support PCI: imx6: Add i.MX8MQ PCIe EP support PCI: imx6: Add i.MX PCIe EP mode support misc: pci_endpoint_test: Add i.MX8 PCIe EP device support dt-bindings: imx6q-pcie: Add i.MX8MP PCIe EP mode compatible string dt-bindings: imx6q-pcie: Add i.MX8MQ PCIe EP mode compatible string dt-bindings: imx6q-pcie: Add i.MX8MM PCIe EP mode compatible string commit 5256d493809d4e741ba813989e392ed96d1e236a Merge: 33abd97c34ff2 939fbcd568fd2 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:29 2023 -0600 Merge branch 'pci/controller/dwc' - Release previously-requested DW eDMA IRQs if request_irq() fails (Serge Semin) - Convert DW eDMA linked-list (ll) and data target (dt) from CPU-relative addresses to PCI bus addresses (Serge Semin) - Fix missing src/dst address for interleaved transfers (Serge Semin) - Enforce the DW eDMA restriction that interleaved transfers must increment src and dst addresses (Serge Semin) - Fix some invalid interleaved transfer semantics (Serge Semin) - Convert CPU-relative addresses to PCI bus addresses for eDMA engine (Serge Semin) - Drop chancnt initialization from dw-edma-core, since it is managed by the dmaengine core, e.g., in dma_async_device_channel_register() (Serge Semin) - Clean up bogus casting of debugfs_entries.reg addresses (Serge Semin) - Ignore debugfs file/directory creation errors (Serge Semin) - Allocate debugfs entries from the heap to prepare for multi-eDMA platforms (Serge Semin) - Simplify and rework register accessors to remove another obstacle to multi-eDMA platforms (Serge Semin) - Consolidate eDMA read/write channels in a single dma_device to simplify, better reflect the hardware design, and avoid a debugfs complaint (Serge Semin) - Move eDMA-specific debugfs nodes into existing dmaengine subdirectory (Serge Semin) - Fix a readq_ch() truncation from 64 to 32 bits (Serge Semin) - Use existing readq()/writeq rather than hand-coding new ones (Serge Semin) - Drop unnecessary data target region allocation in favor of existing dw_edma_chip members (Serge Semin) - Use parent device in eDMA controller name to prepare for multi-eDMA platforms (Serge Semin) - In addition to the existing MMIO accessors for linked list entries, add support for ioremapped entries for use by eDMA in Root Ports or local Endpoints (Serge Semin) - Convert DW_EDMA_PCIE so it depends on DW_EDMA instead of selecting it (Serge Semin) - Allow DWC drivers to set streaming DMA masks larger than 32 bits; previously both streaming and coherent DMA were limited to 32 bits because some PCI devices only support coherent 32-bit DMA for MSI (Serge Semin) - Set 64-bit streaming and coherent DMA mask for the bt1 driver (Serge Semin) - Add DW Root Port and Endpoint controller support for eDMA (Serge Semin) * pci/controller/dwc: PCI: dwc: Add Root Port and Endpoint controller eDMA engine support PCI: bt1: Set 64-bit DMA mask PCI: dwc: Restrict only coherent DMA mask for MSI address allocation dmaengine: dw-edma: Prepare dw_edma_probe() for builtin callers dmaengine: dw-edma: Depend on DW_EDMA instead of selecting it dmaengine: dw-edma: Add mem-mapped LL-entries support dmaengine: dw-edma: Skip cleanup procedure if no private data found dmaengine: dw-edma: Replace chip ID number with device name dmaengine: dw-edma: Drop DT-region allocation dmaengine: dw-edma: Use non-atomic io-64 methods dmaengine: dw-edma: Fix readq_ch() return value truncation dmaengine: dw-edma: Use DMA engine device debugfs subdirectory dmaengine: dw-edma: Join read/write channels into a single device dmaengine: dw-edma: Move eDMA data pointer to debugfs node descriptor dmaengine: dw-edma: Simplify debugfs context CSRs init procedure dmaengine: dw-edma: Rename debugfs dentry variables to 'dent' dmaengine: dw-edma: Convert debugfs descs to being heap-allocated dmaengine: dw-edma: Add dw_edma prefix to debugfs nodes descriptor dmaengine: dw-edma: Stop checking debugfs_create_*() return value dmaengine: dw-edma: Drop unnecessary debugfs reg casts dmaengine: dw-edma: Drop chancnt initialization dmaengine: dw-edma: Add PCI bus address getter to the remote EP glue driver dmaengine: dw-edma: Add CPU to PCI bus address translation dmaengine: dw-edma: Fix invalid interleaved xfers semantics dmaengine: dw-edma: Don't permit non-inc interleaved xfers dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers dmaengine: dw-edma: Convert ll/dt phys address to PCI bus/DMA address dmaengine: dw-edma: Release requested IRQs on failure dmaengine: Fix dma_slave_config.dst_addr description commit 33abd97c34ff233f21355d411bea6709f4d5ad75 Merge: 191b41018856d f5edd8715e2ea Author: Bjorn Helgaas Date: Wed Feb 22 13:47:28 2023 -0600 Merge branch 'pci/endpoint' - Convert dra7xx to threaded IRQ handler (Manivannan Sadhasivam) - Move tegra194 dw_pcie_ep_linkup() to threaded IRQ handler (Manivannan Sadhasivam) - Add a separate lock for the endpoint pci_epf list to avoid deadlock while running callbacks (Manivannan Sadhasivam) - Use callbacks instead of notifier chains to signal events from EPC to EPF drivers (Manivannan Sadhasivam) - Use link_up() callback in place of LINK_UP notifier (Manivannan Sadhasivam) * pci/endpoint: PCI: endpoint: Use link_up() callback in place of LINK_UP notifier PCI: endpoint: Use callback mechanism for passing events from EPC to EPF PCI: endpoint: Use a separate lock for protecting epc->pci_epf list PCI: tegra194: Move dw_pcie_ep_linkup() to threaded IRQ handler PCI: dra7xx: Use threaded IRQ handler for "dra7xx-pcie-main" IRQ commit 191b41018856da2bcd6f3f3ab0b2eb1c7a9f8585 Merge: ebdce9e3d085f a2b9b123ccac9 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:28 2023 -0600 Merge branch 'pci/virtualization' - Avoid FLR for AMD FCH AHCI adapters to avoid a hardware defect (Damien Le Moal) - Add ACS quirk for Wangxun NICs that don't allow peer-to-peer between functions, but don't advertise an ACS Capability (Mengyuan Lou) * pci/virtualization: PCI: Add ACS quirk for Wangxun NICs PCI: Avoid FLR for AMD FCH AHCI adapters commit ebdce9e3d085f7891463fd0046e04201d1604d0d Merge: 0b7af1ddcf62e 9d8ba74a181b1 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:27 2023 -0600 Merge branch 'pci/resource' - Realign space as required by bridge windows after dividing it up (Mika Westerberg) - Account for space required by other devices on the bus before distributing it all to bridges (Mika Westerberg) - Distribute spare resources to root bus devices as well as to other hotplug bridges (Mika Westerberg) - Fix bug that dropped root bus resources that end at zero, e.g., a host bridge that leads only to bus 00 (Geert Uytterhoeven) * pci/resource: PCI: Fix dropping valid root bus resources with .end = zero PCI: Distribute available resources for root buses, too PCI: Take other bus devices into account when distributing resources PCI: Align extra resources for hotplug bridges properly commit 0b7af1ddcf62e6f497b26e967a65dad5d46d79ae Merge: 08a67024a0b4a 53b54ad074de1 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:27 2023 -0600 Merge branch 'pci/reset' - Always observe reset delay when waking devices from D3cold, e.g., after system sleep, regardless of whether we're allowed to runtime-suspend to D3cold (Lukas Wunner) - Unify reset and resume delays to wait for downstream devices after a bridge reset (Lukas Wunner) - Wait for downstream devices after a DPC-induced bridge reset (Lukas Wunner) * pci/reset: PCI/DPC: Await readiness of secondary bus after reset PCI: Unify delay handling for reset and resume PCI/PM: Observe reset delay irrespective of bridge_d3 commit 08a67024a0b4a18b2fad8d5b3670f02e9b24ebfb Merge: 7260675a52a67 8133844a8f243 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:26 2023 -0600 Merge branch 'pci/pm' - Account for _S0W when deciding whether to put bridges in D3 to avoid missing hotplug events (Rafael J. Wysocki) * pci/pm: PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3() commit 7260675a52a67f3c44036306bf25f6947c294a02 Merge: 881766fe0d4a8 6606f4c3c48c7 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:26 2023 -0600 Merge branch 'pci/p2pdma' - Annotate RCU dereference (Logan Gunthorpe) * pci/p2pdma: PCI/P2PDMA: Annotate RCU dereference commit 881766fe0d4a8db9d885864afdfe44a5ea8d2c53 Merge: 72d083a60a864 f98954b293d0a Author: Bjorn Helgaas Date: Wed Feb 22 13:47:25 2023 -0600 Merge branch 'pci/kbuild' - Remove MODULE_LICENSE from boolean drivers so they don't look like modules so modprobe will complain about them (Nick Alcock) * pci/kbuild: PCI: Remove MODULE_LICENSE so boolean drivers don't look like modules commit 72d083a60a864ad75059b63dc4a2f7107eb85d0a Merge: fec93576f7dc8 ea0b5aa5f184c Author: Bjorn Helgaas Date: Wed Feb 22 13:47:25 2023 -0600 Merge branch 'pci/iov' - Enlarge virtfn sysfs name buffer to prevent buffer overflow (Alexey V. Vissarionov) * pci/iov: PCI/IOV: Enlarge virtfn sysfs name buffer commit fec93576f7dc80756c6f142a3312ddc4dac5db9a Merge: a17613298f5df 74ff8864cc842 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:25 2023 -0600 Merge branch 'pci/hotplug' - Add quirk to work around Qualcomm hardware defect in Command Completed signaling (Manivannan Sadhasivam) - Remove locking to allow devices to be marked as disconnected immediately instead of waiting for concurrent bind/unbind to complete (Lukas Wunner) * pci/hotplug: PCI: hotplug: Allow marking devices as disconnected during bind/unbind PCI: pciehp: Add Qualcomm quirk for Command Completed erratum commit a17613298f5df5bfaf66b403ed082da93abc05ce Merge: f900e4441c657 6fffbc7ae1373 Author: Bjorn Helgaas Date: Wed Feb 22 13:47:24 2023 -0600 Merge branch 'pci/enumeration' - Implement portdrv .shutdown() method that calls service driver .remove() methods (which disables interrupt generation as required by .shutdown()), but doesn't disable bus mastering (which hangs on Loongson LS7A because of a hardware defect) (Huacai Chen) - Prevent MRRS increases for devices below Loongson LS7A to avoid hardware limitations (Huacai Chen) - Ignore devices with a firmware (DT/ACPI) node that says the device is disabled (Rob Herring) * pci/enumeration: PCI: Honor firmware's device disabled status PCI: loongson: Add more devices that need MRRS quirk PCI: loongson: Prevent LS7A MRRS increases PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown commit f900e4441c657d976bf875fc83e7a3b8e4d4b45a Merge: 1b929c02afd37 6b985af556e5c Author: Bjorn Helgaas Date: Wed Feb 22 13:47:24 2023 -0600 Merge branch 'pci/aer' - Configure ECRC only if AER is native (Vidya Sagar) - Stop enabling device error reporting for the downstream hierarchy when the AER service driver probes a Root Port because we've already done that when enumerating those downstream devices (Bjorn Helgaas) * pci/aer: PCI/AER: Remove redundant Device Control Error Reporting Enable PCI/AER: Configure ECRC only if AER is native commit 939fbcd568fd294034c96edc92ff5b9de1a5fce8 Author: Serge Semin Date: Fri Jan 13 20:14:09 2023 +0300 PCI: dwc: Add Root Port and Endpoint controller eDMA engine support Since the DW eDMA core now supports eDMA controllers embedded in locally accessible DW PCIe Root Ports and Endpoints, register these controllers when possible. To do that the DW PCIe core driver needs to perform some preparations first. First of all, it needs to find the eDMA controller CSRs base address, whether they are accessible over the Port Logic or iATU unrolled space. Afterwards it can try to auto-detect the eDMA controller availability and number of read/write channels. If none are found the procedure silently returns without error. Secondly, the platform is supposed to provide either combined or per-channel IRQ signals. If no valid IRQs set is found, the procedure returns without error to be backward compatible with platforms where DW PCIe controllers have eDMA but lack the IRQ description. Finally, before actually probing the eDMA device we need to allocate LLP items buffers. After that the DW eDMA can be registered. If registration is successful, a message regarding the number of detected Read/Write eDMA channels will be printed to the system as is done for the iATU settings. Note: the DW PCI controller driver (either host or endpoint mode) is currently always built-in, so if the DW eDMA core is built as a module (CONFIG_DW_EDMA=m), eDMA controllers will not be registered even if the dw-edma module is later loaded. Link: https://lore.kernel.org/r/20230113171409.30470-28-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Acked-by: Vinod Koul commit 68373f2c0fd82bc66ec51e2db27ca0fe141210fd Author: Serge Semin Date: Fri Jan 13 20:14:08 2023 +0300 PCI: bt1: Set 64-bit DMA mask The DW PCIe Root Port IP core is synthesized with the 64-bit AXI address bus. Since the device is also equipped with the eDMA engine, explicitly set the device DMA mask so DMA engine clients can allocate data buffers anywhere in the 64-bit memory space. Link: https://lore.kernel.org/r/20230113171409.30470-27-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas commit 6c784e21b3da735bd2c3dba73acf9b2c033564fa Author: Serge Semin Date: Fri Jan 13 20:14:07 2023 +0300 PCI: dwc: Restrict only coherent DMA mask for MSI address allocation The MSI target address must be in the lowest 4GB memory to support PCI peripherals without 64-bit MSI support. Since the allocation is done from DMA coherent memory, set only the coherent DMA mask, leaving the streaming DMA mask alone. Thus streaming DMA operations will work with no artificial limitations. It will be specifically useful for the eDMA-capable controllers so the corresponding DMA engine clients would map the DMA buffers with no need for SWIOTLB for buffers allocated above 4GB. Add a brief comment about the reason allocating the MSI target address below 4GB. Link: https://lore.kernel.org/r/20230113171409.30470-26-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Robin Murphy commit 3bc0f149405e07c7e59985a24ce96db83973f8d7 Author: Serge Semin Date: Fri Jan 13 20:14:06 2023 +0300 dmaengine: dw-edma: Prepare dw_edma_probe() for builtin callers When CONFIG_DW_EDMA=m, dw_edma_probe() is built as a module. Previously edma.h declared it as extern, but the implementation isn't available for builtin callers. A subsequent commit will add calls from dw_pcie_host_init() and dw_pcie_ep_init(), which can only be built-in. Make it safe for such builtin callers to call dw_edma_probe() by using IS_REACHABLE() to define a stub when CONFIG_DW_EDMA=m. When CONFIG_DW_EDMA=m, these builtin callers will fail to detect and register eDMA devices, so eDMA won't be usable even if the dw-edma module is loaded. [bhelgaas: split to separate patch, commit log] Link: https://lore.kernel.org/r/20230113171409.30470-25-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Vinod Koul commit acf994151dd9a59d544b5d3c196b64f326d94c52 Author: Serge Semin Date: Wed Jan 25 15:24:33 2023 -0600 dmaengine: dw-edma: Depend on DW_EDMA instead of selecting it Kconfig "select" is discouraged for visible symbols like DW_EDMA because it makes it possible to set DW_EDMA even if DW_EDMA depends on things that are not set (see Documentation/kbuild/kconfig-language.txt). Convert DW_EDMA_PCIE so it depends on DW_EDMA instead of selecting it. There will likely be several future drivers that depend on DW_EDMA, so this uses "if DW_EDMA" to enclose them all rather than repeating "depends on DW_EDMA" for each. [bhelgaas: split to separate patch, commit log] Link: https://lore.kernel.org/r/20230113171409.30470-25-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Vinod Koul commit 16f8a08643b6d63d2e8252ddaa9e17e2408a2531 Author: Serge Semin Date: Fri Jan 13 20:14:05 2023 +0300 dmaengine: dw-edma: Add mem-mapped LL-entries support Currently the DW eDMA driver only supports the linked lists memory allocated locally with respect to the remote eDMA engine setup. It means the linked lists will be accessible by the CPU via the MMIO space only. If eDMA is embedded into the DW PCIe Root Ports or local Endpoints (which support will be added in subsequent commits) the linked lists are supposed to be allocated in the CPU memory. In that case the LL-entries can be directly accessed, while the former case implies using the MMIO accessors for that. In order to have both cases supported by the driver, the dw_edma_region descriptor should be fixed to contain the MMIO-backed and just memory-based virtual addresses. The linked lists initialization procedure will use one of them depending on the eDMA device nature. If the eDMA engine is embedded into the local DW PCIe Root Port/Endpoint controllers, the list entries will be directly accessed by referencing the corresponding structure fields. Otherwise the MMIO accessors usage will be preserved. Link: https://lore.kernel.org/r/20230113171409.30470-24-Sergey.Semin@baikalelectronics.ru Signed-off-by: Serge Semin Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Vinod Koul commit bc009f9382bd0704273c9a0c1cbf72020bbbe1f7 Merge: 241ed6ab74f94 befb28f2676a6 Author: Linus Torvalds Date: Wed Feb 22 11:41:37 2023 -0800 Merge tag 'for-linus-6.3-1' of https://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "Small fixes to the SMBus IPMI and IPMB driver. Nothing big, cleanups, fixing names, and one small deviation from the specification fixed" * tag 'for-linus-6.3-1' of https://github.com/cminyard/linux-ipmi: ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' ipmi:ssif: Add a timer between request retries ipmi:ssif: Remove rtc_us_timer ipmi_ssif: Rename idle state and check ipmi:ssif: resend_msg() cannot fail commit 241ed6ab74f94eb3d64ee6b950cd8091b1213225 Merge: 6c71297eaf713 5720a18baa468 Author: Linus Torvalds Date: Wed Feb 22 11:31:09 2023 -0800 Merge tag 'hwmon-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Infineon TDA38640 Voltage Regulator - NXP MC34VR500 PMIC - GXP fan controller - MPQ7932 Power Management IC New chip or board support added to existing drivers: - it87: IT87952E; also other cleanup/improvements - intel-m10-bmc-hwmon: N6000 - pmbus/max16601: MAX16600 - aquacomputer_d5next: Aquacomputer Aquastream Ultimate, Aquacomputer Poweradjust 3, Aquacomputer Aquaero - nct6775: Support for B650/B660/X670 ASUS boards - oxp-sensors: AYANEO AIR and AIR Pro Other notable changes: - Various kernel documentation fixes - Various devicetree bindings fixes - Explicitly deprecated [devm_]hwmon_device_register_with_groups - ftsteutates: Support for fanX_fault and other cleanup - ltc2945: Support for setting shunt resistor and other cleanup/fixes - coretemp: Avoid RDMSR interrupts to isolated CPUs, and simplify platform device handling ... and various other minor cleanups and fixes" * tag 'hwmon-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (66 commits) hwmon: Deprecate [devm_]hwmon_device_register_with_groups hwmon: (mlxreg-fan) Return zero speed for broken fan hwmon: (gxp-fan-ctrl) use devm_platform_get_and_ioremap_resource() hwmon: (aquacomputer_d5next) Add support for Aquacomputer Aquastream Ultimate hwmon: (aquacomputer_d5next) Add support for Aquacomputer Poweradjust 3 hwmon: (iio_hwmon) use dev_err_probe hwmon: intel-m10-bmc-hwmon: Add N6000 sensors Docs/hwmon/index: Add missing SPDX License Identifier hwmon: (it87) Updated documentation for recent updates to it87 hwmon: (it87) Add new chipset IT87952E hwmon: (it87) Allow multiple chip IDs for force_id hwmon: (it87) Add chip_id in some info message hwmon: (it87) List full chip model name hwmon: (it87) Disable configuration exit for certain chips hwmon: (it87) Allow disabling exiting of configuration mode Documentation: hwmon: correct spelling hwmon: (pmbus/max16601) Add support for MAX16600 hwmon: (ltc2945) Allow setting shunt resistor hwmon: (ltc2945) Handle error case in ltc2945_value_store hwmon: (ltc2945) Add devicetree match table ... commit 6c71297eaf713ece684a367ce9aff06069d715b9 Merge: d5176cdbf64ce 904e28c6de083 Author: Linus Torvalds Date: Wed Feb 22 11:24:42 2023 -0800 Merge tag 'for-linus-2023022201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Benjamin Tissoires: - HID-BPF infrastructure: this allows to start using HID-BPF. Note that the mechanism to ship HID-BPF program through the kernel tree is still not implemented yet (but is planned). This should be a no-op for 99% of users. Also we are gaining kselftests for the HID tree (Benjamin Tissoires) - Some UAF fixes in workers when using uhid (Pietro Borrello & Benjamin Tissoires) - Constify hid_ll_driver (Thomas Weißschuh) - Allow more custom IIO sensors through HID (Philipp Jungkamp) - Logitech HID++ fixes for scroll wheel, protocol and debug (Bastien Nocera) - Some new device support: Steam Deck (Vicki Pfau), UClogic (José Expósito), Logitech G923 Xbox Edition steering wheel (Walt Holman), EVision keyboards (Philippe Valembois) - other assorted code cleanups and fixes * tag 'for-linus-2023022201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (99 commits) HID: mcp-2221: prevent UAF in delayed work hid: bigben_probe(): validate report count HID: asus: use spinlock to safely schedule workers HID: asus: use spinlock to protect concurrent accesses HID: bigben: use spinlock to safely schedule workers HID: bigben_worker() remove unneeded check on report_field HID: bigben: use spinlock to protect concurrent accesses HID: logitech-hidpp: Add myself to authors HID: logitech-hidpp: Retry commands when device is busy HID: logitech-hidpp: Add more debug statements HID: Add support for Logitech G923 Xbox Edition steering wheel HID: logitech-hidpp: Add Signature M650 HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk HID: logitech-hidpp: Don't restart communication if not necessary HID: logitech-hidpp: Add constants for HID++ 2.0 error codes Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures" HID: logitech-hidpp: Hard-code HID++ 1.0 fast scroll support HID: i2c-hid: goodix: Add mainboard-vddio-supply dt-bindings: HID: i2c-hid: goodix: Add mainboard-vddio-supply HID: i2c-hid: goodix: Stop tying the reset line to the regulator ... commit 3ef9fec011d471a259935f2e2ff58ab12886d683 Author: Arnaldo Carvalho de Melo Date: Wed Feb 22 16:17:36 2023 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes from these csets: 8c29f01654053258 ("x86/sev: Add SEV-SNP guest feature negotiation support") That cause no changes to tooling: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after $ Just silences this perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/msr-index.h' differs from latest version at 'arch/x86/include/asm/msr-index.h' diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Cc: Borislav Petkov (AMD) Cc: Nikunj A Dadhania Link: https://lore.kernel.org/lkml/Y%2FZrNvtcijPWagCp@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit 6153c44392b04ff2da1e9aa82ba87da9ab9a0fc1 Author: Johan Hovold Date: Tue Feb 21 11:14:27 2023 +0100 drm/msm/adreno: fix runtime PM imbalance at unbind A recent commit moved enabling of runtime PM from adreno_gpu_init() to adreno_load_gpu() (called on first open()), which means that unbind() may now be called with runtime PM disabled in case the device was never opened in between. Make sure to only forcibly suspend and disable runtime PM at unbind() in case runtime PM has been enabled to prevent a disable count imbalance. This specifically avoids leaving runtime PM disabled when the device is later opened after a successful bind: msm_dpu ae01000.display-controller: [drm:adreno_load_gpu [msm]] *ERROR* Couldn't power up the GPU: -13 Fixes: 4b18299b3365 ("drm/msm/adreno: Defer enabling runpm until hw_init()") Reported-by: Bjorn Andersson Link: https://lore.kernel.org/lkml/20230203181245.3523937-1-quic_bjorande@quicinc.com Cc: stable@vger.kernel.org # 6.0 Signed-off-by: Johan Hovold Patchwork: https://patchwork.freedesktop.org/patch/523549/ Link: https://lore.kernel.org/r/20230221101430.14546-2-johan+linaro@kernel.org Signed-off-by: Rob Clark commit 32e7083429d46f29080626fe387ff90c086b1fbe Author: Dmitry Baryshkov Date: Tue Feb 14 05:09:56 2023 +0300 drm/msm/a5xx: fix context faults during ring switch The rptr_addr is set in the preempt_init_ring(), which is called from a5xx_gpu_init(). It uses shadowptr() to set the address, however the shadow_iova is not yet initialized at that time. Move the rptr_addr setting to the a5xx_preempt_hw_init() which is called after setting the shadow_iova, getting the correct value for the address. Fixes: 8907afb476ac ("drm/msm: Allow a5xx to mark the RPTR shadow as privileged") Suggested-by: Rob Clark Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/522640/ Link: https://lore.kernel.org/r/20230214020956.164473-5-dmitry.baryshkov@linaro.org Signed-off-by: Rob Clark commit b4fb748f0b734ce1d2e7834998cc599fcbd25d67 Author: Dmitry Baryshkov Date: Tue Feb 14 05:09:55 2023 +0300 drm/msm/a5xx: fix the emptyness check in the preempt code Quoting Yassine: ring->memptrs->rptr is never updated and stays 0, so the comparison always evaluates to false and get_next_ring always returns ring 0 thinking it isn't empty. Fix this by calling get_rptr() instead of reading rptr directly. Reported-by: Yassine Oudjana Fixes: b1fc2839d2f9 ("drm/msm: Implement preemption for A5XX targets") Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/522642/ Link: https://lore.kernel.org/r/20230214020956.164473-4-dmitry.baryshkov@linaro.org Signed-off-by: Rob Clark commit 141f66ebbfa17cc7e2075f06c50107da978c965b Author: Dmitry Baryshkov Date: Tue Feb 14 05:09:54 2023 +0300 drm/msm/a5xx: fix highest bank bit for a530 A530 has highest bank bit equal to 15 (like A540). Fix values written to REG_A5XX_RB_MODE_CNTL and REG_A5XX_TPL1_MODE_CNTL registers. Fixes: 1d832ab30ce6 ("drm/msm/a5xx: Add support for Adreno 508, 509, 512 GPUs") Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/522639/ Link: https://lore.kernel.org/r/20230214020956.164473-3-dmitry.baryshkov@linaro.org Signed-off-by: Rob Clark commit a7a4c19c36de1e4b99b06e4060ccc8ab837725bc Author: Dmitry Baryshkov Date: Tue Feb 14 05:09:53 2023 +0300 drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register Rather than writing CP_PREEMPT_ENABLE_GLOBAL twice, follow the vendor kernel and set CP_PREEMPT_ENABLE_LOCAL register instead. a5xx_submit() will override it during submission, but let's get the sequence correct. Fixes: b1fc2839d2f9 ("drm/msm: Implement preemption for A5XX targets") Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/522638/ Link: https://lore.kernel.org/r/20230214020956.164473-2-dmitry.baryshkov@linaro.org Signed-off-by: Rob Clark commit 4cd15a3e8b36a94c4afa6af064ebe09d387ae034 Author: Douglas Anderson Date: Thu Feb 2 10:48:43 2023 -0800 drm/msm/a6xx: Make GPU destroy a bit safer If, for whatever reason, we're trying process adreno_runtime_resume() at the same time that a6xx_destroy() is running then things can go boom. Specifically adreno_runtime_resume() will eventually call a6xx_pm_resume() and that may try to resume the gmu. Let's grab the GMU lock as we're destroying the GMU. That will solve the race because a6xx_pm_resume() grabs the same lock. That makes the access of `gmu->initialized` in a6xx_gmu_resume() safe. We'll also return an error code in a6xx_gmu_resume() if we see that `gmu->initialized` was false. If this happens we'll bail out of the rest of a6xx_pm_resume(), which is good because the rest of that function is also not good to do if we're racing with a6xx_destroy(). Signed-off-by: Douglas Anderson Patchwork: https://patchwork.freedesktop.org/patch/521232/ Link: https://lore.kernel.org/r/20230202104822.1.I0e49003bf4dd1dead9be4a29dbee41f3b1236e48@changeid Signed-off-by: Rob Clark commit 796762f0506077c4f048b4eb05de2f587f488bce Author: Thomas Zimmermann Date: Wed Feb 22 13:37:12 2023 +0100 drm/msm: Fix possible uninitialized access in fbdev Do not run drm_fb_helper_unprepare() if fbdev allocation fails. Avoids access to an uninitialized pointer. Original bug report is at [1]. Reported-by: kernel test robot Signed-off-by: Thomas Zimmermann Fixes: 3fb1f62f80a1 ("drm/fb-helper: Remove drm_fb_helper_unprepare() from drm_fb_helper_fini()") Link: https://lore.kernel.org/oe-kbuild-all/202302220810.9dymwCQ8-lkp@intel.com/ # 1 Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/523715/ Link: https://lore.kernel.org/r/20230222123712.5049-1-tzimmermann@suse.de Signed-off-by: Rob Clark commit 8a86f213f4426f19511a16d886871805b35c3acf Author: Rob Clark Date: Wed Feb 15 15:50:48 2023 -0800 drm/msm: Fix potential invalid ptr free The error path cleanup expects that chain and syncobj are either NULL or valid pointers. But post_deps was not allocated with __GFP_ZERO. Fixes: ab723b7a992a ("drm/msm: Add syncobj support.") Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Reviewed-by: Dmitry Osipenko Patchwork: https://patchwork.freedesktop.org/patch/523051/ Link: https://lore.kernel.org/r/20230215235048.1166484-1-robdclark@gmail.com commit 92dd0575729a423aa5524d89055e34295152a2dd Merge: dbd7a2a941b8c a66f1efcf748f Author: Rob Clark Date: Wed Feb 22 11:20:41 2023 -0800 Merge tag 'drm-msm-fixes-2023-01-16' into msm-fixes Back-merge of previous cycles msm-fixes for kexec fix (to avoid merge conflict) Signed-off-by: Rob Clark commit d5176cdbf64ce7d4eebf339205f17c23118e9f72 Merge: 17bbc46fc9d51 099f37a539e61 Author: Linus Torvalds Date: Wed Feb 22 11:05:56 2023 -0800 Merge tag 'pinctrl-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Nothing special, notably a lot of new Qualcomm hardware is supported, a RISC-V reference SoC and then some cleanups both in code and device tree bindings. Core changes: - Add PINCTRL_PINFUNCTION() macro and use it in several drivers New drivers: - New driver for the StarFive JH7110 SoC "sys" and "aon" (always-on) pin controllers. (RISC-V.) - New subdriver for the Qualcomm QDU1000/QRU1000 SoC pin controller - New subdrivers for the Qualcomm SM8550 SoC and LPASS pin controllers - New subdriver for the Qualcomm SA8775P SoC pin controller - New subdriver for the Qualcomm IPQ5332 SoC pin controller - New (trivial) support for Qualcomm PM8550 and PMR735D PMIC pin control - New subdriver for the Mediatek MT7981 SoC pin controller Improvements: - Several cleanups and refactorings to the Intel drivers - Add 4KOhm bias support to the Intel driver - Use the NOIRQ_SYSTEM_SLEEP_PM_OPS for the AT91 driver - Support general purpose clocks in the Qualcomm MSM8226 SoC - Several conversions to use the new I2C .probe_new() call - Massive clean-up of the Qualcomm Device Tree YAML schemas - Add VIN[45] pins, groups and functions to the Renesas r8a77950 SoC driver" * tag 'pinctrl-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (118 commits) pinctrl: qcom: Add support for i2c specific pull feature pinctrl: starfive: Add StarFive JH7110 aon controller driver pinctrl: starfive: Add StarFive JH7110 sys controller driver dt-bindings: pinctrl: Add StarFive JH7110 aon pinctrl dt-bindings: pinctrl: Add StarFive JH7110 sys pinctrl pinctrl: add mt7981 pinctrl driver dt-bindings: pinctrl: add bindings for MT7981 SoC dt-bindings: pinctrl: rockchip,pinctrl: mark gpio sub nodes of pinctrl as deprecated pinctrl: qcom: Introduce IPQ5332 TLMM driver dt-bindings: pinctrl: qcom: add IPQ5332 pinctrl dt-bindings: pinctrl: qcom: lpass-lpi: correct GPIO name pattern pinctrl: qcom: pinctrl-sm8550-lpass-lpi: add SM8550 LPASS dt-bindings: pinctrl: qcom,sm8550-lpass-lpi-pinctrl: add SM8550 LPASS pinctrl: at91: use devm_kasprintf() to avoid potential leaks dt-bindings: pinctrl: qcom: correct gpio-ranges in examples dt-bindings: pinctrl: qcom,msm8994: correct number of GPIOs dt-bindings: pinctrl: qcom,sdx55: correct GPIO name pattern dt-bindings: pinctrl: qcom,msm8953: correct GPIO name pattern dt-bindings: pinctrl: qcom,sm6375: correct GPIO name pattern and example dt-bindings: pinctrl: qcom,msm8909: correct GPIO name pattern and example ... commit 65eb2867f5bf46023ab42ba8347106870d961cf3 Author: Vojtech Hejsek Date: Thu Feb 16 09:01:15 2023 +0100 ACPI: resource: Skip IRQ override on Asus Expertbook B2402FBA The Asus Expertbook B2502FBA has IRQ 1 described as Active_Low in its ACPI table. However, the kernel overrides this and sets it to Edge_High, which prevents the internal keyboard from working properly. Adding this laptop model to the override_table fixes the issue. Signed-off-by: Vojtech Hejsek Signed-off-by: Rafael J. Wysocki commit 17bbc46fc9d5128756dc9f36063836eaede06b0b Merge: 13e574b4941ee 4827aae061337 Author: Linus Torvalds Date: Wed Feb 22 11:01:17 2023 -0800 Merge tag 'gpio-updates-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "A rather small update, there are no new drivers, just improvements and refactoring in existing ones. Thanks to migrating of several drivers to using generalized APIs and dropping of OF interfaces in favor of using software nodes we're actually removing more code than we're adding. Core GPIOLIB: - drop several OF interfaces after moving a significant part of the code to using software nodes - remove more interfaces referring to the global GPIO numberspace that we're getting rid of - improvements in the gpio-regmap library - add helper for GPIO device reference counting - remove unused APIs - minor tweaks like sorting headers alphabetically Extended support in existing drivers: - add support for Tegra 234 PMC to gpio-tegra186 Driver improvements: - migrate the 104-dio/idi family of drivers to using the regmap-irq API - migrate gpio-i8255 and gpio-mm to the GPIO regmap API - clean-ups in gpio-pca953x - remove duplicate assignments of of_gpio_n_cells in gpio-davinci, gpio-ge, gpio-xilinx, gpio-zevio and gpio-wcd934x - improvements to gpio-pcf857x: implement get/set_multiple callbacks, use generic device properties instead of OF + minor tweaks - fix OF-related header includes and Kconfig dependencies in gpio-zevio - dynamically allocate the GPIO base in gpio-omap - use a dedicated printf specifier for printing fwnode info in gpio-sim - use dev_name() for the GPIO chip label in gpio-vf610 - other minor tweaks and fixes Documentation: - remove mentions of legacy API from comments in various places - convert the DT binding documents to YAML schema for Fujitsu MB86S7x, Unisoc GPIO and Unisoc EIC - document the Unisoc UMS512 controller in DT bindings" * tag 'gpio-updates-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (54 commits) gpio: sim: Use %pfwP specifier instead of calling fwnode API directly gpio: tegra186: remove unneeded loop in tegra186_gpio_init_route_mapping() gpiolib: of: Move enum of_gpio_flags to its only user gpio: mvebu: Use IS_REACHABLE instead of IS_ENABLED for CONFIG_PWM gpio: zevio: Add missing header gpio: Get rid of gpio_to_chip() gpio: pcf857x: Drop unneeded explicit casting gpio: pcf857x: Make use of device properties gpio: pcf857x: Get rid of legacy platform data gpio: rockchip: Do not mention legacy API in the code gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells gpio: zevio: Use proper headers and drop OF_GPIO dependency gpio: zevio: Remove duplicate assignment of of_gpio_n_cells gpio: xilinx: Remove duplicate assignment of of_gpio_n_cells dt-bindings: gpio: Add compatible string for Unisoc UMS512 dt-bindings: gpio: Convert Unisoc EIC controller binding to yaml dt-bindings: gpio: Convert Unisoc GPIO controller binding to yaml gpio: ge: Remove duplicate assignment of of_gpio_n_cells gpio: davinci: Remove duplicate assignment of of_gpio_n_cells gpio: omap: use dynamic allocation of base ... commit 13e574b4941ee1931f8c70f33c3011f74e5fbd30 Merge: 0175ec3a28c69 de82c25dab9ac Author: Linus Torvalds Date: Wed Feb 22 10:53:37 2023 -0800 Merge tag 'spi-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "This has been a fairly quiet release for SPI, though it is likely that the next release will have some big changes as there's some preparatory work for multiple chip select support gone in - the rest of the code is on the list but will need to be rebased onto -rc1. Otherwise there's a couple of new tunables for chip select timings, some new devices and smaller device specific updates and fixes. - Support for configuring the hold and minimum inactive times for chip selects. - Beginnings of support for supporting devices which have multiple chip selects on a single device. - Support for newer Broadcom HSSPI and Intel controllers, Silicon Labs EM3581 and SI3210" * tag 'spi-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (67 commits) spi: dt-bindings: qcom,spi-qcom-qspi: document OPP and power-domains spi: spidev: drop the incorrect notice from Kconfig spi: bcm63xx-hsspi: fix error code in probe spi: bcmbca-hsspi: Fix error code in probe() function spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() spi: intel: Check number of chip selects after reading the descriptor spi: xilinx: add force_irq for QSPI mode spi: spi-st-ssc: convert to DT schema spi: Reorder fields in 'struct spi_transfer' spi: cadence-quadspi: use STIG mode for small reads spi: cadence-quadspi: setup ADDR Bits in cmd reads spi: cadence-quadspi: Add flag for direct mode writes spi: cadence-quadspi: Reset CMD_CTRL Reg on cmd r/w completion MAINTAINERS: Remove file reference for Broadcom Broadband SoC HS SPI driver entry spi: bcm63xx-hsspi: bcmbca-hsspi: fix _be16 type usage MAINTAINERS: Add entry for Broadcom Broadband SoC HS SPI drivers spi: bcmbca-hsspi: Add driver for newer HSSPI controller spi: bcm63xx-hsspi: Disable spi mem dual io read op support spi: spi-mem: Allow controller supporting mem_ops without exec_op spi: bcm63xx-hsspi: Add prepend mode support ... commit 0175ec3a28c695562a08fdccf73f2ec5ed744e2f Merge: 603ac530f1350 7f62cb8861190 Author: Linus Torvalds Date: Wed Feb 22 10:49:32 2023 -0800 Merge tag 'regulator-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This has been a very quiet release for the regulator API: there's one new driver for the Maxim MAX20411, some DT schema conversions and some small tweaks and improvements but really nothing major at all" * tag 'regulator-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (22 commits) regulator: max597x: Align for simple_mfd_i2c driver regulator: max20411: Fix off-by-one for n_voltages setting regulator: max597x: Remove unused variable regulator: tps65219: use generic set_bypass() regulator: s5m8767: Bounds check id indexing into arrays regulator: max77802: Bounds check regulator id against opmode regulator: max20411: Convert to i2c's .probe_new() regulator: scmi: Allow for zero voltage domains regulator: max20411: Directly include bitfield.h regulator: Introduce Maxim MAX20411 Step-Down converter regulator: dt-bindings: Describe Maxim MAX20411 regulator: dt-bindings: qcom-labibb: Allow regulator-common properties regulator: dt-bindings: fixed-regulator: allow gpios property regulator: tps65219: use IS_ERR() to detect an error pointer regulator: mcp16502: add enum MCP16502_REG_HPM description regulator: fixed-helper: use the correct function name in comment regulator: act8945a: fix non-kernel-doc comments dt-bindings: regulators: convert non-smd RPM Regulators bindings to dt-schema regulator: dt-bindings: Convert Fairchild FAN53555 to DT schema regulator: dt-bindings: qcom,usb-vbus-regulator: change node name ... commit 603ac530f13506e6ce5db4ab953ede4d292c5327 Merge: 064d7dcf51a82 40f4b05868101 Author: Linus Torvalds Date: Wed Feb 22 10:42:55 2023 -0800 Merge tag 'regmap-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "A quiet release for regmap: we've seen several cleanups, an update for a change in the MDIO APIs and one small fix" * tag 'regmap-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap-irq: Remove unused mask_invert flag regmap-irq: Remove unused type_invert flag regmap: Reorder fields in 'struct regmap_bus' to save some memory regmap: apply reg_base and reg_downshift for single register ops commit 45dd9bc75d9adc9483f0c7d662ba6e73ed698a0b Author: Randy Dunlap Date: Tue Feb 21 23:33:15 2023 -0800 KVM: SVM: hyper-v: placate modpost section mismatch error modpost reports section mismatch errors/warnings: WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) WARNING: modpost: vmlinux.o: section mismatch in reference: svm_hv_hardware_setup (section: .text) -> (unknown) (section: .init.data) This "(unknown) (section: .init.data)" all refer to svm_x86_ops. Tag svm_hv_hardware_setup() with __init to fix a modpost warning as the non-stub implementation accesses __initdata (svm_x86_ops), i.e. would generate a use-after-free if svm_hv_hardware_setup() were actually invoked post-init. The helper is only called from svm_hardware_setup(), which is also __init, i.e. lack of __init is benign other than the modpost warning. Fixes: 1e0c7d40758b ("KVM: SVM: hyper-v: Remote TLB flush for SVM") Signed-off-by: Randy Dunlap Cc: Vineeth Pillai Cc: Paolo Bonzini Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Reviewed-by: Sean Christopherson Reviewed-by: Vitaly Kuznetsov Message-Id: <20230222073315.9081-1-rdunlap@infradead.org> Signed-off-by: Paolo Bonzini commit 064d7dcf51a82b480e953a15cca47e5df0426502 Merge: f3dd0c53370e7 7933b90b42896 Author: Linus Torvalds Date: Wed Feb 22 10:29:05 2023 -0800 Merge tag 'sound-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "The majority of works in this cycle are about ASoC spread over trees. Most of them are for new devices and cleanups / refactoring works, and not much significant changes are seen in the core side. Below are some highlights: ASoC: - Continued refactoring to move into common helper functions - Lots of DT schema conversons and stylistic nits - Continued work on building out the new SOF IPC4 scheme - Continued work for Intel AVS - New drivers for Awinc AT88395, Infineon PEB2466, Iron Device SMA1303, Mediatek MT8188, Realtek RT712, Renesas IDT821034, Samsung/Tesla FSD SoC I2S, and TI TAS5720A-Q1 ALSA: - A few cleanups to make the remove callbacks to void returns - FireWire refactoring and enhancements - PCM kselftest enhancements" * tag 'sound-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (398 commits) ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks ASoC: soc-ac97: Return correct error codes ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared ASoC: cs35l45: Remove separate namespace for tables ASoC: cs35l45: Remove separate tables module ASoC: soc-ac97: Convert to agnostic GPIO API ASoC: dt-bindings: renesas,rsnd.yaml: drop "dmas/dma-names" from "rcar_sound,ssi" ALSA: hda: cs35l41: Enable Amp High Pass Filter ALSA: hda: cs35l41: Ensure firmware/tuning pairs are always loaded ALSA: hda: cs35l41: Correct error condition handling ASoC: codecs: wcd934x: Use min macro for comparison and assignment ASoC: Intel: Skylake: Fix struct definition ASoC: tlv320adcx140: extend list of supported samplerates ASoC: imx-pcm-rpmsg: Remove unused variable SoC: rt5682s: Disable jack detection interrupt during suspend ASoC: SOF: Intel: hda-dsp: Set streaming flag for d0i3 ASoC: SOF: Intel: Enable d0i3 work for ipc4 ASoC: SOF: ipc4: Wake up dsp core before sending ipc msg ASoC: SOF: Intel: hda-dsp: use set_pm_gate according to ipc version ASoC: SOF: Introduce a new set_pm_gate() IPC PM op ... commit 6ba912f1c081448cf3d1fa9ada9115aae4594ac4 Author: Arnd Bergmann Date: Wed Feb 15 10:14:48 2023 +0100 kcsan: select CONFIG_CONSTRUCTORS Building a kcsan enabled kernel for x86_64 with gcc-11 results in a lot of build warnings or errors without CONFIG_CONSTRUCTORS: x86_64-linux-ld: error: unplaced orphan section `.ctors.65436' from `arch/x86/lib/copy_mc.o' x86_64-linux-ld: error: unplaced orphan section `.ctors.65436' from `arch/x86/lib/cpu.o' x86_64-linux-ld: error: unplaced orphan section `.ctors.65436' from `arch/x86/lib/csum-partial_64.o' x86_64-linux-ld: error: unplaced orphan section `.ctors.65436' from `arch/x86/lib/csum-wrappers_64.o' x86_64-linux-ld: error: unplaced orphan section `.ctors.65436' from `arch/x86/lib/insn-eval.o' x86_64-linux-ld: error: unplaced orphan section `.ctors.65436' from `arch/x86/lib/insn.o' x86_64-linux-ld: error: unplaced orphan section `.ctors.65436' from `arch/x86/lib/misc.o' The same thing has been reported for mips64. I can't reproduce it for any other compiler version, so I don't know if constructors are always required here or if this is a gcc-11 specific implementation detail. I see no harm in always enabling constructors here, and this reliably fixes the build warnings for me. Link: https://lore.kernel.org/lkml/202204181801.r3MMkwJv-lkp@intel.com/T/ Cc: Kees Cook See-also: 3e6631485fae ("vmlinux.lds.h: Keep .ctors.* with .ctors") Signed-off-by: Arnd Bergmann Reviewed-by: Marco Elver Signed-off-by: Paul E. McKenney commit d649c34cb916b015fdcb487e51409fcc5caeca8d Author: Yan Zhao Date: Wed Feb 22 15:49:38 2023 +0800 vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd group->iommufd is not initialized for the iommufd_ctx_put() [20018.331541] BUG: kernel NULL pointer dereference, address: 0000000000000000 [20018.377508] RIP: 0010:iommufd_ctx_put+0x5/0x10 [iommufd] ... [20018.476483] Call Trace: [20018.479214] [20018.481555] vfio_group_fops_unl_ioctl+0x506/0x690 [vfio] [20018.487586] __x64_sys_ioctl+0x6a/0xb0 [20018.491773] ? trace_hardirqs_on+0xc5/0xe0 [20018.496347] do_syscall_64+0x67/0x90 [20018.500340] entry_SYSCALL_64_after_hwframe+0x4b/0xb5 Fixes: 9eefba8002c2 ("vfio: Move vfio group specific code into group.c") Cc: stable@vger.kernel.org Signed-off-by: Yan Zhao Reviewed-by: Jason Gunthorpe Reviewed-by: Yi Liu Link: https://lore.kernel.org/r/20230222074938.13681-1-yan.y.zhao@intel.com Signed-off-by: Alex Williamson commit f3dd0c53370e70c0f9b7e931bbec12916f3bb8cc Author: Linus Torvalds Date: Wed Feb 22 09:52:32 2023 -0800 bpf: add missing header file include Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") built fine on x86-64 and arm64, and that's the extent of my local build testing. It turns out those got the include incidentally through other header files ( in particular), but that was not true of other architectures, resulting in build errors kernel/bpf/core.c: In function ‘___bpf_prog_run’: kernel/bpf/core.c:1913:3: error: implicit declaration of function ‘barrier_nospec’ so just make sure to explicitly include the proper header file to make everybody see it. Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") Reported-by: kernel test robot Reported-by: Viresh Kumar Reported-by: Huacai Chen Tested-by: Geert Uytterhoeven Tested-by: Dave Hansen Acked-by: Alexei Starovoitov Signed-off-by: Linus Torvalds commit 57bebf807e2abcf87d96b9de1266104ee2d8fc2f Author: Pavel Begunkov Date: Wed Feb 22 14:36:51 2023 +0000 io_uring/rsrc: optimise registered huge pages When registering huge pages, internally io_uring will split them into many PAGE_SIZE bvec entries. That's bad for performance as drivers need to eventually dma-map the data and will do it individually for each bvec entry. Coalesce huge pages into one large bvec. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit b000ae0ec2d709046ac1a3c5722fea417f8a067e Author: Pavel Begunkov Date: Wed Feb 22 14:36:50 2023 +0000 io_uring/rsrc: optimise single entry advance Iterating within the first bvec entry should be essentially free, but we use iov_iter_advance() for that, which shows up in benchmark profiles taking up to 0.5% of CPU. Replace it with a hand coded version. Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit edd478269640b360c6f301f2baa04abdda563ef3 Author: Pavel Begunkov Date: Wed Feb 22 14:36:48 2023 +0000 io_uring/rsrc: disallow multi-source reg buffers If two or more mappings go back to back to each other they can be passed into io_uring to be registered as a single registered buffer. That would even work if mappings came from different sources, e.g. it's possible to mix in this way anon pages and pages from shmem or hugetlb. That is not a problem but it'd rather be less prone if we forbid such mixing. Cc: Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe commit 9a1563d1720680bdc1d702486b7b73f51c079b32 Author: Pavel Begunkov Date: Wed Feb 22 14:32:43 2023 +0000 io_uring: remove unused wq_list_merge There are no users of wq_list_merge, kill it. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/5f9ad0301949213230ad9000a8359d591aae615a.1677002255.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 48ba08374e779421ca34bd14b4834aae19fc3e6a Author: Wojciech Lukowicz Date: Sat Feb 18 18:41:41 2023 +0000 io_uring: fix size calculation when registering buf ring Using struct_size() to calculate the size of io_uring_buf_ring will sum the size of the struct and of the bufs array. However, the struct's fields are overlaid with the array making the calculated size larger than it should be. When registering a ring with N * PAGE_SIZE / sizeof(struct io_uring_buf) entries, i.e. with fully filled pages, the calculated size will span one more page than it should and io_uring will try to pin the following page. Depending on how the application allocated the ring, it might succeed using an unrelated page or fail returning EFAULT. The size of the ring should be the product of ring_entries and the size of io_uring_buf, i.e. the size of the bufs array only. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Wojciech Lukowicz Reviewed-by: Gabriel Krisman Bertazi Link: https://lore.kernel.org/r/20230218184141.70891-1-wlukowicz01@gmail.com Signed-off-by: Jens Axboe commit 6bf65a1b3668b04bb6c8126494d00303104eb9e5 Author: Pavel Begunkov Date: Mon Feb 20 14:13:52 2023 +0000 io_uring/rsrc: fix a comment in io_import_fixed() io_import_fixed() supports offsets, but "may not" means the opposite. Replace it with "might not" so the comments rather speaks about possible cases. Signed-off-by: Pavel Begunkov Reviewed-by: Gabriel Krisman Bertazi Link: https://lore.kernel.org/r/5b5f79958456caa6dc532f6205f75f224b232c81.1676902343.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 8d664282a03fec09682f10252d3c785c2513691d Author: Jens Axboe Date: Fri Feb 17 08:27:23 2023 -0700 io_uring: rename 'in_idle' to 'in_cancel' This better describes what it does - it's incremented when the task is currently undergoing a cancelation operation, due to exiting or exec'ing. Signed-off-by: Jens Axboe commit ce8e04f6e5d3b2d14cd00cc4c0b1cc8cbdcf4d12 Author: Jens Axboe Date: Fri Feb 17 08:22:17 2023 -0700 io_uring: consolidate the put_ref-and-return section of adding work We've got a few cases of this, move them to one section and just use gotos to get there. Reduces the text section on both arm64 and x86-64, using gcc-12.2. Signed-off-by: Jens Axboe commit b61b82f81e095fe265b0614045d17b08e6ee5c72 Author: Sangmoon Kim Date: Mon Feb 20 16:34:41 2023 +0900 arm64: pass ESR_ELx to die() of cfi_handler Commit 0f2cb928a154 ("arm64: consistently pass ESR_ELx to die()") caused all callers to pass the ESR_ELx value to die(). For consistency, this patch also adds esr to die() call of cfi_handler. Also, when CFI error occurs, die handlers can use ESR_ELx value. Signed-off-by: Sangmoon Kim Acked-by: Mark Rutland Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20230220073441.2753-1-sangmoon.kim@samsung.com Signed-off-by: Catalin Marinas commit e034b8a18d4badceecb672c58b488bad1e901d95 Author: Thomas Zimmermann Date: Wed Feb 22 13:37:12 2023 +0100 drm/msm: Fix possible uninitialized access in fbdev Do not run drm_fb_helper_unprepare() if fbdev allocation fails. Avoids access to an uninitialized pointer. Original bug report is at [1]. Reported-by: kernel test robot Signed-off-by: Thomas Zimmermann Fixes: 3fb1f62f80a1 ("drm/fb-helper: Remove drm_fb_helper_unprepare() from drm_fb_helper_fini()") Link: https://lore.kernel.org/oe-kbuild-all/202302220810.9dymwCQ8-lkp@intel.com/ # 1 Reviewed-by: Dmitry Baryshkov Link: https://patchwork.freedesktop.org/patch/msgid/20230222123712.5049-1-tzimmermann@suse.de commit 0269680e5eb88f6223c53a8b3138cbfa60ba7657 Author: Mark Brown Date: Thu Feb 9 20:04:07 2023 +0000 arm64/fpsimd: Remove warning for SME without SVE Support for SME without SVE is architecturally valid and has now been tested well enough so let's remove the warning message that is displayed at boot. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230209-arm64-sme-no-sve-v1-1-74eb3df2f878@kernel.org Signed-off-by: Catalin Marinas commit e74a68468062d7ebd8ce17069e12ccc64cc6a58c Author: Peter Collingbourne Date: Tue Feb 14 21:09:11 2023 -0800 arm64: Reset KASAN tag in copy_highpage with HW tags only During page migration, the copy_highpage function is used to copy the page data to the target page. If the source page is a userspace page with MTE tags, the KASAN tag of the target page must have the match-all tag in order to avoid tag check faults during subsequent accesses to the page by the kernel. However, the target page may have been allocated in a number of ways, some of which will use the KASAN allocator and will therefore end up setting the KASAN tag to a non-match-all tag. Therefore, update the target page's KASAN tag to match the source page. We ended up unintentionally fixing this issue as a result of a bad merge conflict resolution between commit e059853d14ca ("arm64: mte: Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags""), which preserved a tag reset for PG_mte_tagged pages which was considered to be unnecessary at the time. Because SW tags KASAN uses separate tag storage, update the code to only reset the tags when HW tags KASAN is enabled. Signed-off-by: Peter Collingbourne Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c Reported-by: "Kuan-Ying Lee (李冠穎)" Cc: # 6.1 Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"") Reviewed-by: Andrey Konovalov Link: https://lore.kernel.org/r/20230215050911.1433132-1-pcc@google.com Signed-off-by: Catalin Marinas commit b48279af636de613e9dd03857d9cadd4beca8e7e Author: Namhyung Kim Date: Sat Feb 18 08:27:24 2023 -0800 perf test: Fix offcpu test prev_state check On Fedora 36, the 'perf record' offcpu profiling tests are failing. It was because the BPF checks the prev task's state being S or D but actually it has more bits set. Let's check the LSB 8 bits for the purpose of offcpu profiling. Reported-by: Arnaldo Carvalho de Melo Signed-off-by: Namhyung Kim Acked-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Ingo Molnar Cc: Jiri Olsa Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230218162724.1292657-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit eb9be8310c58c166f9fae3b71c0ad9d6741b4897 Author: Conor Dooley Date: Fri Feb 10 18:59:45 2023 +0000 RISC-V: add a spin_shadow_stack declaration The patchwork automation reported a sparse complaint that spin_shadow_stack was not declared and should be static: ../arch/riscv/kernel/traps.c:335:15: warning: symbol 'spin_shadow_stack' was not declared. Should it be static? However, this is used in entry.S and therefore shouldn't be static. The same applies to the shadow_stack that this pseudo spinlock is trying to protect, so do like its charge and add a declaration to thread_info.h Signed-off-by: Conor Dooley Fixes: 7e1864332fbc ("riscv: fix race when vmap stack overflow") Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20230210185945.915806-1-conor@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 9b07d27d0fbb7f7441aa986859a0f53ec93a0335 Author: Randy Dunlap Date: Tue Feb 21 23:04:11 2023 -0800 swiotlb: mark swiotlb_memblock_alloc() as __init swiotlb_memblock_alloc() calls memblock_alloc(), which calls (__init) memblock_alloc_try_nid(). However, swiotlb_membloc_alloc() can be marked as __init since it is only called by swiotlb_init_remap(), which is already marked as __init. This prevents a modpost build warning/error: WARNING: modpost: vmlinux.o: section mismatch in reference: swiotlb_memblock_alloc (section: .text) -> memblock_alloc_try_nid (section: .init.text) WARNING: modpost: vmlinux.o: section mismatch in reference: swiotlb_memblock_alloc (section: .text) -> memblock_alloc_try_nid (section: .init.text) This fixes the build warning/error seen on ARM64, PPC64, S390, i386, and x86_64. Fixes: 8d58aa484920 ("swiotlb: reduce the swiotlb buffer size on allocation failure") Signed-off-by: Randy Dunlap Cc: Alexey Kardashevskiy Cc: Christoph Hellwig Cc: iommu@lists.linux.dev Cc: Mike Rapoport Cc: linux-mm@kvack.org Signed-off-by: Christoph Hellwig commit c1855dd0a62b7ead360eb9231fb65c2108efaf47 Author: Bjorn Andersson Date: Wed Feb 22 06:31:10 2023 -0800 clk: qcom: Revert sync_state based clk_disable_unused Revert the postponement of clk_disable_unused() for clock providers that implement sync_state, and the change to drivers implementing this, until agreement on the implementation has been reached. This reverts: 29e31415e14e ("clk: qcom: Remove need for clk_ignore_unused on sc8280xp") 99c0f7d35c4b ("clk: qcom: sdm845: Use generic clk_sync_state_disable_unused callback") 26b36df75166 ("clk: Add generic sync_state callback for disabling unused clocks") Requested-by: Stephen Boyd Signed-off-by: Bjorn Andersson commit fd9a6a13949af81062f4cd04f2c1b28ca5311e71 Author: Javier Carrasco Date: Wed Feb 15 09:18:15 2023 +0100 rtc: pcf85363: add support for the quartz-load-femtofarads property The quartz oscillator load capacitance of the PCF85263 and PCF85363 can be adjusted to 6 pF, 7 pF (default) and 12.5 pF with the CL[1:0] bits in the oscillator control register (address 25h). Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20230215081815.3141776-3-javier.carrasco@wolfvision.net Signed-off-by: Alexandre Belloni commit 1b2f85a8bac67b9909f2ee4be1bc11548a7aeaf3 Author: Javier Carrasco Date: Wed Feb 15 09:18:14 2023 +0100 dt-bindings: rtc: nxp,pcf8563: move pcf85263/pcf85363 to a dedicated binding These Real Time Clocks are managed by the rtc-pcf85363 device driver, which now supports the quartz-load-femtofarads property. Signed-off-by: Javier Carrasco Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230215081815.3141776-2-javier.carrasco@wolfvision.net Signed-off-by: Alexandre Belloni commit 59c54c59974649b2e7bc92faae4a21e2b2408db2 Author: Kathiravan T Date: Mon Jan 30 22:31:53 2023 +0530 dt-bindings: mfd: qcom,tcsr: Add compatible for IPQ5332 Document the qcom,tcsr-ipq5332 compatible. Signed-off-by: Kathiravan T Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230130170155.27266-2-quic_kathirav@quicinc.com commit 43be4f662ae23c38d7f29204a3b635d4c6d61646 Author: Jacky Bai Date: Sun Jan 29 15:08:20 2023 +0800 dt-bindings: mfd: Add NXP BBNSM Add binding for NXP BBNSM(Battery-Backed Non-Secure Module). Signed-off-by: Jacky Bai Reviewed-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230129070823.1945489-2-ping.bai@nxp.com commit 8a15b4daed3d45c9162f23d393a06df2a7be4778 Author: Andreas Kemnade Date: Fri Jan 27 17:58:28 2023 +0100 mfd: ntxec: Add version number for EC in Tolino Vision The EC firmware has a different version number than anything defined until now. Signed-off-by: Andreas Kemnade Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230127165828.3256170-1-andreas@kemnade.info commit 4d83bcbeee12be0842ec99606f08c1c65e986a97 Author: Bernhard Rosenkränzer Date: Wed Jan 25 15:34:57 2023 +0100 dt-bindings: mfd: syscon: Add mt8365-syscfg Document Mediatek mt8365-syscfg Signed-off-by: Bernhard Rosenkränzer Acked-by: Krzysztof Kozlowski Reviewed-by: Matthias Brugger Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230125143503.1015424-4-bero@baylibre.com commit ca78476e4888f1f1caac26c48ec715e546baf432 Author: Arnd Bergmann Date: Thu Jan 5 14:46:13 2023 +0100 mfd: Remove toshiba tmio drivers Four separate mfd drivers are in the "tmio" family, and all of them were used in now-removed PXA machines (eseries, tosa, and hx4700), so the mfd drivers and all its children can be removed as well. Signed-off-by: Arnd Bergmann Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230105134622.254560-19-arnd@kernel.org commit a783c962619271a8b905efad1d89adfec11ae0c8 Author: Alexandre Belloni Date: Tue Feb 14 23:27:53 2023 +0100 rtc: allow rtc_read_alarm without read_alarm callback .read_alarm is not necessary to read the current alarm because it is recorded in the aie_timer and so rtc_read_alarm() will never call rtc_read_alarm_internal() which is the only function calling the callback. Reported-by: Zhipeng Wang Reported-by: Marcel Ziswiler Fixes: 7ae41220ef58 ("rtc: introduce features bitfield") Tested-by: Philippe Schenker Link: https://lore.kernel.org/r/20230214222754.582582-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit 2d433e9c897dcb0b70ef17b536f61430b1e151d4 Author: Alexandre Belloni Date: Tue Feb 14 21:27:15 2023 +0100 rtc: rv3032: add ACPI support The RV-3032 has been assigned the MCRY3032 ACPI ID. Link: https://lore.kernel.org/r/20230214202716.565749-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit b6ef5d4a0295bc0567021c0102d1c66f2ed212a2 Author: Alexandre Belloni Date: Tue Feb 14 21:26:53 2023 +0100 rtc: rv3028: add ACPI support The RV-3028 has been assigned the MCRY3028 ACPI ID. Link: https://lore.kernel.org/r/20230214202653.565647-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit eb7b85853c3866236f9cb378fc68ce5f76efbf9c Author: Jacky Bai Date: Wed Feb 15 10:41:16 2023 +0800 rtc: bbnsm: Add the bbnsm rtc support The BBNSM module includes a real time counter with alarm. Add a RTC driver for this function. Signed-off-by: Jacky Bai Reviewed-by: Peng Fan Link: https://lore.kernel.org/r/20230215024117.3357341-3-ping.bai@nxp.com Signed-off-by: Alexandre Belloni commit c1b0c3cfcbad25d2c412863c27638c933f1d911b Author: Andreas Gruenbacher Date: Wed Feb 1 15:50:25 2023 +0100 gfs2: Convert gfs2_page_add_databufs to folios Convert gfs2_page_add_databufs() to folios and rename it to gfs2_trans_add_databufs(). Cc: Matthew Wilcox Signed-off-by: Andreas Gruenbacher commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 Author: Andreas Gruenbacher Date: Wed Feb 1 15:08:50 2023 +0100 gfs2: jdata writepage fix The ->writepage() and ->writepages() operations are supposed to write entire pages. However, on filesystems with a block size smaller than PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the current transaction instead of adding the entire page. Fix that. Fixes: 18ec7d5c3f43 ("[GFS2] Make journaled data files identical to normal files on disk") Signed-off-by: Andreas Gruenbacher commit ad614f81d2e8b9704478921935c75ccd4024b854 Author: Uwe Kleine-König Date: Fri Jan 27 16:26:39 2023 +0100 backlight: ktz8866: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230127152639.1347229-1-u.kleine-koenig@pengutronix.de commit f8449c8f73552b82e2a29dfdb99df54bd3a5aafc Author: Jianhua Lu Date: Fri Jan 20 23:50:18 2023 +0800 backlight: ktz8866: Add support for Kinetic KTZ8866 backlight Add support for Kinetic KTZ8866 backlight, which is used in Xiaomi tablet, Mi Pad 5 series. This driver lightly based on downstream implementation [1]. [1] https://github.com/MiCode/Xiaomi_Kernel_OpenSource/blob/elish-r-oss/drivers/video/backlight/ktz8866.c Signed-off-by: Jianhua Lu Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230120155018.15376-2-lujianhua000@gmail.com commit c8990c3889ea0a052edcff9dd890a3ab28bc5a47 Author: Jianhua Lu Date: Fri Jan 20 23:50:17 2023 +0800 dt-bindings: leds: backlight: Add Kinetic KTZ8866 backlight Add Kinetic KTZ8866 backlight binding documentation. Signed-off-by: Jianhua Lu Reviewed-by: Krzysztof Kozlowski Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230120155018.15376-1-lujianhua000@gmail.com commit deaeeda2051fa280884bf5769021bcdeae5de44e Author: Uwe Kleine-König Date: Fri Jan 20 13:00:18 2023 +0100 backlight: pwm_bl: Don't rely on a disabled PWM emiting inactive state Most but not all PWMs drive the PWM pin to its inactive state when disabled. However if there is no enable_gpio and no regulator the PWM must drive the inactive state to actually disable the backlight. So keep the PWM on in this case. Note that to determine if there is a regulator some effort is required because it might happen that there isn't actually one but the regulator core gave us a dummy. (A nice side effect is that this makes the regulator actually optional even on fully constrained systems.) This fixes backlight disabling e.g. on i.MX6 when an inverted PWM is used. Hint for the future: If this change results in a regression, the bug is in the lowlevel PWM driver. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230120120018.161103-3-u.kleine-koenig@pengutronix.de commit 00e7e698bff1dfdb74da6aff1d80508cdbde25f9 Author: Uwe Kleine-König Date: Fri Jan 20 13:00:17 2023 +0100 backlight: pwm_bl: Configure pwm only once per backlight toggle When the function pwm_backlight_update_status() was called with brightness > 0, pwm_get_state() was called twice (once directly and once in compute_duty_cycle). Also pwm_apply_state() was called twice (once in pwm_backlight_power_on() and once directly). Optimize this to do both calls only once. Note that with this affects the order of regulator and PWM setup. It's not expected to have a relevant effect on hardware. The rationale for this is that the regulator (and the GPIO) are reasonable to switch in pwm_backlight_power_on()/pwm_backlight_power_off() but the PWM has nothing to do with power. (The post_pwm_on_delay and pwm_off_delay are still there though.) Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230120120018.161103-2-u.kleine-koenig@pengutronix.de commit 744fc2dada5073b8d9822c8c838c8141037ec651 Author: Arnd Bergmann Date: Thu Jan 5 14:46:04 2023 +0100 backlight: Remove pxa tosa support The PXA tosa machine was removed, so this backlight driver is no longer needed. Signed-off-by: Arnd Bergmann Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230105134622.254560-10-arnd@kernel.org commit 32fb2588ce69ec254cfd8269bc31d9fbe5b999aa Author: Stephen Kitt Date: Fri Jan 6 17:48:52 2023 +0100 backlight: aat2870: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Reviewed-by: Daniel Thompson Reviewed-by: Sam Ravnborg Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230106164856.1453819-2-steve@sk2.org commit e3b2ac4088126eebcf2e6d5797f9a94bb67e491e Author: Stephen Kitt Date: Fri Jan 6 17:48:54 2023 +0100 backlight: ipaq_micro: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Reviewed-by: Sam Ravnborg Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230106164856.1453819-4-steve@sk2.org commit fef0b89a451fa06bf275dcd31afee09fffea5e17 Author: Stephen Kitt Date: Fri Jan 6 17:48:53 2023 +0100 backlight: arcxcnn: Use backlight helper Instead of retrieving the backlight brightness in struct backlight_properties manually, and then checking whether the backlight should be on at all, use backlight_get_brightness() which does all this and insulates this from future changes. Signed-off-by: Stephen Kitt Reviewed-by: Sam Ravnborg Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230106164856.1453819-3-steve@sk2.org commit 3a396f9859755e822775319516cd71dabc2b4e69 Author: Randy Dunlap Date: Thu Jan 12 22:41:18 2023 -0800 backlight: sky81452: Fix sky81452_bl_platform_data kernel-doc Correct the struct name and add a short struct description to fix the kernel-doc notation. Prevents this kernel-doc warning: drivers/video/backlight/sky81452-backlight.c:64: warning: expecting prototype for struct sky81452_platform_data. Prototype was for struct sky81452_bl_platform_data instead Signed-off-by: Randy Dunlap Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230113064118.30169-1-rdunlap@infradead.org commit 5a7fbe452ad9e4a8988d4c20d7acf148383f8106 Author: Uwe Kleine-König Date: Thu Nov 17 08:21:51 2022 +0100 backlight: pwm_bl: Drop support for legacy PWM probing There is no in-tree user left which relies on legacy probing. So drop support for it which removes another user of the deprecated pwm_request() function. Signed-off-by: Uwe Kleine-König Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221117072151.3789691-1-u.kleine-koenig@pengutronix.de commit 901ae537b7977716dc6d2db34b3a75d64a72ab2b Author: Luca Weiss Date: Tue Nov 1 17:17:59 2022 +0100 dt-bindings: backlight: qcom-wled: Add PMI8950 compatible Document the compatible for the wled block found in PMI8950. Signed-off-by: Luca Weiss Reviewed-by: Daniel Thompson Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221101161801.1058969-1-luca@z3ntu.xyz commit 81bc9eada9e75d011d055505a7a30b760af0455f Author: Yang Yingliang Date: Mon Sep 26 22:20:59 2022 +0800 backlight: ktd253: Switch to use dev_err_probe() helper In the probe path, dev_err() can be replaced with dev_err_probe() which will check if error code is -EPROBE_DEFER and prints the error name. It also sets the defer probe reason which can be checked later through debugfs. It's more simple in error path. Signed-off-by: Yang Yingliang Reviewed-by: Daniel Thompson Reviewed-by: Linus Walleij Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220926142059.2294282-1-yangyingliang@huawei.com commit 3755b46a1bf47a6778f4ce33def1e6122796f57c Author: Miaoqian Lin Date: Thu Dec 15 11:19:01 2022 +0400 backlight: backlight: Fix doc for backlight_device_get_by_name backlight_put() has been dropped, we should call put_device() to drop the reference taken by backlight_device_get_by_name(). Fixes: 0f6a3256fd81 ("backlight: backlight: Drop backlight_put()") Signed-off-by: Miaoqian Lin Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221215071902.424005-1-linmq006@gmail.com commit 7c15430822e71e90203d87e6d0cfe83fa058b0dc Author: Len Brown Date: Wed Feb 1 12:32:01 2023 -0600 wifi: ath11k: allow system suspend to survive ath11k When ath11k runs into internal errors upon suspend, it returns an error code to pci_pm_suspend, which aborts the entire system suspend. The driver should not abort system suspend, but should keep its internal errors to itself, and allow the system to suspend. Otherwise, a user can suspend a laptop by closing the lid and sealing it into a case, assuming that is will suspend, rather than heating up and draining the battery when in transit. In practice, the ath11k device seems to have plenty of transient errors, and subsequent suspend cycles after this failure often succeed. https://bugzilla.kernel.org/show_bug.cgi?id=216968 Fixes: d1b0c33850d29 ("ath11k: implement suspend for QCA6390 PCI devices") Signed-off-by: Len Brown Cc: stable@vger.kernel.org Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230201183201.14431-1-len.brown@intel.com commit 904e28c6de083fa4834cdbd0026470ddc30676fc Merge: a738688177dcd 2f7f4efb94117 Author: Benjamin Tissoires Date: Wed Feb 22 10:44:31 2023 +0100 Merge branch 'for-6.3/hid-bpf' into for-linus Initial support of HID-BPF (Benjamin Tissoires) The history is a little long for this series, as it was intended to be sent for v6.2. However some last minute issues forced us to postpone it to v6.3. Conflicts: * drivers/hid/i2c-hid/Kconfig: commit bf7660dab30d ("HID: stop drivers from selecting CONFIG_HID") conflicts with commit 2afac81dd165 ("HID: fix I2C_HID not selected when I2C_HID_OF_ELAN is") the resolution is simple enough: just drop the "default" and "select" lines as the new commit from Arnd is doing commit a738688177dcdffe8064dc5ecac6ec4431b6b951 Merge: b838d36fa73c1 f5379a01d6617 Author: Benjamin Tissoires Date: Wed Feb 22 10:41:39 2023 +0100 Merge branch 'for-6.3/uclogic' into for-linus UClogic assorted fixes and new devices support (José Expósito) commit b838d36fa73c1584d814f08c3a6d4b9582418a02 Merge: 52bb0598b3ed5 9cd61c8179781 Author: Benjamin Tissoires Date: Wed Feb 22 10:41:06 2023 +0100 Merge branch 'for-6.3/steam' into for-linus Add Steam Deck support (Vicki Pfau) commit 52bb0598b3ed50c7e729f4a2c8006c60931f5e6e Merge: c21c9feed40e8 6f7dbbd5a9d79 Author: Benjamin Tissoires Date: Wed Feb 22 10:40:03 2023 +0100 Merge branch 'for-6.3/sony' into for-linus - enforce DS4 controllers to use hid-playstation (Roderick Colenbrander) - various hid-playstation gyro fixes (Roderick Colenbrander) commit c21c9feed40e8e64ad73d81acaecf6feaf860300 Merge: 3ba2824ca2e38 03a86105556e2 Author: Benjamin Tissoires Date: Wed Feb 22 10:39:05 2023 +0100 Merge branch 'for-6.3/multitouch' into for-linus Allow to pass quirks from i2c-hid to hid-multitouch (Allen Ballway & Dmitry Torokhov) commit 3ba2824ca2e38c4fa80086a91f09f2187ea120ef Merge: a74749efb4125 47e91fdfa5111 Author: Benjamin Tissoires Date: Wed Feb 22 10:38:38 2023 +0100 Merge branch 'for-6.3/mcp2221' into for-linus prevent UAF in delayed work (Benjamin Tissoires) commit a74749efb41253853a96815710a860591f7a03d9 Merge: 0f7566c7e5518 1b136aeb3c4a1 Author: Benjamin Tissoires Date: Wed Feb 22 10:37:02 2023 +0100 Merge branch 'for-6.3/logitech' into for-linus - HID++ fixes for scroll wheel, protocol and debug (Bastien Nocera) - add support of Logitech G923 Xbox Edition steering wheel (Walt Holman) commit 0f7566c7e55183b0310e291a94840ba23451322a Merge: 2818ccb42a25a eb16f59e8e584 Author: Benjamin Tissoires Date: Wed Feb 22 10:34:51 2023 +0100 Merge branch 'for-6.3/i2c-hid' into for-linus - dev_dbg cleanup (Thomas Weißschuh) - cleanup i2c-hid-acpi (Andy Shevchenko) - goodix: revert/fixes for an actual production device compared to the manufacturer sample (Douglas Anderson) commit 2818ccb42a25a73465b8c9158ffccdef8e43699d Merge: 1f3a957344010 f1f73651a0849 Author: Benjamin Tissoires Date: Wed Feb 22 10:33:09 2023 +0100 Merge branch 'for-6.3/hid-sensor' into for-linus Allow more custom IIO sensors through HID (Philipp Jungkamp) commit 1f3a95734401085fe2e2cfc1a004d58114268c1f Merge: 33238632295e6 f5cd71cfdb5c8 Author: Benjamin Tissoires Date: Wed Feb 22 10:32:22 2023 +0100 Merge branch 'for-6.3/evision' into for-linus New hid-evision driver for EVision keyboards (Philippe Valembois) commit 33238632295e6f1e7176b77ab6aa9ed6c0b86366 Merge: 94109c9f237d4 b94335f899542 Author: Benjamin Tissoires Date: Wed Feb 22 10:31:52 2023 +0100 Merge branch 'for-6.3/bigben' into for-linus UAF protection in work struct (Pietro Borrello) commit 94109c9f237d4f5b3148c7242b020f9485b55cf0 Merge: 06db2af35e5f4 4ab3a086d10ee Author: Benjamin Tissoires Date: Wed Feb 22 10:30:47 2023 +0100 Merge branch 'for-6.3/asus' into for-linus UAF protection in work struct (Pietro Borrello) commit 06db2af35e5f44cebf36c1dc122f5769f630d2f8 Merge: 0b028189d1019 3f16ba1c0768d Author: Benjamin Tissoires Date: Wed Feb 22 10:27:57 2023 +0100 Merge branch 'for-6.3/hid-core' into for-linus - constify hid_ll_driver (Thomas Weißschuh) - map standard Battery System Charging to upower (José Expósito) - couple of assorted fixes and new handling of HID usages (Jingyuan Liang & Ronald Tschalär) commit 0af8c09c896810879387decfba8c942994bb61f5 Author: Pavel Tikhomirov Date: Mon Feb 13 12:25:05 2023 +0800 netfilter: x_tables: fix percpu counter block leak on error path when creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_alloc +-< find_check_entry # {arp,ip,ip6}_tables.c +-< translate_table And it can be leaked on this code path: +-> ip6t_register_table +-> translate_table # allocates percpu counter block +-> xt_register_table # fails there is no freeing of the counter block on xt_register_table fail. Note: xt_percpu_counter_free should be called to free it like we do in do_replace through cleanup_entry helper (or in __ip6t_unregister_table). Probability of hitting this error path is low AFAICS (xt_register_table can only return ENOMEM here, as it is not replacing anything, as we are creating new netns, and it is hard to imagine that all previous allocations succeeded and after that one in xt_register_table failed). But it's worth fixing even the rare leak. Fixes: 71ae0dff02d7 ("netfilter: xtables: use percpu rule counters") Signed-off-by: Pavel Tikhomirov Signed-off-by: Pablo Neira Ayuso commit 4414a7ab80cebf715045e3c4d465feefbad21139 Author: Liang He Date: Thu Jan 5 14:10:55 2023 +0800 mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the refcnt even when it returns an error. Signed-off-by: Liang He Acked-by: Charles Keepax Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230105061055.1509261-1-windhl@126.com commit 7d1e3bd94828ad9fc86f55253cd6fec8edd65394 Author: Jeremy Kerr Date: Thu Jan 5 08:50:10 2023 +0800 mfd: syscon: Allow reset control for syscon devices Simple syscon devices may require deassertion of a reset signal in order to access their register set. Rather than requiring a custom driver to implement this, we can use the generic "resets" specifiers to link a reset line to the syscon. This change adds an optional reset line to the syscon device description, and deasserts the reset if detected. Signed-off-by: Jeremy Kerr Reviewed-by: Arnd Bergmann Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230105005010.124948-3-jk@codeconstruct.com.au commit 0f4d261989a89aa78f309eb0c5cb816028182bca Author: Jeremy Kerr Date: Thu Jan 5 08:50:09 2023 +0800 dt-bindings: mfd/syscon: Add resets property Simple syscon devices may require deassertion of a reset signal in order to access their register set. This change adds the `resets` property from reset.yaml#/properties/resets (referenced through core.yaml), specifying a maxItems of 1 for a single (optional) reset descriptor. This will allow a future change to the syscon driver to implement reset control. Signed-off-by: Jeremy Kerr Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230105005010.124948-2-jk@codeconstruct.com.au commit 8e993c5888fa7131b384f3c8ec710209b7be78e6 Author: Brad Larson Date: Wed Jan 18 19:51:26 2023 -0800 dt-bindings: mfd: syscon: Add amd,pensando-elba-syscon compatible Add the AMD Pensando Elba SoC system registers compatible Signed-off-by: Brad Larson Acked-by: Rob Herring Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230119035136.21603-6-blarson@amd.com commit 484cd9c0ec63b807227c44c10e47330eba136dff Author: Matti Lehtimäki Date: Thu Jan 12 22:26:07 2023 +0200 dt-bindings: mfd: qcom,tcsr: Add compatible for MSM8226 Document the qcom,msm8226-tcsr compatible. Signed-off-by: Matti Lehtimäki Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230112202612.791455-5-matti.lehtimaki@gmail.com commit 81435ed2bdea54bef20a898827b127d8ce087495 Author: Lee Jones Date: Mon Jan 9 17:26:36 2023 +0000 mfd: simple-mfd-i2c: Fix incoherent comment regarding DT registration Signed-off-by: Lee Jones commit 1b1305e95e85624f538ec56db9acf88e2d3d7397 Author: Samuel Holland Date: Wed Dec 28 10:27:52 2022 -0600 mfd: axp20x: Switch to the sys-off handler API This removes a layer of indirection through pm_power_off() and allows the PMIC handler to be used as a fallback when firmware power off fails. This happens on boards like the Clockwork DevTerm R-01 where OpenSBI does not know how to use the PMIC to power off the board. Move the check for AXP288 to avoid registering a dummy handler. Signed-off-by: Samuel Holland [Lee: Removed superfluous new line] Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221228162752.14204-1-samuel@sholland.org commit 88a32c2c5e98d72765846db83c1739e7b036770a Author: Geert Uytterhoeven Date: Mon Jan 9 14:33:22 2023 +0100 mfd: core: Spelling s/compement/complement/ Fix a misspelling of "complement". Signed-off-by: Geert Uytterhoeven Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/aa7abd7103a0e4be954ea63de78f12e8251b2964.1673271092.git.geert+renesas@glider.be commit 8aa06dbe50a612e32b5c367421e2a51ae3f1acc9 Author: Jiapeng Chong Date: Tue Dec 27 16:18:05 2022 +0800 mfd: max8925: Remove the unused function irq_to_max8925() The function irq_to_max8925() is defined in the max8925-core.c file, but not called elsewhere, so remove this unused function. drivers/mfd/max8925-core.c:472:40: warning: unused function 'irq_to_max8925'. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3561 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221227081805.54185-1-jiapeng.chong@linux.alibaba.com commit 49184844b6653292b2954304005357ef6828b0fa Author: Jiapeng Chong Date: Tue Dec 27 16:19:21 2022 +0800 mfd: qcom-pm8xxx: Remove set but unused variable 'rev' Variable rev is not effectively used in the function, so delete it. drivers/mfd/qcom-pm8xxx.c:513:6: warning: variable 'rev' set but not used. Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3558 Reported-by: Abaci Robot Signed-off-by: Jiapeng Chong Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221227081921.56448-1-jiapeng.chong@linux.alibaba.com commit 0b05327947dc68e8901477ced9ea6f8e3fb0c5f5 Author: Nick Hawkins Date: Fri Dec 16 12:35:29 2022 -0600 dt-bindings: mfd: syscon: Document GXP register compatible Document hpe,gxp-sysreg compatible for GXP registers. Signed-off-by: Nick Hawkins Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221216183532.78933-4-nick.hawkins@hpe.com commit 58a3fb991ec21e8cba82062be374c67447496e3a Author: Uwe Kleine-König Date: Mon Dec 12 22:43:52 2022 +0100 mfd: twl4030-power: Drop empty platform remove function A remove callback just returning 0 is equivalent to no remove callback at all. So drop the useless function. Signed-off-by: Uwe Kleine-König Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221212214352.3776110-1-u.kleine-koenig@pengutronix.de commit ccc91b3ed3f641efa8e9050c587ef509b0e2be3a Author: Andreas Kemnade Date: Thu Dec 8 22:57:23 2022 +0100 mfd: twl: Fix TWL6032 phy vbus detection TWL6032 has a few charging registers prepended before the charging registers the TWL6030 has. To be able to use common register defines declare the additional registers as additional module. At the moment this affects the access to CHARGERUSB_CTRL1 in phy-twl6030-usb. Without this patch, it is accessing the wrong register on TWL6032. The consequence is that presence of Vbus is not reported. Cc: Bin Liu Cc: Tony Lindgren Signed-off-by: Andreas Kemnade Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221208215723.217557-1-andreas@kemnade.info commit 8b450dcff23aa254844492831a8e2b508a9d522d Author: Qiheng Lin Date: Thu Dec 8 14:15:55 2022 +0800 mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() `req` is allocated in pcf50633_adc_async_read(), but adc_enqueue_request() could fail to insert the `req` into queue. We need to check the return value and free it in the case of failure. Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver") Signed-off-by: Qiheng Lin Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com commit 3a8678dfa857b671ff56de2573cb236fc6f0f0d2 Author: Lee Jones Date: Tue Dec 6 10:50:38 2022 +0000 MAINTAINERS: Move MFD from a Supported to Maintaied state No one is funding MFD maintenance. S: *Status*, one of the following: Supported: Someone is actually paid to look after this. Maintained: Someone actually looks after it. Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221206105038.124613-1-lee@kernel.org commit 0c8884fe34bb3e2d739c883000691bb665c01843 Author: Bhanu Prakash Maiya Date: Wed Dec 7 10:40:12 2022 -0700 dt-bindings: mfd: cros-ec: Add compatible string for UART support Add a compatible string to support the UART implementation of the cros ec interface. The driver does not support the reg and interrupt properties, so exempt them from being required for UART compatible nodes. Signed-off-by: Bhanu Prakash Maiya Co-developed-by: Mark Hasemeyer Signed-off-by: Mark Hasemeyer Acked-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221207104005.v10.2.I9e018ecb8bdf341648cb64417085978ff0d22a46@changeid commit 8cc5e62bae28d02f706a6abc8fd804609579964c Author: ye xingchen Date: Fri Dec 2 15:28:36 2022 +0800 mfd: Use sysfs_emit() to instead of scnprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: ye xingchen Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/202212021528368292334@zte.com.cn commit 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 Author: Randy Dunlap Date: Wed Nov 30 17:25:41 2022 -0800 mfd: cs5535: Don't build on UML The cs5535-mfd driver uses CPU-specific data that is not available for ARCH=um builds, so don't allow it to be built for UML. Prevents these build errors: In file included from ../arch/x86/include/asm/olpc.h:7, from ../drivers/mfd/cs5535-mfd.c:17: ../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’: ../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && ../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ 17 | (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ 18 | (boot_cpu_data.x86_model == 5)); ../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’: ../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && ../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ 24 | (boot_cpu_data.x86 == 5) && ../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ 25 | (boot_cpu_data.x86_model == 10)); Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Randy Dunlap Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org commit 8781ba7f45695af3ab8e8d1b55a31f527c9201a3 Author: Aren Moynihan Date: Thu Dec 8 17:02:26 2022 -0500 mfd: axp20x: Fix order of pek rise and fall events The power button can get "stuck" if the rising edge and falling edge irq are read in the same pass. This can often be triggered when resuming from suspend if the power button is released before the kernel handles the interrupt. Swapping the order of the rise and fall events makes sure that the press event is handled first, which prevents this situation. Signed-off-by: Aren Moynihan Reviewed-by: Samuel Holland Tested-by: Samuel Holland Acked-by: Chen-Yu Tsai Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221208220225.635414-1-aren@peacevolution.org commit 725a2acd851dbef94a3e68c1a8a1de2862742ecd Author: Neil Armstrong Date: Fri Nov 18 09:24:38 2022 +0100 dt-bindings: mfd: qcom,spmi-pmic: Document PMICs bundled with SM8550 Document compatible for the pm8550, pm8550b, pm8550ve, pm8550vs, pmk8550. pm8010 & pmr735d SPMI PMICs Signed-off-by: Neil Armstrong Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20221114-narmstrong-sm8550-upstream-spmi-v2-1-b839bf2d558a@linaro.org commit 5d69b181cd0db10dc8327d28ce837b3623cd531a Author: Tom Fitzhenry Date: Mon Jan 2 22:11:47 2023 +1100 mfd: rk808: Re-add rk808-clkout to RK818 Fixes RK818 (e.g. on Pinephone Pro) to register its clock, without which dependent devices (e.g. wifi/BT, via sdio-wifi-pwrseq) fail to probe. This line was removed in commit 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances"), but only from RK818. Fixes: 3633daacea2e ("mfd: rk808: Permit having multiple PMIC instances") Signed-off-by: Tom Fitzhenry Reviewed-by: Javier Martinez Canillas Acked-by: Neil Armstrong Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20230102111147.2580861-1-tom@tom-fitzhenry.me.uk commit 28e1958009cf73166b13551d1b52c6b907f993d8 Merge: 783422d00d7d8 acf63c458b55e Author: Lee Jones Date: Wed Feb 22 08:25:03 2023 +0000 Merge tags 'ib-mfd-extcon-i2c-v6.3' and 'ib-mfd-fpga-hwmon-v6.3-1' into ibs-for-mfd-merged Immutable branch between MFD, Extcon and I2C due for the v6.3 merge window Immutable branch between MFD, FPGA and HWMON due for the v6.3 merge window commit f82cdc37c4bd4ba905bf99ade9782a639b5c12e9 Author: Russell Currey Date: Wed Feb 22 13:17:08 2023 +1100 powerpc/pseries: Avoid hcall in plpks_is_available() on non-pseries plpks_is_available() can be called on any platform via kexec but calls _plpks_get_config() which makes a hcall, which will only work on pseries. Fix this by returning early in plpks_is_available() if hcalls aren't possible. Fixes: 119da30d037d ("powerpc/pseries: Expose PLPKS config values, support additional fields") Reported-by: Murphy Zhou Signed-off-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230222021708.146257-1-ruscur@russell.cc commit 901b894af5b933cf6576eec05746f34b46e2ac83 Author: Benjamin Block Date: Tue Feb 21 18:56:00 2023 +0100 scsi: zfcp: Trace when request remove fails after qdio send fails When we fail to send a FSF request in 'zfcp_fsf_req_send()' when calling 'zfcp_qdio_send()' we try to remove the request object from our internal hash table again to prevent keeping a stale memory reference. This removal might still - very much theoretically - fail. To store some evidence of when this happens add a new trace record for this case; tag: 'fsrsrmf'. We reuse the 'ZFCP_DBF_HBA_RES' trace ID for this, but mark all fields other then the request ID with ~0, to make fairly obvious that these are invalid values. This faking has to be done because we don't have a valid request object at this point, and can not safely access any of the memory of the old object - we just failed to find it in our hash table, so it might be gone already. Here is an example of a decoded trace record: Timestamp : 2023-02-17-13:09:12:748140 Area : HBA Subarea : 1 Level : - Exception : 000003ff7ff500c2 CPU ID : 0011 Caller : 0x0 Record ID : 1 Tag : fsrsrmf Request ID : 0x0000000080126ab6 Request status : 0xffffffff FSF cmnd : 0xffffffff FSF sequence no: 0xffffffff FSF issued : 2042-09-18-01:53:47:370495 FSF stat : 0xffffffff FSF stat qual : ffffffff ffffffff ffffffff ffffffff Prot stat : 0xffffffff Prot stat qual : ffffffff ffffffff ffffffff ffffffff Port handle : 0xffffffff LUN handle : 0xffffffff This provides at least some basic evidence that this event happened, and what object was affected. Link: https://lore.kernel.org/r/99b8246b2d71b63fa4f9c56333e2037502f7f5af.1677000450.git.bblock@linux.ibm.com Signed-off-by: Benjamin Block Reviewed-by: Steffen Maier Signed-off-by: Martin K. Petersen commit 3ab01810153b0ca26cfc846ba72996b250adde6d Author: Benjamin Block Date: Tue Feb 21 18:55:59 2023 +0100 scsi: zfcp: Change the type of all fsf request id fields and variables to u64 We use different integer types throughout zfcp to store the FSF request ID and related values; some places use 'unsigned long' and others 'u64'. On s390x these are effectively the same type, but this might cause confusions and is generally inconsistent. The specification for the used hardware specifies this value as a 64-bit number, and ultimately we use this value to communicate with the hardware, so it makes sense to change the type of all these variables to 'u64' where we can. The only exception being when we store it in the 'host_scribble' field of a 'struct scsi_cmnd'; for this case we add a build time check to make sure they are compatible. Link: https://lore.kernel.org/r/9c9cbe5acc2b419a22dce2fed847e3db91b60201.1677000450.git.bblock@linux.ibm.com Signed-off-by: Benjamin Block Reviewed-by: Steffen Maier Signed-off-by: Martin K. Petersen commit 79f9abd64719cc71ba78a76574e21dc8266c65a3 Author: Benjamin Block Date: Tue Feb 21 18:55:58 2023 +0100 scsi: zfcp: Make the type for accessing request hashtable buckets size_t The appropriate type for array indices is 'size_t' and the current implementation in 'zfcp_reqlist.h' mixes 'int' and 'unsigned int' in different places to access the hashtable buckets of our internal request hash table. To prevent any confusion, change all places to 'size_t'. Link: https://lore.kernel.org/r/64afe93f6263c6b07815937826cd7d5fc4f1a674.1677000450.git.bblock@linux.ibm.com Signed-off-by: Benjamin Block Reviewed-by: Steffen Maier Signed-off-by: Martin K. Petersen commit 2702812ae33b38898de6d950cdb6a03888d001af Author: Bart Van Assche Date: Fri Feb 10 11:32:58 2023 -0800 scsi: ufs: core: Simplify ufshcd_execute_start_stop() Use scsi_execute_cmd() instead of open-coding it. Link: https://lore.kernel.org/r/20230210193258.4004923-4-bvanassche@acm.org Cc: Mike Christie Cc: John Garry Signed-off-by: Bart Van Assche Reviewed-by: John Garry Reviewed-by: Asutosh Das Signed-off-by: Martin K. Petersen commit 93bc4a5d00e472003ae983bb21febd2519a64f62 Author: Bart Van Assche Date: Fri Feb 10 11:32:57 2023 -0800 scsi: ufs: core: Rely on the block layer for setting RQF_PM Do not set RQF_PM explicitly since scsi_alloc_request() sets it indirectly if BLK_MQ_REQ_PM is set. The call chain for the code that sets RQF_PM is as follows: scsi_alloc_request() blk_mq_alloc_request() __blk_mq_alloc_requests() blk_mq_rq_ctx_init() if (data->flags & BLK_MQ_REQ_PM) data->rq_flags |= RQF_PM; Link: https://lore.kernel.org/r/20230210193258.4004923-3-bvanassche@acm.org Cc: Mike Christie Cc: John Garry Reviewed-by: John Garry Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 35cd2f5542df569122d48caf606b972642012c50 Author: Bart Van Assche Date: Fri Feb 10 11:32:56 2023 -0800 scsi: core: Extend struct scsi_exec_args Allow SCSI LLDs to specify SCMD_* flags. Link: https://lore.kernel.org/r/20230210193258.4004923-2-bvanassche@acm.org Cc: Mike Christie Cc: John Garry Reviewed-by: John Garry Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 442336a5a999d4aae6221e3496dad071a152b1fb Author: Bo Liu Date: Fri Feb 17 03:30:46 2023 -0500 scsi: lpfc: Fix double word in comments Remove the repeated word "the" in comments. [mkp: fixed additional typos in the changed lines] Link: https://lore.kernel.org/r/20230217083046.4090-1-liubo03@inspur.com Signed-off-by: Bo Liu Reviewed-by: Randy Dunlap Signed-off-by: Martin K. Petersen commit fc663711b94468f4e1427ebe289c9f05669699c9 Author: Bart Van Assche Date: Fri Feb 10 12:52:00 2023 -0800 scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. This fixes a bug introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core"). Fix the following kernel warning: proc_dir_entry 'scsi/scsi_debug' already registered WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0 Call Trace: proc_mkdir+0xb5/0xe0 scsi_proc_hostdir_add+0xb5/0x170 scsi_host_alloc+0x683/0x6c0 sdebug_driver_probe+0x6b/0x2d0 [scsi_debug] really_probe+0x159/0x540 __driver_probe_device+0xdc/0x230 driver_probe_device+0x4f/0x120 __device_attach_driver+0xef/0x180 bus_for_each_drv+0xe5/0x130 __device_attach+0x127/0x290 device_initial_probe+0x17/0x20 bus_probe_device+0x110/0x130 device_add+0x673/0xc80 device_register+0x1e/0x30 sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug] scsi_debug_init+0x64f/0x1000 [scsi_debug] do_one_initcall+0xd7/0x470 do_init_module+0xe7/0x330 load_module+0x122a/0x12c0 __do_sys_finit_module+0x124/0x1a0 __x64_sys_finit_module+0x46/0x50 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lore.kernel.org/r/20230210205200.36973-3-bvanassche@acm.org Cc: Alan Stern Cc: Yi Zhang Cc: stable@vger.kernel.org Fixes: 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core") Reported-by: Yi Zhang Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit f4407e6033a69ff633ee9d6acf6d241223c7c9fb Author: Bart Van Assche Date: Fri Feb 10 12:51:59 2023 -0800 scsi: core: Fix a source code comment Fix an incorrect reference to the scsi_remove_host() function in a source code comment. Link: https://lore.kernel.org/r/20230210205200.36973-2-bvanassche@acm.org Fixes: b49493f99690 ("Fix a memory leak in scsi_host_dev_release()") Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 5794a3902bde986ade963cdf4db98b6baa433d20 Author: Jesper Juhl Date: Thu Feb 16 01:51:30 2023 +0100 scsi: cxgbi: Remove unneeded version.h include Remove unneeded version.h include pointed out by 'make versioncheck'. Link: https://lore.kernel.org/r/820137c2-decc-3d78-f170-7f1c0571fbb7@gmail.com Signed-off-by: Jesper Juhl Signed-off-by: Martin K. Petersen commit e0aa38c444f2fcf1fceb4fef7902209dd25b48ea Author: Jesper Juhl Date: Thu Feb 16 01:51:30 2023 +0100 scsi: qedi: Remove unneeded version.h include Remove unneeded version.h include pointed out by 'make versioncheck'. Link: https://lore.kernel.org/r/820137c2-decc-3d78-f170-7f1c0571fbb7@gmail.com Signed-off-by: Jesper Juhl Signed-off-by: Martin K. Petersen commit 66b381d874fa440dbcd20e1a9078849f7dd2ff4c Author: Jesper Juhl Date: Thu Feb 16 01:51:30 2023 +0100 scsi: mpi3mr: Remove unneeded version.h include Remove unneeded version.h include pointed out by 'make versioncheck'. Link: https://lore.kernel.org/r/820137c2-decc-3d78-f170-7f1c0571fbb7@gmail.com Signed-off-by: Jesper Juhl Signed-off-by: Martin K. Petersen commit e39ea831ebad4ab15c4748cb62a397a8abcca36e Author: Shin'ichiro Kawasaki Date: Tue Feb 14 09:50:19 2023 +0900 scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") introduced an array mrioc->evtack_cmds but initialization of the array elements was missed. They are just zero cleared. The function mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the zero value of the host_tag field, the function calls clear_bit() for mrico->evtack_cmds_bitmap with wrong bit index. This results in memory access to invalid address and "BUG: KASAN: use-after-free". This BUG was observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add the missing initialization of mrioc->evtack_cmds. Link: https://lore.kernel.org/r/20230214005019.1897251-5-shinichiro.kawasaki@wdc.com Cc: stable@vger.kernel.org Fixes: c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Damien Le Moal Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit 339e61565f81a6534afdc18fd854b2e2628bf5db Author: Shin'ichiro Kawasaki Date: Tue Feb 14 09:50:18 2023 +0900 scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bitmaps are allocated using unsigned long as unit. This gap causes memory access beyond the bitmap sizes and results in "BUG: KASAN: slab-out-of-bounds". The BUG was observed at firmware download to eHBA-9600. Call trace indicated that the out-of-bounds access happened in find_first_zero_bit() called from mpi3mr_send_event_ack() for miroc->evtack_cmds_bitmap. To fix the BUG, do not use bytes to manage bitmap sizes. Instead, use number of bits, and call bitmap helper functions which take number of bits as arguments. For memory allocation, call bitmap_zalloc() instead of kzalloc() and krealloc(). For memory free, call bitmap_free() instead of kfree(). For zero clear, call bitmap_clear() instead of memset(). Remove three fields for bitmap byte sizes in struct scmd_priv which are no longer required. Replace the field dev_handle_bitmap_sz with dev_handle_bitmap_bits to keep number of bits of removepend_bitmap across resize. Link: https://lore.kernel.org/r/20230214005019.1897251-4-shinichiro.kawasaki@wdc.com Fixes: c5758fc72b92 ("scsi: mpi3mr: Gracefully handle online FW update operation") Fixes: e844adb1fbdc ("scsi: mpi3mr: Implement SCSI error handler hooks") Fixes: c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Signed-off-by: Shin'ichiro Kawasaki Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit eeb270aee3e085411399f129fc14fa04bd6d83cf Author: Shin'ichiro Kawasaki Date: Tue Feb 14 09:50:17 2023 +0900 scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi In the function mpi3mr_get_all_tgt_info(), devmap_info points to alltgt_info->dmi then there is no need to memcpy() data from devmap_info to alltgt_info->dmi. Remove the unnecessary memcpy(). This also allows to remove the local variable 'rval' and the goto label 'out'. Link: https://lore.kernel.org/r/20230214005019.1897251-3-shinichiro.kawasaki@wdc.com Cc: stable@vger.kernel.org Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") Signed-off-by: Shin'ichiro Kawasaki Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit fb428a2005fc1260d18b989cc5199f281617f44d Author: Shin'ichiro Kawasaki Date: Tue Feb 14 09:50:16 2023 +0900 scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() The function mpi3mr_get_all_tgt_info() has four issues: 1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64). 2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices. 3) It copies num_device by calling memcpy(). Substitution is enough. 4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds". Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer(). Link: https://lore.kernel.org/r/20230214005019.1897251-2-shinichiro.kawasaki@wdc.com Cc: stable@vger.kernel.org Fixes: f5e6d5a34376 ("scsi: mpi3mr: Add support for driver commands") Signed-off-by: Shin'ichiro Kawasaki Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit ae7d45f5283d30274039b95d3e6d53d33c66e991 Author: Tomas Henzl Date: Mon Feb 13 20:37:52 2023 +0100 scsi: mpi3mr: Fix an issue found by KASAN Write only correct size (32 instead of 64 bytes). Link: https://lore.kernel.org/r/20230213193752.6859-1-thenzl@redhat.com Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Signed-off-by: Tomas Henzl Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit c6f2e6b6eaaf883df482cb94f302acad9b80a2a4 Author: Kees Cook Date: Sat Feb 4 10:37:16 2023 -0800 scsi: mpi3mr: Replace 1-element array with flex-array Nothing else defined MPI3_NVME_ENCAP_CMD_MAX, so the "command" buffer was being defined as a fake flexible array of size 1. Replace this with a proper flex array. Avoids this GCC 13 warning under -fstrict-flex-arrays=3: In function 'fortify_memset_chk', inlined from 'mpi3mr_build_nvme_sgl' at ../drivers/scsi/mpi3mr/mpi3mr_app.c:693:2, inlined from 'mpi3mr_bsg_process_mpt_cmds.constprop' at ../drivers/scsi/mpi3mr/mpi3mr_app.c:1214:8: ../include/linux/fortify-string.h:430:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] 430 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Link: https://lore.kernel.org/r/20230204183715.never.937-kees@kernel.org Cc: Sumit Saxena Cc: Himanshu Madhani Cc: "Martin K. Petersen" Cc: Stephen Rothwell Cc: kernel test robot Signed-off-by: Kees Cook Signed-off-by: Martin K. Petersen commit ee4e7dfe4ffc9ca50c6875757bd119abfe22b5c5 Author: Arnd Bergmann Date: Tue Feb 14 14:28:08 2023 +0100 scsi: ipr: Work around fortify-string warning The ipr_log_vpd_compact() function triggers a fortified memcpy() warning about a potential string overflow with all versions of clang: In file included from drivers/scsi/ipr.c:43: In file included from include/linux/string.h:254: include/linux/fortify-string.h:520:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] __write_overflow_field(p_size_field, size); ^ include/linux/fortify-string.h:520:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] 2 errors generated. I don't see anything actually wrong with the function, but this is the only instance I can reproduce of the fortification going wrong in the kernel at the moment, so the easiest solution may be to rewrite the function into something that does not trigger the warning. Instead of having a combined buffer for vendor/device/serial strings, use three separate local variables and just truncate the whitespace individually. Link: https://lore.kernel.org/r/20230214132831.2118392-1-arnd@kernel.org Cc: Kees Cook Fixes: 8cf093e275d0 ("[SCSI] ipr: Improved dual adapter errors") Signed-off-by: Arnd Bergmann Reviewed-by: Damien Le Moal Reviewed-by: Kees Cook Acked-by: Brian King Signed-off-by: Martin K. Petersen commit 3a2d1efaf344c7351945532020774c3fcb134a0a Author: Deepak R Varma Date: Sun Jan 8 21:58:51 2023 +0530 scsi: ipr: Make ipr_probe_ioa_part2() return void Convert function ipr_probe_ioa_part2() to return void instead of int since the current implementation always returns 0 to the caller. The transformation also eliminates the dead code when calling ipr_probe_ioa_part2() function. Issue identified using returnvar Coccinelle semantic patch. Link: https://lore.kernel.org/r/Y7rvQyMOGcPKPTv8@ubun2204.myguest.virtualbox.org Signed-off-by: Deepak R Varma Acked-by: Brian King Signed-off-by: Martin K. Petersen commit 26a02d972bad946ecbaa12131736c8b6d28893f8 Author: Xingui Yang Date: Tue Feb 21 08:10:26 2023 +0000 scsi: sd: Update DIX config every time sd_revalidate_disk() is called If a controller has DIX is enabled and an attached disk is formatted using a protection type supported by the controller, a block integrity profile is registered to enable protected transfers. If the disk is subsequently reformatted to disable PI, and the controller does not support DIX Type 0, this can lead to failures such as this: [142829.032340] hisi_sas_v3_hw 0000:b4:04.0: erroneous completion iptt=2375 task=00000000bea0970c dev id=5 direct-attached phy4 addr=51c20dbaf642a000 CQ hdr: 0x1023 0x50947 0x0 0x20000 Error info: 0x0 0x0 0x4 0x0 [142829.073883] sas: Enter sas_scsi_recover_host busy: 1 failed: 1 [142829.079783] sas: sas_scsi_find_task: aborting task 0x00000000bea0970c [142829.102342] sas: Internal abort: task to dev 51c20dbaf642a000 response: 0x0 status 0x5 [142829.110319] sas: sas_eh_handle_sas_errors: task 0x00000000bea0970c is done [142829.117275] sd 7:0:5:0: [sdc] tag#2375 UNKNOWN(0x2003) Result: hostbyte=0x05 driverbyte=DRIVER_OK cmd_age=0s [142829.127171] sd 7:0:5:0: [sdc] tag#2375 CDB: opcode=0x2a 2a 00 00 00 00 00 00 00 08 00 [142829.135059] I/O error, dev sdc, sector 0 op 0x1:(WRITE) flags 0x18800 phys_seg 1 prio class 2 This is because the block layer integrity profile is currently only set up the first time a disk is discovered. To address this, remove the first_scan check when configuring protection information during revalidate. Also unregister the block integrity profile if DIX is not supported with a given protection type. [mkp: commit description + printk dedup] Link: https://lore.kernel.org/r/20230221081026.24736-1-yangxingui@huawei.com Signed-off-by: Xingui Yang Signed-off-by: Martin K. Petersen commit 5b7c4cabbb65f5c469464da6c5f614cbd7f730f2 Merge: 36289a03bcd3a d1fabc68f8e05 Author: Linus Torvalds Date: Tue Feb 21 18:24:12 2023 -0800 Merge tag 'net-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Core: - Add dedicated kmem_cache for typical/small skb->head, avoid having to access struct page at kfree time, and improve memory use. - Introduce sysctl to set default RPS configuration for new netdevs. - Define Netlink protocol specification format which can be used to describe messages used by each family and auto-generate parsers. Add tools for generating kernel data structures and uAPI headers. - Expose all net/core sysctls inside netns. - Remove 4s sleep in netpoll if carrier is instantly detected on boot. - Add configurable limit of MDB entries per port, and port-vlan. - Continue populating drop reasons throughout the stack. - Retire a handful of legacy Qdiscs and classifiers. Protocols: - Support IPv4 big TCP (TSO frames larger than 64kB). - Add IP_LOCAL_PORT_RANGE socket option, to control local port range on socket by socket basis. - Track and report in procfs number of MPTCP sockets used. - Support mixing IPv4 and IPv6 flows in the in-kernel MPTCP path manager. - IPv6: don't check net.ipv6.route.max_size and rely on garbage collection to free memory (similarly to IPv4). - Support Penultimate Segment Pop (PSP) flavor in SRv6 (RFC8986). - ICMP: add per-rate limit counters. - Add support for user scanning requests in ieee802154. - Remove static WEP support. - Support minimal Wi-Fi 7 Extremely High Throughput (EHT) rate reporting. - WiFi 7 EHT channel puncturing support (client & AP). BPF: - Add a rbtree data structure following the "next-gen data structure" precedent set by recently added linked list, that is, by using kfunc + kptr instead of adding a new BPF map type. - Expose XDP hints via kfuncs with initial support for RX hash and timestamp metadata. - Add BPF_F_NO_TUNNEL_KEY extension to bpf_skb_set_tunnel_key to better support decap on GRE tunnel devices not operating in collect metadata. - Improve x86 JIT's codegen for PROBE_MEM runtime error checks. - Remove the need for trace_printk_lock for bpf_trace_printk and bpf_trace_vprintk helpers. - Extend libbpf's bpf_tracing.h support for tracing arguments of kprobes/uprobes and syscall as a special case. - Significantly reduce the search time for module symbols by livepatch and BPF. - Enable cpumasks to be used as kptrs, which is useful for tracing programs tracking which tasks end up running on which CPUs in different time intervals. - Add support for BPF trampoline on s390x and riscv64. - Add capability to export the XDP features supported by the NIC. - Add __bpf_kfunc tag for marking kernel functions as kfuncs. - Add cgroup.memory=nobpf kernel parameter option to disable BPF memory accounting for container environments. Netfilter: - Remove the CLUSTERIP target. It has been marked as obsolete for years, and we still have WARN splats wrt races of the out-of-band /proc interface installed by this target. - Add 'destroy' commands to nf_tables. They are identical to the existing 'delete' commands, but do not return an error if the referenced object (set, chain, rule...) did not exist. Driver API: - Improve cpumask_local_spread() locality to help NICs set the right IRQ affinity on AMD platforms. - Separate C22 and C45 MDIO bus transactions more clearly. - Introduce new DCB table to control DSCP rewrite on egress. - Support configuration of Physical Layer Collision Avoidance (PLCA) Reconciliation Sublayer (RS) (802.3cg-2019). Modern version of shared medium Ethernet. - Support for MAC Merge layer (IEEE 802.3-2018 clause 99). Allowing preemption of low priority frames by high priority frames. - Add support for controlling MACSec offload using netlink SET. - Rework devlink instance refcounts to allow registration and de-registration under the instance lock. Split the code into multiple files, drop some of the unnecessarily granular locks and factor out common parts of netlink operation handling. - Add TX frame aggregation parameters (for USB drivers). - Add a new attr TCA_EXT_WARN_MSG to report TC (offload) warning messages with notifications for debug. - Allow offloading of UDP NEW connections via act_ct. - Add support for per action HW stats in TC. - Support hardware miss to TC action (continue processing in SW from a specific point in the action chain). - Warn if old Wireless Extension user space interface is used with modern cfg80211/mac80211 drivers. Do not support Wireless Extensions for Wi-Fi 7 devices at all. Everyone should switch to using nl80211 interface instead. - Improve the CAN bit timing configuration. Use extack to return error messages directly to user space, update the SJW handling, including the definition of a new default value that will benefit CAN-FD controllers, by increasing their oscillator tolerance. New hardware / drivers: - Ethernet: - nVidia BlueField-3 support (control traffic driver) - Ethernet support for imx93 SoCs - Motorcomm yt8531 gigabit Ethernet PHY - onsemi NCN26000 10BASE-T1S PHY (with support for PLCA) - Microchip LAN8841 PHY (incl. cable diagnostics and PTP) - Amlogic gxl MDIO mux - WiFi: - RealTek RTL8188EU (rtl8xxxu) - Qualcomm Wi-Fi 7 devices (ath12k) - CAN: - Renesas R-Car V4H Drivers: - Bluetooth: - Set Per Platform Antenna Gain (PPAG) for Intel controllers. - Ethernet NICs: - Intel (1G, igc): - support TSN / Qbv / packet scheduling features of i226 model - Intel (100G, ice): - use GNSS subsystem instead of TTY - multi-buffer XDP support - extend support for GPIO pins to E823 devices - nVidia/Mellanox: - update the shared buffer configuration on PFC commands - implement PTP adjphase function for HW offset control - TC support for Geneve and GRE with VF tunnel offload - more efficient crypto key management method - multi-port eswitch support - Netronome/Corigine: - add DCB IEEE support - support IPsec offloading for NFP3800 - Freescale/NXP (enetc): - support XDP_REDIRECT for XDP non-linear buffers - improve reconfig, avoid link flap and waiting for idle - support MAC Merge layer - Other NICs: - sfc/ef100: add basic devlink support for ef100 - ionic: rx_push mode operation (writing descriptors via MMIO) - bnxt: use the auxiliary bus abstraction for RDMA - r8169: disable ASPM and reset bus in case of tx timeout - cpsw: support QSGMII mode for J721e CPSW9G - cpts: support pulse-per-second output - ngbe: add an mdio bus driver - usbnet: optimize usbnet_bh() by avoiding unnecessary queuing - r8152: handle devices with FW with NCM support - amd-xgbe: support 10Mbps, 2.5GbE speeds and rx-adaptation - virtio-net: support multi buffer XDP - virtio/vsock: replace virtio_vsock_pkt with sk_buff - tsnep: XDP support - Ethernet high-speed switches: - nVidia/Mellanox (mlxsw): - add support for latency TLV (in FW control messages) - Microchip (sparx5): - separate explicit and implicit traffic forwarding rules, make the implicit rules always active - add support for egress DSCP rewrite - IS0 VCAP support (Ingress Classification) - IS2 VCAP filters (protos, L3 addrs, L4 ports, flags, ToS etc.) - ES2 VCAP support (Egress Access Control) - support for Per-Stream Filtering and Policing (802.1Q, 8.6.5.1) - Ethernet embedded switches: - Marvell (mv88e6xxx): - add MAB (port auth) offload support - enable PTP receive for mv88e6390 - NXP (ocelot): - support MAC Merge layer - support for the the vsc7512 internal copper phys - Microchip: - lan9303: convert to PHYLINK - lan966x: support TC flower filter statistics - lan937x: PTP support for KSZ9563/KSZ8563 and LAN937x - lan937x: support Credit Based Shaper configuration - ksz9477: support Energy Efficient Ethernet - other: - qca8k: convert to regmap read/write API, use bulk operations - rswitch: Improve TX timestamp accuracy - Intel WiFi (iwlwifi): - EHT (Wi-Fi 7) rate reporting - STEP equalizer support: transfer some STEP (connection to radio on platforms with integrated wifi) related parameters from the BIOS to the firmware. - Qualcomm 802.11ax WiFi (ath11k): - IPQ5018 support - Fine Timing Measurement (FTM) responder role support - channel 177 support - MediaTek WiFi (mt76): - per-PHY LED support - mt7996: EHT (Wi-Fi 7) support - Wireless Ethernet Dispatch (WED) reset support - switch to using page pool allocator - RealTek WiFi (rtw89): - support new version of Bluetooth co-existance - Mobile: - rmnet: support TX aggregation" * tag 'net-next-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1872 commits) page_pool: add a comment explaining the fragment counter usage net: ethtool: fix __ethtool_dev_mm_supported() implementation ethtool: pse-pd: Fix double word in comments xsk: add linux/vmalloc.h to xsk.c sefltests: netdevsim: wait for devlink instance after netns removal selftest: fib_tests: Always cleanup before exit net/mlx5e: Align IPsec ASO result memory to be as required by hardware net/mlx5e: TC, Set CT miss to the specific ct action instance net/mlx5e: Rename CHAIN_TO_REG to MAPPED_OBJ_TO_REG net/mlx5: Refactor tc miss handling to a single function net/mlx5: Kconfig: Make tc offload depend on tc skb extension net/sched: flower: Support hardware miss to tc action net/sched: flower: Move filter handle initialization earlier net/sched: cls_api: Support hardware miss to tc action net/sched: Rename user cookie and act cookie sfc: fix builds without CONFIG_RTC_LIB sfc: clean up some inconsistent indentings net/mlx4_en: Introduce flexible array to silence overflow warning net: lan966x: Fix possible deadlock inside PTP net/ulp: Remove redundant ->clone() test in inet_clone_ulp(). ... commit 36289a03bcd3aabdf66de75cb6d1b4ee15726438 Merge: 69308402ca6f5 8b84475318641 Author: Linus Torvalds Date: Tue Feb 21 18:10:50 2023 -0800 Merge tag 'v6.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto update from Herbert Xu: "API: - Use kmap_local instead of kmap_atomic - Change request callback to take void pointer - Print FIPS status in /proc/crypto (when enabled) Algorithms: - Add rfc4106/gcm support on arm64 - Add ARIA AVX2/512 support on x86 Drivers: - Add TRNG driver for StarFive SoC - Delete ux500/hash driver (subsumed by stm32/hash) - Add zlib support in qat - Add RSA support in aspeed" * tag 'v6.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (156 commits) crypto: x86/aria-avx - Do not use avx2 instructions crypto: aspeed - Fix modular aspeed-acry crypto: hisilicon/qm - fix coding style issues crypto: hisilicon/qm - update comments to match function crypto: hisilicon/qm - change function names crypto: hisilicon/qm - use min() instead of min_t() crypto: hisilicon/qm - remove some unused defines crypto: proc - Print fips status crypto: crypto4xx - Call dma_unmap_page when done crypto: octeontx2 - Fix objects shared between several modules crypto: nx - Fix sparse warnings crypto: ecc - Silence sparse warning tls: Pass rec instead of aead_req into tls_encrypt_done crypto: api - Remove completion function scaffolding tls: Remove completion function scaffolding tipc: Remove completion function scaffolding net: ipv6: Remove completion function scaffolding net: ipv4: Remove completion function scaffolding net: macsec: Remove completion function scaffolding dm: Remove completion function scaffolding ... commit 69308402ca6f5b80a5a090ade0b13bd146891420 Merge: 5f5ce6bcfcc3a 0d9bdd8a55017 Author: Linus Torvalds Date: Tue Feb 21 17:32:50 2023 -0800 Merge tag 'platform-drivers-x86-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: - AMD PMC: Improvements to aid s2idle debugging - Dell WMI-DDV: hwmon support - INT3472 camera sensor power-management: Improve privacy LED support - Intel VSEC: Base TPMI (Topology Aware Register and PM Capsule Interface) support - Mellanox: SN5600 and Nvidia L1 switch support - Microsoft Surface Support: Various cleanups + code improvements - tools/intel-speed-select: Various improvements - Miscellaneous other cleanups / fixes * tag 'platform-drivers-x86-v6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (80 commits) platform/x86: nvidia-wmi-ec-backlight: Add force module parameter platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY platform/x86: dell-ddv: Prefer asynchronous probing platform/x86: dell-ddv: Add hwmon support Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces platform: mellanox: mlx-platform: Move bus shift assignment out of the loop platform: mellanox: mlx-platform: Add mux selection register to regmap platform_data/mlxreg: Add field with mapped resource address platform/mellanox: mlxreg-hotplug: Allow more flexible hotplug events configuration platform: mellanox: Extend all systems with I2C notification callback platform: mellanox: Split logic in init and exit flow platform: mellanox: Split initialization procedure platform: mellanox: Introduce support of new Nvidia L1 switch platform: mellanox: Introduce support for next-generation 800GB/s switch platform: mellanox: Cosmetic changes - rename to more common name platform: mellanox: Change "reset_pwr_converter_fail" attribute platform: mellanox: Introduce support for rack manager switch MAINTAINERS: dell-wmi-sysman: drop Divya Bharathi x86/platform/uv: Make kobj_type structure constant platform/x86: think-lmi: Make kobj_type structure constant ... commit a3c7d6b642e4b4619f220bf43e8b78c34ffaecf1 Author: Guo Ren Date: Tue Jan 31 20:52:59 2023 -0500 riscv: mm: hugetlb: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP Add HVO support for RISC-V; see commit 6be24bed9da3 ("mm: hugetlb: introduce a new config HUGETLB_PAGE_FREE_VMEMMAP"). This patch is similar to commit 1e63ac088f20 ("arm64: mm: hugetlb: enable HUGETLB_PAGE_FREE_VMEMMAP for arm64"), and riscv's motivation is the same as arm64. The current riscv was ready to enable HVO after fixup, ref commit d33deda095d3 ("riscv/mm: hugepage's PG_dcache_clean flag is only set in head page"). See Documentation/mm/vmemmap_dedup.rst for more details. The HugeTLB VmemmapvOptimization (HVO) defaults to off in Kconfig. Here is the riscv test log: cat /proc/sys/vm/hugetlb_optimize_vmemmap echo 8 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages mount -t hugetlbfs none test/ -o pagesize=2048k Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/linux-riscv/1F5AF29D-708A-483B-A29F-CAEE6F554866@linux.dev/ Acked-by: Muchun Song Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230201015259.3222524-1-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 5f5ce6bcfcc3abbaf690fca30a22d0dcf6f36d32 Merge: 239451e90355b b0d8a67715dae Author: Linus Torvalds Date: Tue Feb 21 17:23:39 2023 -0800 Merge tag 'tag-chrome-platform-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New drivers: - cros_ec_uart for ChromeOS EC protocol over UART - cros_typec_vdm for USB PD Vendor Defined Message Improvements: - Preserve logs as much as possible when EC panics - Shutdown to refrain from potential HW damages when EC panics Fixes: - Fix DP_PORT_VDO to include DP_CAP_RECEPTACLE - Fix a lockdep false positive Cleanups: - Use sysfs_emit*() instead of scnprintf() - Use asm instead of asm-generic for unaligned.h Misc: - Rename module name from cros_ec_typec to cros-ec-typec - Minor fixes" * tag 'tag-chrome-platform-for-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: (34 commits) platform/chrome: cros_ec_typec: Fix spelling mistake platform/chrome: cros_typec_vdm: Add Attention support platform/chrome: cros_ec: Add VDM attention headers platform/chrome: cros_typec_vdm: Fix VDO copy platform/chrome: cros_ec_typec: allow deferred probe of switch handles platform/chrome: cros_ec_proto: remove big stub objects from stack platform/chrome: cros_ec_uart: fix negative type promoted to high platform/chrome: cros_ec: Use per-device lockdep key platform/chrome: fix kernel-doc warnings for cros_ec_command platform/chrome: fix kernel-doc warning for last_resume_result platform/chrome: fix kernel-doc warning for suspend_timeout_ms platform/chrome: fix kernel-doc warnings for panic notifier platform/chrome: cros_ec_lpc: initialize the buf variable platform/chrome: cros_ec: Fix panic notifier registration platform/chrome: cros_typec_switch: Check for retimer flag platform/chrome: cros_typec_switch: Use fwnode* prop check platform/chrome: cros_typec_vdm: Add VDM send support platform/chrome: cros_typec_vdm: Add VDM reply support platform/chrome: cros_ec_typec: Add initial VDM support platform/chrome: cros_ec_typec: Alter module name with hyphens ... commit 8ac6e619d9d51b3eb5bae817db8aa94e780a0db4 Author: Liao Chang Date: Sun Jan 29 17:42:42 2023 +0800 riscv: Add header include guards to insn.h Add header include guards to insn.h to prevent repeating declaration of any identifiers in insn.h. Fixes: edde5584c7ab ("riscv: Add SW single-step support for KDB") Signed-off-by: Liao Chang Reviewed-by: Andrew Jones Fixes: c9c1af3f186a ("RISC-V: rename parse_asm.h to insn.h") Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230129094242.282620-1-liaochang1@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit b19aa282c50344bbac8e50592b21bac624c51d5d Merge: 91612cfb17361 00b242509c8f2 Author: Palmer Dabbelt Date: Tue Feb 21 16:53:58 2023 -0800 Merge patch series "riscv: Dump faulting instructions in oops handler" Björn Töpel says: From: Björn Töpel RISC-V does not dump faulting instructions in the oops handler. This series adds "Code:" dumps to the oops output together with scripts/decodecode support. * b4-shazam-merge: scripts/decodecode: Add support for RISC-V riscv: Add instruction dump to RISC-V splats Link: https://lore.kernel.org/r/20230119074738.708301-1-bjorn@kernel.org Signed-off-by: Palmer Dabbelt commit 91612cfb173619b38087449cd3811f9cb4420d94 Author: Jisheng Zhang Date: Mon Jan 16 00:28:11 2023 +0800 riscv: alternative: proceed one more instruction for auipc/jalr pair If we patched auipc + jalr pair, we'd better proceed one more instruction. Andrew pointed out "There's not a problem now, since we're only adding a fixup for jal, not jalr, but we should future-proof this and there's no reason to revisit an already fixed-up instruction anyway." Signed-off-by: Jisheng Zhang Suggested-by: Andrew Jones Reviewed-by: Andrew Jones Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20230115162811.3146-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit f3af3b0039fe4760fe89a05beb4a0bebbda25ac8 Merge: 130aee3fd9981 f4b71bff8d858 Author: Palmer Dabbelt Date: Tue Feb 21 16:29:10 2023 -0800 Merge patch series "riscv: improve link and support ARCH_WANT_LD_ORPHAN_WARN" Jisheng Zhang says: This series tries to improve link time handling of riscv: patch1 adds the missing RUNTIME_DISCARD_EXIT as suggested by Masahiro. Similar as other architectures such as x86, arm64 and so on, enable ARCH_WANT_LD_ORPHAN_WARN to enable linker orphan warnings to prevent from missing any new sections in future. So the following two patches are preparation ones, and the last patch finally selects ARCH_WANT_LD_ORPHAN_WARN * b4-shazam-merge: riscv: select ARCH_WANT_LD_ORPHAN_WARN for !XIP_KERNEL riscv: vmlinux.lds.S: explicitly catch .init.bss sections from EFI stub riscv: vmlinux.lds.S: explicitly catch .riscv.attributes sections riscv: vmlinux.lds.S: explicitly catch .rela.dyn symbols riscv: lds: define RUNTIME_DISCARD_EXIT Link: https://lore.kernel.org/r/20230119155417.2600-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 130aee3fd9981297ff9354e5d5609cd59aafbbea Author: Mattias Nissler Date: Wed Feb 15 14:48:28 2023 +0000 riscv: Avoid enabling interrupts in die() While working on something else, I noticed that the kernel would start accepting interrupts again after crashing in an interrupt handler. Since the kernel is already in inconsistent state, enabling interrupts is dangerous and opens up risk of kernel state deteriorating further. Interrupts do get enabled via what looks like an unintended side effect of spin_unlock_irq, so switch to the more cautious spin_lock_irqsave/spin_unlock_irqrestore instead. Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") Signed-off-by: Mattias Nissler Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230215144828.3370316-1-mnissler@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 416721ff05fddc58ca531b6f069de250301de6e5 Author: Björn Töpel Date: Tue Feb 14 17:25:15 2023 +0100 riscv, mm: Perform BPF exhandler fixup on page fault Commit 21855cac82d3 ("riscv/mm: Prevent kernel module to access user memory without uaccess routines") added early exits/deaths for page faults stemming from accesses to user-space without using proper uaccess routines (where sstatus.SUM is set). Unfortunatly, this is too strict for some BPF programs, which relies on BPF exhandler fixups. These BPF programs loads "BTF pointers". A BTF pointers could either be a valid kernel pointer or NULL, but not a userspace address. Resolve the problem by calling the fixup handler in the early exit path. Fixes: 21855cac82d3 ("riscv/mm: Prevent kernel module to access user memory without uaccess routines") Signed-off-by: Björn Töpel Link: https://lore.kernel.org/r/20230214162515.184827-1-bjorn@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 9493e6f3ce02f44c21aa19f3cbf3b9aa05479d06 Author: Conor Dooley Date: Sun Feb 12 19:47:36 2023 +0000 RISC-V: take text_mutex during alternative patching Guenter reported a splat during boot, that Samuel pointed out was the lockdep assertion failing in patch_insn_write(): WARNING: CPU: 0 PID: 0 at arch/riscv/kernel/patch.c:63 patch_insn_write+0x222/0x2f6 epc : patch_insn_write+0x222/0x2f6 ra : patch_insn_write+0x21e/0x2f6 epc : ffffffff800068c6 ra : ffffffff800068c2 sp : ffffffff81803df0 gp : ffffffff81a1ab78 tp : ffffffff81814f80 t0 : ffffffffffffe000 t1 : 0000000000000001 t2 : 4c45203a76637369 s0 : ffffffff81803e40 s1 : 0000000000000004 a0 : 0000000000000000 a1 : ffffffffffffffff a2 : 0000000000000004 a3 : 0000000000000000 a4 : 0000000000000001 a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000052464e43 s2 : ffffffff80b4889c s3 : 000000000000082c s4 : ffffffff80b48828 s5 : 0000000000000828 s6 : ffffffff8131a0a0 s7 : 0000000000000fff s8 : 0000000008000200 s9 : ffffffff8131a520 s10: 0000000000000018 s11: 000000000000000b t3 : 0000000000000001 t4 : 000000000000000d t5 : ffffffffd8180000 t6 : ffffffff81803bc8 status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [] patch_insn_write+0x222/0x2f6 [] patch_text_nosync+0xc/0x2a [] riscv_cpufeature_patch_func+0x52/0x98 [] _apply_alternatives+0x46/0x86 [] apply_boot_alternatives+0x3c/0xfa [] setup_arch+0x584/0x5b8 [] start_kernel+0xa2/0x8f8 This issue was exposed by 702e64550b12 ("riscv: fpu: switch has_fpu() to riscv_has_extension_likely()"), as it is the patching in has_fpu() that triggers the splats in Guenter's report. Take the text_mutex before doing any code patching to satisfy lockdep. Fixes: ff689fd21cb1 ("riscv: add RISC-V Svpbmt extension support") Fixes: a35707c3d850 ("riscv: add memory-type errata for T-Head") Fixes: 1a0e5dbd3723 ("riscv: sifive: Add SiFive alternative ports") Reported-by: Guenter Roeck Link: https://lore.kernel.org/all/20230212154333.GA3760469@roeck-us.net/ Signed-off-by: Conor Dooley Reviewed-by: Samuel Holland Tested-by: Guenter Roeck Link: https://lore.kernel.org/r/20230212194735.491785-1-conor@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit dac8bf14bb49aecd1de99ebb5498fa03152f2d40 Author: Andrew Jones Date: Thu Feb 9 13:36:36 2023 +0100 riscv: hwcap: Don't alphabetize ISA extension IDs While the comment above the ISA extension ID definitions says "Entries are sorted alphabetically.", this stopped being good advice with commit d8a3d8a75206 ("riscv: hwcap: make ISA extension ids can be used in asm"), as we now use macros instead of enums. Reshuffling defines is error-prone, so, since they don't need to be in any particular order, change the advice to just adding new extensions at the bottom. Also, take the opportunity to change spaces to tabs, merge three comments into one, and move the base and max defines into more logical locations wrt the ID definitions. Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230209123636.123537-1-ajones@ventanamicro.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 1eac28201ac0725192f5ced34192d281a06692e5 Author: Heiko Stuebner Date: Wed Feb 8 23:53:27 2023 +0100 RISC-V: fix ordering of Zbb extension As Andrew reported, Zb* comes after Zi* according 27.11 "Subset Naming Convention" so fix the ordering accordingly. Reported-by: Andrew Jones Signed-off-by: Heiko Stuebner Reviewed-by: Conor Dooley Reviewed-by: Andrew Jones Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230208225328.1636017-2-heiko@sntech.de Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 9ddfc3cd806081ce1f6c9c2f988cbb031f35d28f Author: Andy Chiu Date: Mon Feb 6 04:04:40 2023 -0500 riscv: jump_label: Fixup unaligned arch_static_branch function Runtime code patching must be done at a naturally aligned address, or we may execute on a partial instruction. We have encountered problems traced back to static jump functions during the test. We switched the tracer randomly for every 1~5 seconds on a dual-core QEMU setup and found the kernel sucking at a static branch where it jumps to itself. The reason is that the static branch was 2-byte but not 4-byte aligned. Then, the kernel would patch the instruction, either J or NOP, with two half-word stores if the machine does not have efficient unaligned accesses. Thus, moments exist where half of the NOP mixes with the other half of the J when transitioning the branch. In our particular case, on a little-endian machine, the upper half of the NOP was mixed with the lower part of the J when enabling the branch, resulting in a jump that jumped to itself. Conversely, it would result in a HINT instruction when disabling the branch, but it might not be observable. ARM64 does not have this problem since all instructions must be 4-byte aligned. Fixes: ebc00dde8a97 ("riscv: Add jump-label implementation") Link: https://lore.kernel.org/linux-riscv/20220913094252.3555240-6-andy.chiu@sifive.com/ Reviewed-by: Greentime Hu Signed-off-by: Andy Chiu Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20230206090440.1255001-1-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 2350bd192fa2d9ffa7a0dc7db12699c0f71af7f8 Author: Palmer Dabbelt Date: Thu Feb 2 15:38:32 2023 -0800 RISC-V: Only provide the single-letter extensions in HWCAP The recent refactoring led to us leaking some HWCAP bits to userspace that didn't make much sense. With any luck we'll have a better scheme soon, but for now just mask off those bits to avoid polluting userspace. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230202233832.11036-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit b49f700668fff7565b945dce823def79bff59bb0 Author: Sergey Matyukevich Date: Mon Jan 30 00:18:18 2023 +0300 riscv: mm: fix regression due to update_mmu_cache change This is a partial revert of the commit 4bd1d80efb5a ("riscv: mm: notify remote harts about mmu cache updates"). Original commit included two loosely related changes serving the same purpose of fixing stale TLB entries causing user-space application crash: - introduce deferred per-ASID TLB flush for CPUs not running the task - switch to per-ASID TLB flush on all CPUs running the task in update_mmu_cache According to report and discussion in [1], the second part caused a regression on Renesas RZ/Five SoC. For now restore the old behavior of the update_mmu_cache. [1] https://lore.kernel.org/linux-riscv/20220829205219.283543-1-geomatsi@gmail.com/ Fixes: 4bd1d80efb5a ("riscv: mm: notify remote harts about mmu cache updates") Reported-by: "Lad, Prabhakar" Signed-off-by: Sergey Matyukevich Link: trailer, so that it can be parsed with git's trailer functionality? Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230129211818.686557-1-geomatsi@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 239451e90355be68130410ef8fadef8cd130a35d Merge: b8878e5a5c62a 4ecc96cba8d93 Author: Linus Torvalds Date: Tue Feb 21 17:07:39 2023 -0800 Merge tag 'for-linus-6.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - help deprecate the /proc/xen files by making the related information available via sysfs - mark the Xen variants of play_dead "noreturn" - support a shared Xen platform interrupt - several small cleanups and fixes * tag 'for-linus-6.3-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: sysfs: make kobj_type structure constant x86/Xen: drop leftover VM-assist uses xen: Replace one-element array with flexible-array member xen/grant-dma-iommu: Implement a dummy probe_device() callback xen/pvcalls-back: fix permanently masked event channel xen: Allow platform PCI interrupt to be shared x86/xen/time: prefer tsc as clocksource when it is invariant x86/xen: mark xen_pv_play_dead() as __noreturn x86/xen: don't let xen_pv_play_dead() return drivers/xen/hypervisor: Expose Xen SIF flags to userspace commit ddad47bfb9552e246ed19ca776d356ee88014af3 Merge: 4090871d77262 eb98192576315 Author: Paolo Bonzini Date: Tue Feb 21 20:00:44 2023 -0500 Merge tag 'kvm-x86-apic-6.3' of https://github.com/kvm-x86/linux into HEAD KVM x86 APIC changes for 6.3: - Remove a superfluous variables from apic_get_tmcct() - Fix various edge cases in x2APIC MSR emulation - Mark APIC timer as expired if its in one-shot mode and the count underflows while the vCPU task was being migrated - Reset xAPIC when userspace forces "impossible" x2APIC => xAPIC transition commit b8878e5a5c62a16ad491ba664a9c1efff62e9a99 Merge: 8bf1a529cd664 b14033a3e6ba7 Author: Linus Torvalds Date: Tue Feb 21 16:59:23 2023 -0800 Merge tag 'hyperv-next-signed-20230220' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv updates from Wei Liu: - allow Linux to run as the nested root partition for Microsoft Hypervisor (Jinank Jain and Nuno Das Neves) - clean up the return type of callback functions (Dawei Li) * tag 'hyperv-next-signed-20230220' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: x86/hyperv: Fix hv_get/set_register for nested bringup Drivers: hv: Make remove callback of hyperv driver void returned Drivers: hv: Enable vmbus driver for nested root partition x86/hyperv: Add an interface to do nested hypercalls Drivers: hv: Setup synic registers in case of nested root partition x86/hyperv: Add support for detecting nested hypervisor commit 00b242509c8f2b9041c4c16d67d51eae3c9ab1d9 Author: Björn Töpel Date: Thu Jan 19 08:47:38 2023 +0100 scripts/decodecode: Add support for RISC-V RISC-V has some GNU disassembly quirks, e.g. it requires '-D' to properly disassemble .2byte directives similar to Arm [1]. Further, GNU objdump groups RISC-V instruction by 2 or 4 byte chunks, instead doing byte-for-byte. Add the required switches, and translate from short/word to bytes when ARCH is "riscv". An example how to invoke decodecode for RISC-V: $ echo 'Code: bf45 f793 1007 f7d9 50ef 37af d541 b7d9 7097 00c8 (80e7) 6140' | AFLAGS="-march=rv64imac_zicbom_zihintpause" \ ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- ./scripts/decodecode Code: bf45 f793 1007 f7d9 50ef 37af d541 b7d9 7097 00c8 (80e7) 6140 All code ======== 0: bf45 c.j 0xffffffffffffffb0 2: 1007f793 andi a5,a5,256 6: f7d9 c.bnez a5,0xffffffffffffff94 8: 37af50ef jal ra,0xf5382 c: d541 c.beqz a0,0xffffffffffffff94 e: b7d9 c.j 0xffffffffffffffd4 10: 00c87097 auipc ra,0xc87 14:* 614080e7 jalr ra,1556(ra) # 0xc87624 <-- trapping instruction Code starting with the faulting instruction =========================================== 0: 614080e7 jalr ra,1556(ra) [1] https://sourceware.org/bugzilla/show_bug.cgi?id=10263 Signed-off-by: Björn Töpel Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230119074738.708301-3-bjorn@kernel.org Signed-off-by: Palmer Dabbelt commit eb165bfa8eafc3d306e34b238e53aafb35dce102 Author: Björn Töpel Date: Thu Jan 19 08:47:37 2023 +0100 riscv: Add instruction dump to RISC-V splats Add instruction dump (Code:) output to RISC-V splats. Dump 16b parcels. An example: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Oops [#1] Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.2.0-rc3-00302-g840ff44c571d-dirty #27 Hardware name: riscv-virtio,qemu (DT) epc : kernel_init+0xc8/0x10e ra : kernel_init+0x70/0x10e epc : ffffffff80bd9a40 ra : ffffffff80bd99e8 sp : ff2000000060bec0 gp : ffffffff81730b28 tp : ff6000007ff00000 t0 : 7974697275636573 t1 : 0000000000000000 t2 : 3030303270393d6e s0 : ff2000000060bee0 s1 : ffffffff81732028 a0 : 0000000000000000 a1 : ff60000080dd1780 a2 : 0000000000000002 a3 : ffffffff8176a470 a4 : 0000000000000000 a5 : 000000000000000a a6 : 0000000000000081 a7 : ff60000080dd1780 s2 : 0000000000000000 s3 : 0000000000000000 s4 : 0000000000000000 s5 : 0000000000000000 s6 : 0000000000000000 s7 : 0000000000000000 s8 : 0000000000000000 s9 : 0000000000000000 s10: 0000000000000000 s11: 0000000000000000 t3 : ffffffff81186018 t4 : 0000000000000022 t5 : 000000000000003d t6 : 0000000000000000 status: 0000000200000120 badaddr: 0000000000000000 cause: 000000000000000f [] ret_from_exception+0x0/0x16 Code: 862a d179 608c a517 0069 0513 2be5 d0ef db2e 47a9 (c11c) a517 ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b SMP: stopping secondary CPUs ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- Signed-off-by: Björn Töpel Link: https://lore.kernel.org/r/20230119074738.708301-2-bjorn@kernel.org Signed-off-by: Palmer Dabbelt commit f4b71bff8d8580eaaf56ec6c5305542a3d3a04bd Author: Jisheng Zhang Date: Thu Jan 19 23:54:17 2023 +0800 riscv: select ARCH_WANT_LD_ORPHAN_WARN for !XIP_KERNEL Now, after that all the sections are explicitly described and declared in vmlinux.lds.S, we can enable ld orphan warnings for !XIP_KERNEL to prevent from missing any new sections in future. Signed-off-by: Jisheng Zhang Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230119155417.2600-6-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 0ed0031b093b19ee46afc0a5517184932401e074 Author: Jisheng Zhang Date: Thu Jan 19 23:54:16 2023 +0800 riscv: vmlinux.lds.S: explicitly catch .init.bss sections from EFI stub When enabling linker orphan section warning, I got warnings similar as below: ld.lld: warning: ./drivers/firmware/efi/libstub/lib.a(efi-stub-helper.stub.o):(.init.bss) is being placed in '.init.bss' Catch the sections so that we can enable linker orphan section warning. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20230119155417.2600-5-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit b13e64d94149c0e2981ef5d0bb496b73c48588ca Author: Jisheng Zhang Date: Thu Jan 19 23:54:15 2023 +0800 riscv: vmlinux.lds.S: explicitly catch .riscv.attributes sections When enabling linker orphan section warning, I got warnings similar as below: riscv64-linux-gnu-ld: warning: orphan section `.riscv.attributes' from `init/main.o' being placed in section `.riscv.attributes' While I don't see any usage of .riscv.attributes sections' in kernel now, just catch the sections so that we can enable linker orphan section warning. Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20230119155417.2600-4-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit e5973191a8e33ffadef4882a261130866a1e70dc Author: Jisheng Zhang Date: Thu Jan 19 23:54:14 2023 +0800 riscv: vmlinux.lds.S: explicitly catch .rela.dyn symbols When enabling linker orphan section warning, I got warnings similar as below: riscv64-linux-gnu-ld: warning: orphan section `.rela.text' from `init/main.o' being placed in section `.rela.dyn' Use the approach similar as ARM64 does and declare it in vmlinux.lds.S Signed-off-by: Jisheng Zhang Link: https://lore.kernel.org/r/20230119155417.2600-3-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 7e92586c28a50dd5875655c0d169184a5acb0eee Author: Jisheng Zhang Date: Thu Jan 19 23:54:13 2023 +0800 riscv: lds: define RUNTIME_DISCARD_EXIT riscv discards .exit.* sections at run-time but doesn't define RUNTIME_DISCARD_EXIT. However, the .exit.* sections are still allocated and kept even if the generic DISCARDS would discard the sections due to missing RUNTIME_DISCARD_EXIT, because the DISCARD sits at the end of the linker script. Add the missing RUNTIME_DISCARD_EXIT define so that it still works if we move DISCARD up or even at the beginning of the linker script. Signed-off-by: Jisheng Zhang Suggested-by: Masahiro Yamada Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230119155417.2600-2-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit fdf6491193e411087ae77bcbc6468e3e1cff99ed Author: Florian Westphal Date: Mon Feb 20 17:24:00 2023 +0100 netfilter: ctnetlink: make event listener tracking global pernet tracking doesn't work correctly because other netns might have set NETLINK_LISTEN_ALL_NSID on its event socket. In this case its expected that events originating in other net namespaces are also received. Making pernet-tracking work while also honoring NETLINK_LISTEN_ALL_NSID requires much more intrusive changes both in netlink and nfnetlink, f.e. adding a 'setsockopt' callback that lets nfnetlink know that the event socket entered (or left) ALL_NSID mode. Move to global tracking instead: if there is an event socket anywhere on the system, all net namespaces which have conntrack enabled and use autobind mode will allocate the ecache extension. netlink_has_listeners() returns false only if the given group has no subscribers in any net namespace, the 'net' argument passed to nfnetlink_has_listeners is only used to derive the protocol (nfnetlink), it has no other effect. For proper NETLINK_LISTEN_ALL_NSID-aware pernet tracking of event listeners a new netlink_has_net_listeners() is also needed. Fixes: 90d1daa45849 ("netfilter: conntrack: add nf_conntrack_events autodetect mode") Reported-by: Bryce Kahle Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 05c07c0c6cc8ec2278ace9871618c41f1365d1f5 Author: Xin Long Date: Fri Feb 17 18:22:57 2023 -0500 netfilter: xt_length: use skb len to match in length_mt6 For IPv6 Jumbo packets, the ipv6_hdr(skb)->payload_len is always 0, and its real payload_len ( > 65535) is saved in hbh exthdr. With 0 length for the jumbo packets, it may mismatch. To fix this, we can just use skb->len instead of parsing exthdrs, as the hbh exthdr parsing has been done before coming to length_mt6 in ip6_rcv_core() and br_validate_ipv6() and also the packet has been trimmed according to the correct IPv6 (ext)hdr length there, and skb len is trustable in length_mt6(). Note that this patch is especially needed after the IPv6 BIG TCP was supported in kernel, which is using IPv6 Jumbo packets. Besides, to match the packets greater than 65535 more properly, a v1 revision of xt_length may be needed to extend "min, max" to u32 in the future, and for now the IPv6 Jumbo packets can be matched by: # ip6tables -m length ! --length 0:65535 Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536") Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536") Signed-off-by: Xin Long Signed-off-by: Pablo Neira Ayuso commit 6c40624930c58529185a257380442547580ed837 Author: Souradeep Chowdhury Date: Wed Feb 22 08:27:49 2023 +0900 bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support The Data Capture and Compare(DCC) is a debugging tool that uses the bootconfig for configuring the register values during boot-time. Increase the max nodes supported by bootconfig to cater to the requirements of the Data Capture and Compare Driver. Link: https://lore.kernel.org/all/1674536682-18404-1-git-send-email-quic_schowdhu@quicinc.com/ Signed-off-by: Souradeep Chowdhury Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 6ded8a28ed80e4cc666f1a3f999b1c7e6f011cdd Author: Paul E. McKenney Date: Wed Feb 22 08:27:49 2023 +0900 bootconfig: Default BOOT_CONFIG_FORCE to y if BOOT_CONFIG_EMBED When a kernel is built with CONFIG_BOOT_CONFIG_EMBED=y, the intention will normally be to unconditionally provide the specified kernel-boot arguments to the kernel, as opposed to requiring a separately provided bootconfig parameter. Therefore, make the BOOT_CONFIG_FORCE Kconfig option default to y in kernels built with CONFIG_BOOT_CONFIG_EMBED=y. The old semantics may be obtained by manually overriding this default. Link: https://lore.kernel.org/all/20230107162202.GA4028633@paulmck-ThinkPad-P17-Gen-1/ Suggested-by: Masami Hiramatsu Signed-off-by: Paul E. McKenney Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 8bf1a529cd664c8e5268381f1e24fe67aa611dd3 Merge: b327dfe05258e d54170812ef1c Author: Linus Torvalds Date: Tue Feb 21 15:27:48 2023 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: - Support for arm64 SME 2 and 2.1. SME2 introduces a new 512-bit architectural register (ZT0, for the look-up table feature) that Linux needs to save/restore - Include TPIDR2 in the signal context and add the corresponding kselftests - Perf updates: Arm SPEv1.2 support, HiSilicon uncore PMU updates, ACPI support to the Marvell DDR and TAD PMU drivers, reset DTM_PMU_CONFIG (ARM CMN) at probe time - Support for DYNAMIC_FTRACE_WITH_CALL_OPS on arm64 - Permit EFI boot with MMU and caches on. Instead of cleaning the entire loaded kernel image to the PoC and disabling the MMU and caches before branching to the kernel bare metal entry point, leave the MMU and caches enabled and rely on EFI's cacheable 1:1 mapping of all of system RAM to populate the initial page tables - Expose the AArch32 (compat) ELF_HWCAP features to user in an arm64 kernel (the arm32 kernel only defines the values) - Harden the arm64 shadow call stack pointer handling: stash the shadow stack pointer in the task struct on interrupt, load it directly from this structure - Signal handling cleanups to remove redundant validation of size information and avoid reading the same data from userspace twice - Refactor the hwcap macros to make use of the automatically generated ID registers. It should make new hwcaps writing less error prone - Further arm64 sysreg conversion and some fixes - arm64 kselftest fixes and improvements - Pointer authentication cleanups: don't sign leaf functions, unify asm-arch manipulation - Pseudo-NMI code generation optimisations - Minor fixes for SME and TPIDR2 handling - Miscellaneous updates: ARCH_FORCE_MAX_ORDER is now selectable, replace strtobool() to kstrtobool() in the cpufeature.c code, apply dynamic shadow call stack in two passes, intercept pfn changes in set_pte_at() without the required break-before-make sequence, attempt to dump all instructions on unhandled kernel faults * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (130 commits) arm64: fix .idmap.text assertion for large kernels kselftest/arm64: Don't require FA64 for streaming SVE+ZA tests kselftest/arm64: Copy whole EXTRA context arm64: kprobes: Drop ID map text from kprobes blacklist perf: arm_spe: Print the version of SPE detected perf: arm_spe: Add support for SPEv1.2 inverted event filtering perf: Add perf_event_attr::config3 arm64/sme: Fix __finalise_el2 SMEver check drivers/perf: fsl_imx8_ddr_perf: Remove set-but-not-used variable arm64/signal: Only read new data when parsing the ZT context arm64/signal: Only read new data when parsing the ZA context arm64/signal: Only read new data when parsing the SVE context arm64/signal: Avoid rereading context frame sizes arm64/signal: Make interface for restore_fpsimd_context() consistent arm64/signal: Remove redundant size validation from parse_user_sigframe() arm64/signal: Don't redundantly verify FPSIMD magic arm64/cpufeature: Use helper macros to specify hwcaps arm64/cpufeature: Always use symbolic name for feature value in hwcaps arm64/sysreg: Initial unsigned annotations for ID registers arm64/sysreg: Initial annotation of signed ID registers ... commit b743852ccc1d9630bb07dc65ef185dab7e2984f6 Author: Paul E. McKenney Date: Wed Feb 22 08:27:48 2023 +0900 Allow forcing unconditional bootconfig processing The BOOT_CONFIG family of Kconfig options allows a bootconfig file containing kernel boot parameters to be embedded into an initrd or into the kernel itself. This can be extremely useful when deploying kernels in cases where some of the boot parameters depend on the kernel version rather than on the server hardware, firmware, or workload. Unfortunately, the "bootconfig" kernel parameter must be specified in order to cause the kernel to look for the embedded bootconfig file, and it clearly does not help to embed this "bootconfig" kernel parameter into that file. Therefore, provide a new BOOT_CONFIG_FORCE Kconfig option that causes the kernel to act as if the "bootconfig" kernel parameter had been specified. In other words, kernels built with CONFIG_BOOT_CONFIG_FORCE=y will look for the embedded bootconfig file even when the "bootconfig" kernel parameter is omitted. This permits kernel-version-dependent kernel boot parameters to be embedded into the kernel image without the need to (for example) update large numbers of boot loaders. Link: https://lore.kernel.org/all/20230105005838.GA1772817@paulmck-ThinkPad-P17-Gen-1/ Signed-off-by: Paul E. McKenney Cc: Masami Hiramatsu Cc: Jonathan Corbet Cc: Andrew Morton Cc: Nick Desaulniers Cc: Vlastimil Babka Cc: Johannes Weiner Cc: Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit cf8c59a3756b2735c409a9b3ac1e4ec556546a7a Author: Antonio Alvarez Feijoo Date: Wed Feb 22 08:27:35 2023 +0900 tools/bootconfig: fix single & used for logical condition A single & will create a background process and return true, so the grep command will run even if the file checked in the first condition does not exist. Link: https://lore.kernel.org/all/20230112114215.17103-1-antonio.feijoo@suse.com/ Fixes: 1eaad3ac3f39 ("tools/bootconfig: Use per-group/all enable option in ftrace2bconf script") Signed-off-by: Antonio Alvarez Feijoo Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 2b3795167e233dc9974f9f8239afb920f5cd4a32 Author: Fengnan Chang Date: Tue Feb 21 19:53:40 2023 +0800 scsi: sd: Remove unused sd_cdb_cache Since commit ce70fd9a551a ("scsi: core: Remove the cmd field from struct scsi_request") sd_cdb_cache is unused. Remove it. Link: https://lore.kernel.org/r/20230221115340.21201-1-changfengnan@bytedance.com Signed-off-by: Fengnan Chang Reviewed-by: John Garry Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit e58a171d35e32e6e8c37cfe0e8a94406732a331f Author: Florian Westphal Date: Fri Feb 17 23:20:06 2023 +0100 netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious. Fixes: c58dd2dd443c ("netfilter: Can't fail and free after table replacement") Reported-by: syzbot+f61594de72d6705aea03@syzkaller.appspotmail.com Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit efb056e5f1f0036179b2f92c1c15f5ea7a891d70 Author: Phil Sutter Date: Thu Feb 16 17:05:36 2023 +0100 netfilter: ip6t_rpfilter: Fix regression with VRF interfaces When calling ip6_route_lookup() for the packet arriving on the VRF interface, the result is always the real (slave) interface. Expect this when validating the result. Fixes: acc641ab95b66 ("netfilter: rpfilter/fib: Populate flowic_l3mdev field") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit b327dfe05258e09c8db6e1e091c2e6d84dd426a6 Merge: eb6d5bbea2fbf 5eb6e280432dd Author: Linus Torvalds Date: Tue Feb 21 15:21:29 2023 -0800 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM udpates from Russell King: - Improve Kconfig help text for Cortex A8 and Cortex A9 errata - Kconfig spelling and grammar fixes - Allow kernel-mode VFP/Neon in softirq context - Use Neon in softirq context - Implement AES-CTR/GHASH version of GCM * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9289/1: Allow pre-ARMv5 builds with ld.lld 16.0.0 and newer ARM: 9288/1: Kconfigs: fix spelling & grammar ARM: 9286/1: crypto: Implement fused AES-CTR/GHASH version of GCM ARM: 9285/1: remove meaningless arch/arm/mach-rda/Makefile ARM: 9283/1: permit non-nested kernel mode NEON in softirq context ARM: 9282/1: vfp: Manipulate task VFP state with softirqs disabled ARM: 9281/1: improve Cortex A8/A9 errata help text commit 2076f57f2ca0a2034afac7832257b2bc509c1a87 Author: Asutosh Das Date: Thu Feb 16 09:13:46 2023 -0800 scsi: ufs: mcq: Fix incorrectly set queue depth ufshcd_config_mcq() may change the can_queue value. The current code invokes scsi_add_host() before ufshcd_config_mcq() so the tags are limited to the original can_queue value. Fix this by invoking scsi_add_host() after ufshcd_config_mcq(). Link: https://lore.kernel.org/r/8840cea4a57b46dabce18acc39afc50ab826330f.1676567593.git.quic_asutoshd@quicinc.com Fixes: 2468da61ea09 ("scsi: ufs: core: mcq: Configure operation and runtime interface") Signed-off-by: Asutosh Das Reviewed-by: Bart Van Assche Reviewed-by: Manivannan Sadhasivam Signed-off-by: Martin K. Petersen commit e6d57e9ff0aec323717ee36fc9ea34ad89217151 Author: Florian Westphal Date: Tue Feb 14 17:23:59 2023 +0100 netfilter: conntrack: fix rmmod double-free race nf_conntrack_hash_check_insert() callers free the ct entry directly, via nf_conntrack_free. This isn't safe anymore because nf_conntrack_hash_check_insert() might place the entry into the conntrack table and then delteted the entry again because it found that a conntrack extension has been removed at the same time. In this case, the just-added entry is removed again and an error is returned to the caller. Problem is that another cpu might have picked up this entry and incremented its reference count. This results in a use-after-free/double-free, once by the other cpu and once by the caller of nf_conntrack_hash_check_insert(). Fix this by making nf_conntrack_hash_check_insert() not fail anymore after the insertion, just like before the 'Fixes' commit. This is safe because a racing nf_ct_iterate() has to wait for us to release the conntrack hash spinlocks. While at it, make the function return -EAGAIN in the rmmod (genid changed) case, this makes nfnetlink replay the command (suggested by Pablo Neira). Fixes: c56716c69ce1 ("netfilter: extensions: introduce extension genid count") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit eb6d5bbea2fbfaade9e29bf5ce4abe3a8384678f Merge: bcf5470eb4a13 1e5b5df65af99 Author: Linus Torvalds Date: Tue Feb 21 15:17:34 2023 -0800 Merge tag 'm68k-for-v6.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Add seccomp support - defconfig updates - Miscellaneous fixes and improvements * tag 'm68k-for-v6.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: /proc/hardware should depend on PROC_FS selftests/seccomp: Add m68k support m68k: Add kernel seccomp support m68k: Check syscall_trace_enter() return code m68k: defconfig: Update defconfigs for v6.2-rc3 m68k: q40: Do not initialise statics to 0 commit 19873b03f1daeffd9d5e089b855dd926975ab5b7 Author: Yangtao Li Date: Mon Feb 20 22:24:31 2023 +0800 scsi: ufs: ufs-mediatek: Guard power management functions with CONFIG_PM Fix the following compilation error when CONFIG_PM is set to 'n': drivers/ufs/host/ufs-mediatek.c: In function `ufs_mtk_runtime_suspend`: drivers/ufs/host/ufs-mediatek.c:1623:8: error: implicit declaration of function `ufshcd_runtime_suspend`; did you mean `ufs_mtk_runtime_suspend`? [-Werror=implicit-function-declaration] 1623 | ret = ufshcd_runtime_suspend(dev); | ^~~~~~~~~~~~~~~~~~~~~~ | ufs_mtk_runtime_suspend drivers/ufs/host/ufs-mediatek.c: In function `ufs_mtk_runtime_resume`: drivers/ufs/host/ufs-mediatek.c:1638:9: error: implicit declaration of function `ufshcd_runtime_resume`; did you mean `ufs_mtk_runtime_resume`? [-Werror=implicit-function-declaration] 1638 | return ufshcd_runtime_resume(dev); | ^~~~~~~~~~~~~~~~~~~~~ | ufs_mtk_runtime_resume At top level: drivers/ufs/host/ufs-mediatek.c:1632:12: error: `ufs_mtk_runtime_resume` defined but not used [-Werror=unused-function] 1632 | static int ufs_mtk_runtime_resume(struct device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ufs/host/ufs-mediatek.c:1618:12: error: `ufs_mtk_runtime_suspend` defined but not used [-Werror=unused-function] 1618 | static int ufs_mtk_runtime_suspend(struct device *dev) Link: https://lore.kernel.org/r/20230220142431.54589-1-frank.li@vivo.com Reported-by: k2ci Reported-by: Shida Zhang Signed-off-by: Yangtao Li Reviewed-by: Stanley Chu Signed-off-by: Martin K. Petersen commit 7dafc3e007918384c8693ff8d70381b5c1e9c247 Author: Adrien Thierry Date: Fri Feb 17 14:44:22 2023 -0500 scsi: ufs: core: Initialize devfreq synchronously During UFS initialization, devfreq initialization is asynchronous: ufshcd_async_scan() calls ufshcd_add_lus(), which in turn initializes devfreq for UFS. The simple ondemand governor is then loaded. If it is built as a module, request_module() is called and throws a warning: WARNING: CPU: 7 PID: 167 at kernel/kmod.c:136 __request_module+0x1e0/0x460 Modules linked in: crct10dif_ce llcc_qcom phy_qcom_qmp_usb ufs_qcom phy_qcom_snps_femto_v2 ufshcd_pltfrm phy_qcom_qmp_combo ufshcd_core phy_qcom_qmp_ufs qcom_wdt socinfo fuse ipv6 CPU: 7 PID: 167 Comm: kworker/u16:3 Not tainted 6.2.0-rc6-00009-g58706f7fb045 #1 Hardware name: Qualcomm SA8540P Ride (DT) Workqueue: events_unbound async_run_entry_fn pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __request_module+0x1e0/0x460 lr : __request_module+0x1d8/0x460 sp : ffff800009323b90 x29: ffff800009323b90 x28: 0000000000000000 x27: 0000000000000000 x26: ffff800009323d50 x25: ffff7b9045f57810 x24: ffff7b9045f57830 x23: ffffdc5a83e426e8 x22: ffffdc5ae80a9818 x21: 0000000000000001 x20: ffffdc5ae7502f98 x19: ffff7b9045f57800 x18: ffffffffffffffff x17: 312f716572667665 x16: 642f7366752e3030 x15: 0000000000000000 x14: 000000000000021c x13: 0000000000005400 x12: ffff7b9042ed7614 x11: ffff7b9042ed7600 x10: 00000000636c0890 x9 : 0000000000000038 x8 : ffff7b9045f2c880 x7 : ffff7b9045f57c68 x6 : 0000000000000080 x5 : 0000000000000000 x4 : 8000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : ffffdc5ae5d382f0 x0 : 0000000000000001 Call trace: __request_module+0x1e0/0x460 try_then_request_governor+0x7c/0x100 devfreq_add_device+0x4b0/0x5fc ufshcd_async_scan+0x1d4/0x310 [ufshcd_core] async_run_entry_fn+0x34/0xe0 process_one_work+0x1d0/0x320 worker_thread+0x14c/0x444 kthread+0x10c/0x110 ret_from_fork+0x10/0x20 This occurs because synchronous module loading from async is not allowed. According to __request_module(): /* * We don't allow synchronous module loading from async. Module * init may invoke async_synchronize_full() which will end up * waiting for this task which already is waiting for the module * loading to complete, leading to a deadlock. */ Such a deadlock was experienced on the Qualcomm QDrive3/sa8540p-ride. With DEVFREQ_GOV_SIMPLE_ONDEMAND=m, the boot hangs after the warning. Fix both the warning and the deadlock by moving devfreq initialization out of the async routine. Tested on the sa8540p-ride by using fio to put the UFS under load, and printing the trace generated by /sys/kernel/tracing/events/ufs/ufshcd_clk_scaling events. The trace looks similar with and without the change. Link: https://lore.kernel.org/r/20230217194423.42553-1-athierry@redhat.com Signed-off-by: Adrien Thierry Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit bcf5470eb4a13e5670fefb21525b43ef385c6fc6 Merge: 877934769e5b9 6472a2dcc4274 Author: Linus Torvalds Date: Tue Feb 21 15:09:17 2023 -0800 Merge tag 's390-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Large cleanup of the con3270/tty3270 driver. Among others this fixes: - Background Color Support - ASCII Line Character Support - VT100 Support - Geometries other than 80x24 - Cleanup and improve cmpxchg() code. Also add cmpxchg_user_key() to uaccess functions, which will be used by KVM to access KVM guest memory with a specific storage key - Add support for user space events counting to CPUMF - Cleanup the vfio/ccw code, which also allows now to properly support 2K Format-2 IDALs - Move kernel page table allocation and initialization to decompressor, which finally allows to enter the kernel with dynamic address translation enabled. This in turn allows to get rid of code with special handling in the kernel, which has to distinguish if DAT is on or off - Replace kretprobe with rethook - Various improvements to vfio/ap queue resets: - Use TAPQ to verify completion of a reset in progress rather than multiple invocations of ZAPQ. - Check TAPQ response codes when verifying successful completion of ZAPQ. - Fix erroneous handling of some error response codes. - Increase the maximum amount of time to wait for successful completion of ZAPQ - Rework system call wrappers to get rid of alias functions, which were only left on s390 - Cleanup diag288_wdt watchdog driver. It has been agreed on with Guenter Roeck that this goes upstream via the s390 tree - Add missing loadparm parameter handling for list-directed ECKD ipl/reipl - Various improvements to memory detection code - Remove arch_cpu_idle_time() since the current implementation is broken, and allows user space observable accounted idle times which can temporarily decrease - Add Reset DAT-Protection support: (only) allow to change PTEs from RO to RW with a new RDP instruction. Unlike the currently used IPTE instruction, this does not necessarily guarantee that TLBs of all CPUs are synchronously flushed; and that remote CPUs can see spurious protection faults. The overall improvement for not requiring an all CPU synchronization, like it is required with IPTE, should be beneficial - Fix KFENCE page fault reporting - Smaller cleanups and improvement all over the place * tag 's390-6.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (182 commits) s390/irq,idle: simplify idle check s390/processor: add test_and_set_cpu_flag() and test_and_clear_cpu_flag() s390/processor: let cpu helper functions return boolean values s390/kfence: fix page fault reporting s390/zcrypt: introduce ctfm field in struct CPRBX s390: remove confusing comment from uapi types header file vfio/ccw: remove WARN_ON during shutdown s390/entry: remove toolchain dependent micro-optimization s390/mem_detect: do not truncate online memory ranges info s390/vx: remove __uint128_t type from __vector128 struct again s390/mm: add support for RDP (Reset DAT-Protection) s390/mm: define private VM_FAULT_* reasons from top bits Documentation: s390: correct spelling s390/ap: fix status returned by ap_qact() s390/ap: fix status returned by ap_aqic() s390: vfio-ap: tighten the NIB validity check Revert "s390/mem_detect: do not update output parameters on failure" s390/idle: remove arch_cpu_idle_time() and corresponding code s390/vx: use simple assignments to access __vector128 members s390/vx: add 64 and 128 bit members to __vector128 struct ... commit ac4893980bbe79ce383daf9a0885666a30fe4c83 Author: Hangyu Hua Date: Fri Feb 10 15:17:30 2023 +0800 netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() nf_ct_put() needs to be called to put the refcount got by nf_conntrack_find_get() to avoid refcount leak when nf_conntrack_hash_check_insert() fails. Fixes: 7d367e06688d ("netfilter: ctnetlink: fix soft lockup when netlink adds new entries (v2)") Signed-off-by: Hangyu Hua Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 473025a6b6f8a4a8de3120c78588d32cf4ba7324 Author: Bart Van Assche Date: Thu Feb 9 10:49:03 2023 -0800 scsi: ufs: Make the TC G210 driver dependent on CONFIG_OF The TC G210 driver only supports devices declared in the device tree. Hence make this driver dependent on CONFIG_OF. This patch fixes the following compiler error: drivers/ufs/host/tc-dwc-g210-pltfrm.c:36:34: error: ‘tc_dwc_g210_pltfm_match’ defined but not used [-Werror=unused-const-variable=] 36 | static const struct of_device_id tc_dwc_g210_pltfm_match[] = { | Link: https://lore.kernel.org/r/20230209184914.2762172-1-bvanassche@acm.org Cc: Joao Pinto Signed-off-by: Bart Van Assche Reviewed-by: Bean Huo Signed-off-by: Martin K. Petersen commit 64fd2ba977b1b6b073bcf4c71906f820bc531421 Author: Muneendra Date: Wed Feb 8 19:43:26 2023 -0800 scsi: scsi_transport_fc: Add an additional flag to fc_host_fpin_rcv() The LLDD and the stack currently process FPINs received from the fabric, but the stack is not aware of any action taken by the driver to alleviate congestion. The current interface between the driver and the SCSI stack is limited to passing the notification mainly for statistics and heuristics. The reaction to an FPIN could be handled either by the driver or by the stack (marginal path and failover). Amend the interface to indicate if action on an FPIN has already been reacted to by the LLDDs or not. Add an additional flag to fc_host_fpin_rcv() to indicate if the FPIN has been acknowledged/reacted to by the driver. Also added a new event code FCH_EVT_LINK_FPIN_ACK to notify to the user that the event has been acknowledged/reacted by the LLDD driver Link: https://lore.kernel.org/r/20230209034326.882514-1-muneendra.kumar@broadcom.com Co-developed-by: Anil Gurumurthy Signed-off-by: Anil Gurumurthy Co-developed-by: Nilesh Javali Signed-off-by: Nilesh Javali Signed-off-by: Muneendra Reviewed-by: James Smart Reviewed-by: Himanshu Madhani Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen commit 1ba7dfb905b3975bdb8b9d1f7793efcdfc59385b Author: Saravanan Sekar Date: Wed Dec 7 18:37:14 2022 +0100 dt-bindings: regulator: Add mps,mpq7932 power-management IC Document mpq7932 power-management IC Signed-off-by: Saravanan Sekar Acked-by: Guenter Roeck Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221207173716.123223-3-saravanan@linumiz.com Signed-off-by: Rob Herring commit 877934769e5b91798d304d4641647900ee614ce8 Merge: 74e19ef0ff806 7914695743d59 Author: Linus Torvalds Date: Tue Feb 21 14:51:40 2023 -0800 Merge tag 'x86_cpu_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpuid updates from Borislav Petkov: - Cache the AMD debug registers in per-CPU variables to avoid MSR writes where possible, when supporting a debug registers swap feature for SEV-ES guests - Add support for AMD's version of eIBRS called Automatic IBRS which is a set-and-forget control of indirect branch restriction speculation resources on privilege change - Add support for a new x86 instruction - LKGS - Load kernel GS which is part of the FRED infrastructure - Reset SPEC_CTRL upon init to accomodate use cases like kexec which rediscover - Other smaller fixes and cleanups * tag 'x86_cpu_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/amd: Cache debug register values in percpu variables KVM: x86: Propagate the AMD Automatic IBRS feature to the guest x86/cpu: Support AMD Automatic IBRS x86/cpu, kvm: Add the SMM_CTL MSR not present feature x86/cpu, kvm: Add the Null Selector Clears Base feature x86/cpu, kvm: Move X86_FEATURE_LFENCE_RDTSC to its native leaf x86/cpu, kvm: Add the NO_NESTED_DATA_BP feature KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code x86/cpu, kvm: Add support for CPUID_80000021_EAX x86/gsseg: Add the new header to x86/gsseg: Use the LKGS instruction if available for load_gs_index() x86/gsseg: Move load_gs_index() to its own new header file x86/gsseg: Make asm_load_gs_index() take an u16 x86/opcode: Add the LKGS instruction to x86-opcode-map x86/cpufeature: Add the CPU feature bit for LKGS x86/bugs: Reset speculation control settings on init x86/cpu: Remove redundant extern x86_read_arch_cap_msr() commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 Author: Dave Hansen Date: Tue Feb 21 12:30:15 2023 -0800 uaccess: Add speculation barrier to copy_from_user() The results of "access_ok()" can be mis-speculated. The result is that you can end speculatively: if (access_ok(from, size)) // Right here even for bad from/size combinations. On first glance, it would be ideal to just add a speculation barrier to "access_ok()" so that its results can never be mis-speculated. But there are lots of system calls just doing access_ok() via "copy_to_user()" and friends (example: fstat() and friends). Those are generally not problematic because they do not _consume_ data from userspace other than the pointer. They are also very quick and common system calls that should not be needlessly slowed down. "copy_from_user()" on the other hand uses a user-controller pointer and is frequently followed up with code that might affect caches. Take something like this: if (!copy_from_user(&kernelvar, uptr, size)) do_something_with(kernelvar); If userspace passes in an evil 'uptr' that *actually* points to a kernel addresses, and then do_something_with() has cache (or other) side-effects, it could allow userspace to infer kernel data values. Add a barrier to the common copy_from_user() code to prevent mis-speculated values which happen after the copy. Also add a stub for architectures that do not define barrier_nospec(). This makes the macro usable in generic code. Since the barrier is now usable in generic code, the x86 #ifdef in the BPF code can also go away. Reported-by: Jordy Zomer Suggested-by: Linus Torvalds Signed-off-by: Dave Hansen Reviewed-by: Thomas Gleixner Acked-by: Daniel Borkmann # BPF bits Signed-off-by: Linus Torvalds commit 3fe97ff3d94934649abb0652028dd7296170c8d0 Author: James Bottomley Date: Sat Nov 28 15:27:21 2020 -0800 scsi: ses: Don't attach if enclosure has no components An enclosure with no components can't usefully be operated by the driver (since effectively it has nothing to manage), so report the problem and don't attach. Not attaching also fixes an oops which could occur if the driver tries to manage a zero component enclosure. [mkp: Switched to KERN_WARNING since this scenario is common] Link: https://lore.kernel.org/r/c5deac044ac409e32d9ad9968ce0dcbc996bfc7a.camel@linux.ibm.com Cc: stable@vger.kernel.org Reported-by: Ding Hui Signed-off-by: James Bottomley Signed-off-by: Martin K. Petersen commit 578797f0c8cbc2e3ec5fc0dab87087b4c7073686 Author: Tomas Henzl Date: Thu Feb 2 17:24:51 2023 +0100 scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013 When edev->components is zero, accessing edev->component[0] members is wrong. Link: https://lore.kernel.org/r/20230202162451.15346-5-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl Signed-off-by: Martin K. Petersen commit 801ab13d50cf3d26170ee073ea8bb4eececb76ab Author: Tomas Henzl Date: Thu Feb 2 17:24:50 2023 +0100 scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process(). Link: https://lore.kernel.org/r/20230202162451.15346-4-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl Signed-off-by: Martin K. Petersen commit db95d4df71cb55506425b6e4a5f8d68e3a765b63 Author: Tomas Henzl Date: Thu Feb 2 17:24:49 2023 +0100 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses Sanitize possible addl_desc_ptr out-of-bounds accesses in ses_enclosure_data_process(). Link: https://lore.kernel.org/r/20230202162451.15346-3-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl Signed-off-by: Martin K. Petersen commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd Author: Tomas Henzl Date: Thu Feb 2 17:24:48 2023 +0100 scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page. Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com Cc: stable@vger.kernel.org Signed-off-by: Tomas Henzl Signed-off-by: Martin K. Petersen commit f1aa2eb5ea05ccd1fd92d235346e60e90a1ed949 Author: Ondrej Mosnacek Date: Fri Feb 10 15:58:23 2023 +0100 sysctl: fix proc_dobool() usability Currently proc_dobool expects a (bool *) in table->data, but sizeof(int) in table->maxsize, because it uses do_proc_dointvec() directly. This is unsafe for at least two reasons: 1. A sysctl table definition may use { .data = &variable, .maxsize = sizeof(variable) }, not realizing that this makes the sysctl unusable (see the Fixes: tag) and that they need to use the completely counterintuitive sizeof(int) instead. 2. proc_dobool() will currently try to parse an array of values if given .maxsize >= 2*sizeof(int), but will try to write values of type bool by offsets of sizeof(int), so it will not work correctly with neither an (int *) nor a (bool *). There is no .maxsize validation to prevent this. Fix this by: 1. Constraining proc_dobool() to allow only one value and .maxsize == sizeof(bool). 2. Wrapping the original struct ctl_table in a temporary one with .data pointing to a local int variable and .maxsize set to sizeof(int) and passing this one to proc_dointvec(), converting the value to/from bool as needed (using proc_dou8vec_minmax() as an example). 3. Extending sysctl_check_table() to enforce proc_dobool() expectations. 4. Fixing the proc_dobool() docstring (it was just copy-pasted from proc_douintvec, apparently...). 5. Converting all existing proc_dobool() users to set .maxsize to sizeof(bool) instead of sizeof(int). Fixes: 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled") Fixes: a2071573d634 ("sysctl: introduce new proc handler proc_dobool") Signed-off-by: Ondrej Mosnacek Acked-by: Kees Cook Signed-off-by: Luis Chamberlain commit 1b72607d7321e66829e11148712b3a2ba1dc83e7 Merge: 88af9b164c7a2 6828e402d06f7 Author: Linus Torvalds Date: Tue Feb 21 12:32:05 2023 -0800 Merge tag 'thermal-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "The majority of changes here are related to the general switch-over to using arrays of generic trip point structures registered along with a thermal zone instead of trip point callbacks (this has been done mostly by Daniel Lezcano with some help from yours truly on the Intel drivers front). Apart from that and the related reorganization of code, there are some enhancements of the existing driver and a new Mediatek Low Voltage Thermal Sensor (LVTS) driver. The Intel powerclamp undergoes a major rework so it will use the generic idle_inject facility for CPU idle time injection going forward and it will take additional module parameters for specifying the subset of CPUs to be affected by it (work done by Srinivas Pandruvada). Also included are assorted fixes and a whole bunch of cleanups. Specifics: - Rework a large bunch of drivers to use the generic thermal trip structure and use the opportunity to do more cleanups by removing unused functions from the OF code (Daniel Lezcano) - Remove core header inclusion from drivers (Daniel Lezcano) - Fix some locking issues related to the generic thermal trip rework (Johan Hovold) - Fix a crash when requesting the critical temperature on tegra, which is related to the generic trip point work (Jon Hunter) - Clean up thermal device unregistration code (Viresh Kumar) - Fix and clean up thermal control core initialization error code paths (Daniel Lezcano) - Relocate the trip points handling code into a separate file (Daniel Lezcano) - Make the thermal core fail registration of thermal zones and cooling devices if the thermal class has not been registered (Rafael Wysocki) - Add trip point initialization helper functions for ACPI-defined trip points and modify two thermal drivers to use them (Rafael Wysocki, Daniel Lezcano) - Make the core thermal control code use sysfs_emit_at() instead of scnprintf() where applicable (ye xingchen) - Consolidate code accessing the Intel TCC (Thermal Control Circuitry) MSRs by introducing library functions for that and making the TCC-related code in thermal drivers use them (Zhang Rui) - Enhance the x86_pkg_temp_thermal driver to support dynamic tjmax changes (Zhang Rui) - Address an "unsigned expression compared with zero" warning in the intel_soc_dts_iosf thermal driver (Yang Li) - Update comments regarding two functions in the Intel Menlow thermal driver (Deming Wang) - Use sysfs_emit_at() instead of scnprintf() in the int340x thermal driver (ye xingchen) - Make the intel_pch thermal driver support the Wellsburg PCH (Tim Zimmermann) - Modify the intel_pch and processor_thermal_device_pci thermal drivers use generic trip point tables instead of thermal zone trip point callbacks (Daniel Lezcano) - Add production mode attribute sysfs attribute to the int340x thermal driver (Srinivas Pandruvada) - Rework dynamic trip point updates handling and locking in the int340x thermal driver (Rafael Wysocki) - Make the int340x thermal driver use a generic trip points table instead of thermal zone trip point callbacks (Rafael Wysocki, Daniel Lezcano) - Clean up and improve the int340x thermal driver (Rafael Wysocki) - Simplify and clean up the intel_pch thermal driver (Rafael Wysocki) - Fix the Intel powerclamp thermal driver and make it use the common idle injection framework (Srinivas Pandruvada) - Add two module parameters, cpumask and max_idle, to the Intel powerclamp thermal driver to allow it to affect only a specific subset of CPUs instead of all of them (Srinivas Pandruvada) - Make the Intel quark_dts thermal driver Use generic trip point objects instead of its own trip point representation (Daniel Lezcano) - Add toctree entry for thermal documents and fix two issues in the Intel powerclamp driver documentation (Bagas Sanjaya) - Use strscpy() to instead of strncpy() in the thermal core (Xu Panda) - Fix thermal_sampling_exit() (Vincent Guittot) - Add Mediatek Low Voltage Thermal Sensor (LVTS) driver (Balsam Chihi) - Add r8a779g0 RCar support to the rcar_gen3 thermal driver (Geert Uytterhoeven) - Fix useless call to set_trips() when resuming in the rcar_gen3 thermal control driver and add interrupt support detection at init time to it (Niklas Söderlund) - Fix memory corruption in the hi3660 thermal driver (Yongqin Liu) - Fix include path for libnl3 in pkg-config file for libthermal (Vibhav Pant) - Remove syscfg-based driver for st as the platform is not supported any more (Alain Volmat)" * tag 'thermal-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (135 commits) thermal/drivers/st: Remove syscfg based driver thermal: Remove core header inclusion from drivers tools/lib/thermal: Fix include path for libnl3 in pkg-config file. thermal/drivers/hisi: Drop second sensor hi3660 thermal/drivers/rcar_gen3_thermal: Fix device initialization thermal/drivers/rcar_gen3_thermal: Create device local ops struct thermal/drivers/rcar_gen3_thermal: Do not call set_trips() when resuming thermal/drivers/rcar_gen3: Add support for R-Car V4H dt-bindings: thermal: rcar-gen3-thermal: Add r8a779g0 support thermal/drivers/mediatek: Add the Low Voltage Thermal Sensor driver dt-bindings: thermal: mediatek: Add LVTS thermal controllers thermal/drivers/mediatek: Relocate driver to mediatek folder tools/lib/thermal: Fix thermal_sampling_exit() Documentation: powerclamp: Fix numbered lists formatting Documentation: powerclamp: Escape wildcard in cpumask description Documentation: admin-guide: Add toctree entry for thermal docs thermal: intel: powerclamp: Add two module parameters Documentation: admin-guide: Move intel_powerclamp documentation thermal: core: Use sysfs_emit_at() instead of scnprintf() thermal: intel: powerclamp: Fix duration module parameter ... commit 88af9b164c7a25a71b1a1a699872b869e2e84c77 Merge: 2504ba8b01634 f32309c4d08db Author: Linus Torvalds Date: Tue Feb 21 12:23:24 2023 -0800 Merge tag 'acpi-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These fix a frequency limit issue in the ACPI processor performance library code, fix a few issues in the ACPICA code, improve Crystal Cove support in the ACPI PMIC driver, fix string handling in the ACPI battery driver, add IRQ override quirks for a few machines more, fix other assorted problems and clean up code and documentation. Specifics: - Drop port I/O validation for some regions to avoid AML failures due to rejections of legitimate port I/O writes (Mario Limonciello) - Constify acpi_get_handle() pathname argument to allow its callers to pass const pathnames to it (Sakari Ailus) - Prevent acpi_ns_simple_repair() from crashing in some cases when AE_AML_NO_RETURN_VALUE should be returned (Daniil Tatianin) - Fix typo in CDAT DSMAS struct definition (Lukas Wunner) - Drop an unnecessary (void *) conversion from the ACPI processor driver (Zhou jie) - Modify the ACPI processor performance library code to use the "no limit" frequency QoS as appropriate and adjust the intel_pstate driver accordingly (Rafael Wysocki) - Add support for NBFT to the ACPI table parser (Stuart Hayes) - Introduce list of known non-PNP devices to avoid enumerating some of them as PNP devices (Rafael Wysocki) - Add x86 ACPI paths to the ACPI entry in MAINTAINERS to allow scripts to report the actual maintainers information (Rafael Wysocki) - Add two more entries to the ACPI IRQ override quirk list (Adam Niederer, Werner Sembach) - Add a pmic_i2c_address entry for Intel Bay Trail Crystal Cove to allow intel_soc_pmic_exec_mipi_pmic_seq_element() to be used with the Bay Trail Crystal Cove PMIC OpRegion driver (Hans de Goede) - Add comments with DSDT power OpRegion field names to the ACPI PMIC driver (Hans de Goede) - Fix string termination handling in the ACPI battery driver (Armin Wolf) - Limit error type to 32-bit width in the ACPI APEI error injection code (Shuai Xue) - Fix Lenovo Ideapad Z570 DMI match in the ACPI backlight driver (Hans de Goede) - Silence missing prototype warnings in some places in the ACPI-related code (Ammar Faizi) - Make kobj_type structures used in the ACPI code constant (Thomas Weißschuh) - Correct spelling in firmware-guide/ACPI (Randy Dunlap) - Clarify the meaning of Explicit and Implicit in the _DSD GPIO properties documentation (Andy Shevchenko) - Fix some kernel-doc comments in the ACPI CPPC library code (Yang Li)" * tag 'acpi-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (25 commits) ACPI: make kobj_type structures constant Documentation: firmware-guide: gpio-properties: Clarify Explicit and Implicit ACPICA: Fix typo in CDAT DSMAS struct definition ACPI: resource: Do IRQ override on all TongFang GMxRGxx ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models ACPI: CPPC: Fix some kernel-doc comments ACPI: video: Fix Lenovo Ideapad Z570 DMI match Documentation: firmware-guide/ACPI: correct spelling ACPI: PMIC: Add comments with DSDT power opregion field names ACPI: battery: Increase maximum string length ACPI: battery: Fix buffer overread if not NUL-terminated ACPI: APEI: EINJ: Limit error type to 32-bit width MAINTAINERS: Add x86 ACPI paths to the ACPI entry ACPI: battery: Fix missing NUL-termination with large strings ACPI: PNP: Introduce list of known non-PNP devices ACPICA: nsrepair: handle cases without a return value correctly ACPI: Silence missing prototype warnings cpufreq: intel_pstate: Drop ACPI _PSS states table patching ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily ACPI: processor: perflib: Use the "no limit" frequency QoS ... commit 2504ba8b01634319a6f95b7fa9bf9c101437e158 Merge: 4a7d37e824f57 dd855f01e8d19 Author: Linus Torvalds Date: Tue Feb 21 12:13:58 2023 -0800 Merge tag 'pm-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These add EPP support to the AMD P-state cpufreq driver, add support for new platforms to the Intel RAPL power capping driver, intel_idle and the Qualcomm cpufreq driver, enable thermal cooling for Tegra194, drop the custom cpufreq driver for loongson1 that is not necessary any more (and the corresponding cpufreq platform device), fix assorted issues and clean up code. Specifics: - Add EPP support to the AMD P-state cpufreq driver (Perry Yuan, Wyes Karny, Arnd Bergmann, Bagas Sanjaya) - Drop the custom cpufreq driver for loongson1 that is not necessary any more and the corresponding cpufreq platform device (Keguang Zhang) - Remove "select SRCU" from system sleep, cpufreq and OPP Kconfig entries (Paul E. McKenney) - Enable thermal cooling for Tegra194 (Yi-Wei Wang) - Register module device table and add missing compatibles for cpufreq-qcom-hw (Nícolas F. R. A. Prado, Abel Vesa and Luca Weiss) - Various dt binding updates for qcom-cpufreq-nvmem and opp-v2-kryo-cpu (Christian Marangi) - Make kobj_type structure in the cpufreq core constant (Thomas Weißschuh) - Make cpufreq_unregister_driver() return void (Uwe Kleine-König) - Make the TEO cpuidle governor check CPU utilization in order to refine idle state selection (Kajetan Puchalski) - Make Kconfig select the haltpoll cpuidle governor when the haltpoll cpuidle driver is selected and replace a default_idle() call in that driver with arch_cpu_idle() to allow MWAIT to be used (Li RongQing) - Add Emerald Rapids Xeon support to the intel_idle driver (Artem Bityutskiy) - Add ARCH_SUSPEND_POSSIBLE dependencies for ARMv4 cpuidle drivers to avoid randconfig build failures (Arnd Bergmann) - Make kobj_type structures used in the cpuidle sysfs interface constant (Thomas Weißschuh) - Make the cpuidle driver registration code update microsecond values of idle state parameters in accordance with their nanosecond values if they are provided (Rafael Wysocki) - Make the PSCI cpuidle driver prevent topology CPUs from being suspended on PREEMPT_RT (Krzysztof Kozlowski) - Document that pm_runtime_force_suspend() cannot be used with DPM_FLAG_SMART_SUSPEND (Richard Fitzgerald) - Add EXPORT macros for exporting PM functions from drivers (Richard Fitzgerald) - Remove /** from non-kernel-doc comments in hibernation code (Randy Dunlap) - Fix possible name leak in powercap_register_zone() (Yang Yingliang) - Add Meteor Lake and Emerald Rapids support to the intel_rapl power capping driver (Zhang Rui) - Modify the idle_inject power capping facility to support 100% idle injection (Srinivas Pandruvada) - Fix large time windows handling in the intel_rapl power capping driver (Zhang Rui) - Fix memory leaks with using debugfs_lookup() in the generic PM domains and Energy Model code (Greg Kroah-Hartman) - Add missing 'cache-unified' property in the example for kryo OPP bindings (Rob Herring) - Fix error checking in opp_migrate_dentry() (Qi Zheng) - Let qcom,opp-fuse-level be a 2-long array for qcom SoCs (Konrad Dybcio) - Modify some power management utilities to use the canonical ftrace path (Ross Zwisler) - Correct spelling problems for Documentation/power/ as reported by codespell (Randy Dunlap)" * tag 'pm-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (53 commits) Documentation: amd-pstate: disambiguate user space sections cpufreq: amd-pstate: Fix invalid write to MSR_AMD_CPPC_REQ dt-bindings: opp: opp-v2-kryo-cpu: enlarge opp-supported-hw maximum dt-bindings: cpufreq: qcom-cpufreq-nvmem: make cpr bindings optional dt-bindings: cpufreq: qcom-cpufreq-nvmem: specify supported opp tables PM: Add EXPORT macros for exporting PM functions cpuidle: psci: Do not suspend topology CPUs on PREEMPT_RT MIPS: loongson32: Drop obsolete cpufreq platform device powercap: intel_rapl: Fix handling for large time window cpuidle: driver: Update microsecond values of state parameters as needed cpuidle: sysfs: make kobj_type structures constant cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies PM: EM: fix memory leak with using debugfs_lookup() PM: domains: fix memory leak with using debugfs_lookup() cpufreq: Make kobj_type structure constant cpufreq: davinci: Fix clk use after free cpufreq: amd-pstate: avoid uninitialized variable use cpufreq: Make cpufreq_unregister_driver() return void OPP: fix error checking in opp_migrate_dentry() dt-bindings: cpufreq: cpufreq-qcom-hw: Add SM8550 compatible ... commit ccfd889acb06eab10b98deb4b5eef0ec74157ea0 Author: Denis Arefev Date: Tue Jan 24 13:50:37 2023 +0300 smackfs: Added check catlen If the catlen is 0, the memory for the netlbl_lsm_catmap structure must be allocated anyway, otherwise the check of such rules is not completed correctly. Signed-off-by: Denis Arefev Signed-off-by: Casey Schaufler commit 7ae9fb1b7ecbb5d85d07857943f677fd1a559b18 Merge: 9c445d2637c93 9e69e845ae952 Author: Dmitry Torokhov Date: Tue Feb 21 11:19:49 2023 -0800 Merge branch 'next' into for-linus Prepare input updates for 6.3 merge window. commit 4a7d37e824f57dbace61abf62f53843800bd245c Merge: 902d9fcd8dccf 78f7a3fd6dc66 Author: Linus Torvalds Date: Tue Feb 21 11:07:23 2023 -0800 Merge tag 'hardening-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: "Beyond some specific LoadPin, UBSAN, and fortify features, there are other fixes scattered around in various subsystems where maintainers were okay with me carrying them in my tree or were non-responsive but the patches were reviewed by others: - Replace 0-length and 1-element arrays with flexible arrays in various subsystems (Paulo Miguel Almeida, Stephen Rothwell, Kees Cook) - randstruct: Disable Clang 15 support (Eric Biggers) - GCC plugins: Drop -std=gnu++11 flag (Sam James) - strpbrk(): Refactor to use strchr() (Andy Shevchenko) - LoadPin LSM: Allow root filesystem switching when non-enforcing - fortify: Use dynamic object size hints when available - ext4: Fix CFI function prototype mismatch - Nouveau: Fix DP buffer size arguments - hisilicon: Wipe entire crypto DMA pool on error - coda: Fully allocate sig_inputArgs - UBSAN: Improve arm64 trap code reporting - copy_struct_from_user(): Add minimum bounds check on kernel buffer size" * tag 'hardening-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: randstruct: disable Clang 15 support uaccess: Add minimum bounds check on kernel buffer size arm64: Support Clang UBSAN trap codes for better reporting coda: Avoid partial allocation of sig_inputArgs gcc-plugins: drop -std=gnu++11 to fix GCC 13 build lib/string: Use strchr() in strpbrk() crypto: hisilicon: Wipe entire pool on error net/i40e: Replace 0-length array with flexible array io_uring: Replace 0-length array with flexible array ext4: Fix function prototype mismatch for ext4_feat_ktype i915/gvt: Replace one-element array with flexible-array member drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size LoadPin: Allow filesystem switch when not enforcing LoadPin: Move pin reporting cleanly out of locking LoadPin: Refactor sysctl initialization LoadPin: Refactor read-only check into a helper ARM: ixp4xx: Replace 0-length arrays with flexible arrays fortify: Use __builtin_dynamic_object_size() when available rxrpc: replace zero-lenth array with DECLARE_FLEX_ARRAY() helper commit 902d9fcd8dccf6a5ccd009f2ae8fec5b3db7f41b Merge: 8cc01d43f882f 0fb0624b15d21 Author: Linus Torvalds Date: Tue Feb 21 11:04:56 2023 -0800 Merge tag 'seccomp-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull seccomp update from Kees Cook: - Fix kernel-doc function name ordering to avoid warning (Randy Dunlap) * tag 'seccomp-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: seccomp: fix kernel-doc function name warning commit 8cc01d43f882fa1f44d8aa6727a6ea783d8fbe3f Merge: 8ca8d89b43caf bba8d3d17dc26 Author: Linus Torvalds Date: Tue Feb 21 10:45:51 2023 -0800 Merge tag 'rcu.2023.02.10a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU updates from Paul McKenney: - Documentation updates - Miscellaneous fixes, perhaps most notably: - Throttling callback invocation based on the number of callbacks that are now ready to invoke instead of on the total number of callbacks - Several patches that suppress false-positive boot-time diagnostics, for example, due to lockdep not yet being initialized - Make expedited RCU CPU stall warnings dump stacks of any tasks that are blocking the stalled grace period. (Normal RCU CPU stall warnings have done this for many years) - Lazy-callback fixes to avoid delays during boot, suspend, and resume. (Note that lazy callbacks must be explicitly enabled, so this should not (yet) affect production use cases) - Make kfree_rcu() and friends take advantage of polled grace periods, thus reducing memory footprint by almost two orders of magnitude, admittedly on a microbenchmark This also begins the transition from kfree_rcu(p) to kfree_rcu_mightsleep(p). This transition was motivated by bugs where kfree_rcu(p), which can block, was typed instead of the intended kfree_rcu(p, rh) - SRCU updates, perhaps most notably fixing a bug that causes SRCU to fail when booted on a system with a non-zero boot CPU. This surprising situation actually happens for kdump kernels on the powerpc architecture This also adds an srcu_down_read() and srcu_up_read(), which act like srcu_read_lock() and srcu_read_unlock(), but allow an SRCU read-side critical section to be handed off from one task to another - Clean up the now-useless SRCU Kconfig option There are a few more commits that are not yet acked or pulled into maintainer trees, and these will be in a pull request for a later merge window - RCU-tasks updates, perhaps most notably these fixes: - A strange interaction between PID-namespace unshare and the RCU-tasks grace period that results in a low-probability but very real hang - A race between an RCU tasks rude grace period on a single-CPU system and CPU-hotplug addition of the second CPU that can result in a too-short grace period - A race between shrinking RCU tasks down to a single callback list and queuing a new callback to some other CPU, but where that queuing is delayed for more than an RCU grace period. This can result in that callback being stranded on the non-boot CPU - Torture-test updates and fixes - Torture-test scripting updates and fixes - Provide additional RCU CPU stall-warning information in kernels built with CONFIG_RCU_CPU_STALL_CPUTIME=y, and restore the full five-minute timeout limit for expedited RCU CPU stall warnings * tag 'rcu.2023.02.10a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (80 commits) rcu/kvfree: Add kvfree_rcu_mightsleep() and kfree_rcu_mightsleep() kernel/notifier: Remove CONFIG_SRCU init: Remove "select SRCU" fs/quota: Remove "select SRCU" fs/notify: Remove "select SRCU" fs/btrfs: Remove "select SRCU" fs: Remove CONFIG_SRCU drivers/pci/controller: Remove "select SRCU" drivers/net: Remove "select SRCU" drivers/md: Remove "select SRCU" drivers/hwtracing/stm: Remove "select SRCU" drivers/dax: Remove "select SRCU" drivers/base: Remove CONFIG_SRCU rcu: Disable laziness if lazy-tracking says so rcu: Track laziness during boot and suspend rcu: Remove redundant call to rcu_boost_kthread_setaffinity() rcu: Allow up to five minutes expedited RCU CPU stall-warning timeouts rcu: Align the output of RCU CPU stall warning messages rcu: Add RCU stall diagnosis information sched: Add helper nr_context_switches_cpu() ... commit 8ca8d89b43caf9a02a18414d6eeff966d2b14512 Merge: 3e82b41e1e3cc 32a47817d0755 Author: Linus Torvalds Date: Tue Feb 21 10:36:29 2023 -0800 Merge tag 'cgroup-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "All the changes are trivial: documentation updates and a trivial code cleanup" * tag 'cgroup-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/cpuset: fix a few kernel-doc warnings & coding style docs: cgroup-v1: use numbered lists for user interface setup docs: cgroup-v1: add internal cross-references docs: cgroup-v1: make swap extension subsections subsections docs: cgroup-v1: use bullet lists for list of stat file tables docs: cgroup-v1: move hierarchy of accounting caption docs: cgroup-v1: fix footnotes docs: cgroup-v1: use code block for locking order schema docs: cgroup-v1: wrap remaining admonitions in admonition blocks docs: cgroup-v1: replace custom note constructs with appropriate admonition blocks cgroup/cpuset: no need to explicitly init a global static variable commit 3e82b41e1e3cc74108712a66b5be8a7b8be9e8b0 Merge: 9e58df973d227 c63a2e52d5e08 Author: Linus Torvalds Date: Tue Feb 21 10:25:48 2023 -0800 Merge tag 'wq-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - When per-cpu workqueue workers expire after sitting idle for too long, they used to wake up to the CPU that they're bound to in order to exit. This unfortunately could cause unwanted disturbances on CPUs isolated for e.g. RT applications. The worker exit path is restructured so that an existing worker is unbound from its CPU before being woken up for the last time, allowing it to migrate away from an isolated CPU for exiting. - A couple debug improvements. Watchdog dump is made more compact and workqueue now warns if used-after-free during the RCU grace period after destroy_workqueue(). * tag 'wq-for-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Fold rebind_worker() within rebind_workers() workqueue: Unbind kworkers before sending them to exit() workqueue: Don't hold any lock while rcuwait'ing for !POOL_MANAGER_ACTIVE workqueue: Convert the idle_timer to a timer + work_struct workqueue: Factorize unbind/rebind_workers() logic workqueue: Protects wq_unbound_cpumask with wq_pool_attach_mutex workqueue: Make show_pwq() use run-length encoding workqueue: Add a new flag to spot the potential UAF error commit 9e58df973d2272e6e558965e7cb32453a4b380ff Merge: 560b80306782a 6f3ee0e22b4c6 Author: Linus Torvalds Date: Tue Feb 21 10:03:48 2023 -0800 Merge tag 'irq-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "Updates for the interrupt subsystem: Core: - Move the interrupt affinity spreading mechanism into lib/group_cpus so it can be used for similar spreading requirements, e.g. in the block multi-queue code This also contains a first usecase in the block multi-queue code which Jens asked to take along with the librarization - Improve irqdomain locking to close a number race conditions which can be observed with massive parallel device driver probing - Enforce and document the semantics of disable_irq() which cannot be invoked safely from non-sleepable context - Move the IPI multiplexing code from the Apple AIC driver into the core, so it can be reused by RISCV Drivers: - Plug OF node refcounting leaks in various drivers - Correctly mark level triggered interrupts in the Broadcom L2 drivers - The usual small fixes and improvements - No new drivers for the record!" * tag 'irq-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (42 commits) irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts irqdomain: Switch to per-domain locking irqchip/mvebu-odmi: Use irq_domain_create_hierarchy() irqchip/loongson-pch-msi: Use irq_domain_create_hierarchy() irqchip/gic-v3-mbi: Use irq_domain_create_hierarchy() irqchip/gic-v3-its: Use irq_domain_create_hierarchy() irqchip/gic-v2m: Use irq_domain_create_hierarchy() irqchip/alpine-msi: Use irq_domain_add_hierarchy() x86/uv: Use irq_domain_create_hierarchy() x86/ioapic: Use irq_domain_create_hierarchy() irqdomain: Clean up irq_domain_push/pop_irq() irqdomain: Drop leftover brackets irqdomain: Drop dead domain-name assignment irqdomain: Drop revmap mutex irqdomain: Fix domain registration race irqdomain: Fix mapping-creation race irqdomain: Refactor __irq_domain_alloc_irqs() irqdomain: Look for existing mapping only once irqdomain: Drop bogus fwspec-mapping error handling ... commit 560b80306782aee1f7d42bd929ddf010eb52121d Merge: 056612fd41fef ab407a1919d26 Author: Linus Torvalds Date: Tue Feb 21 09:45:13 2023 -0800 Merge tag 'timers-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "Updates for timekeeping, timers and clockevent/source drivers: Core: - Yet another round of improvements to make the clocksource watchdog more robust: - Relax the clocksource-watchdog skew criteria to match the NTP criteria. - Temporarily skip the watchdog when high memory latencies are detected which can lead to false-positives. - Provide an option to enable TSC skew detection even on systems where TSC is marked as reliable. Sigh! - Initialize the restart block in the nanosleep syscalls to be directed to the no restart function instead of doing a partial setup on entry. This prevents an erroneous restart_syscall() invocation from corrupting user space data. While such a situation is clearly a user space bug, preventing this is a correctness issue and caters to the least suprise principle. - Ignore the hrtimer slack for realtime tasks in schedule_hrtimeout() to align it with the nanosleep semantics. Drivers: - The obligatory new driver bindings for Mediatek, Rockchip and RISC-V variants. - Add support for the C3STOP misfeature to the RISC-V timer to handle the case where the timer stops in deeper idle state. - Set up a static key in the RISC-V timer correctly before first use. - The usual small improvements and fixes all over the place" * tag 'timers-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) clocksource/drivers/timer-sun4i: Add CLOCK_EVT_FEAT_DYNIRQ clocksource/drivers/em_sti: Mark driver as non-removable clocksource/drivers/sh_tmu: Mark driver as non-removable clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use clocksource/drivers/timer-microchip-pit64b: Add delay timer clocksource/drivers/timer-microchip-pit64b: Select driver only on ARM dt-bindings: timer: sifive,clint: add comaptibles for T-Head's C9xx dt-bindings: timer: mediatek,mtk-timer: add MT8365 clocksource/drivers/riscv: Get rid of clocksource_arch_init() callback clocksource/drivers/sh_cmt: Mark driver as non-removable clocksource/drivers/timer-microchip-pit64b: Drop obsolete dependency on COMPILE_TEST clocksource/drivers/riscv: Increase the clock source rating clocksource/drivers/timer-riscv: Set CLOCK_EVT_FEAT_C3STOP based on DT dt-bindings: timer: Add bindings for the RISC-V timer device RISC-V: time: initialize hrtimer based broadcast clock event device dt-bindings: timer: rk-timer: Add rktimer for rv1126 time/debug: Fix memory leak with using debugfs_lookup() clocksource: Enable TSC watchdog checking of HPET and PMTMR only when requested posix-timers: Use atomic64_try_cmpxchg() in __update_gt_cputime() clocksource: Verify HPET and PMTMR when TSC unverified ... commit 02d7bd1efb4280ea1a75ad1eece3f19537f82a19 Author: Kevin Groeneveld Date: Sat Dec 10 15:38:35 2022 -0500 clk: imx: pll14xx: fix recalc_rate for negative kdiv kdiv is a signed 16 bit value in the DEV_CTL1 register. Commit 53990cf9d5b4 ("clk: imx: pll14xx: consolidate rate calculation") changed the kdiv variable from a short int to just int. When the value read from the DIV_CTL1 register is assigned directly to an int the sign of the value is lost resulting in incorrect results when the value is negative. Adding a s16 cast to the register value fixes the issue. Fixes: 53990cf9d5b4 ("clk: imx: pll14xx: consolidate rate calculation") Signed-off-by: Kevin Groeneveld Link: https://lore.kernel.org/r/20221210203835.9714-1-kgroeneveld@lenbrook.com Reviewed-by: Abel Vesa Signed-off-by: Stephen Boyd commit d1fabc68f8e0541d41657096dc713cb01775652d Merge: 4d4266e3fd321 f922c7b1c1c45 Author: Jakub Kicinski Date: Tue Feb 21 09:26:22 2023 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Per-next-PR merge. net/smc/af_smc.c b5dd4d698171 ("net/smc: llc_conf_mutex refactor, replace it with rw_semaphore") e40b801b3603 ("net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()") https://lore.kernel.org/all/20230221124008.6303c330@canb.auug.org.au/ Signed-off-by: Jakub Kicinski commit 056612fd41fef88eef22a032021cc15ef98cfc34 Merge: 3f0b0903fde58 fcb3a81d22175 Author: Linus Torvalds Date: Tue Feb 21 09:24:08 2023 -0800 Merge tag 'x86-cleanups-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull miscellaneous x86 cleanups from Thomas Gleixner: - Correct the common copy and pasted mishandling of kstrtobool() in the strict_sas_size() setup function - Make recalibrate_cpu_khz() an GPL only export - Check TSC feature before doing anything else which avoids pointless code execution if TSC is not available - Remove or fixup stale and misleading comments - Remove unused or pointelessly duplicated variables - Spelling and typo fixes * tag 'x86-cleanups-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hotplug: Remove incorrect comment about mwait_play_dead() x86/tsc: Do feature check as the very first thing x86/tsc: Make recalibrate_cpu_khz() export GPL only x86/cacheinfo: Remove unused trace variable x86/Kconfig: Fix spellos & punctuation x86/signal: Fix the value returned by strict_sas_size() x86/cpu: Remove misleading comment x86/setup: Move duplicate boot_cpu_data definition out of the ifdeffery x86/boot/e820: Fix typo in e820.c comment commit 4d4266e3fd321fadb628ce02de641b129522c39c Author: Ilias Apalodimas Date: Sat Feb 18 00:21:30 2023 +0200 page_pool: add a comment explaining the fragment counter usage When reading the page_pool code the first impression is that keeping two separate counters, one being the page refcnt and the other being fragment pp_frag_count, is counter-intuitive. However without that fragment counter we don't know when to reliably destroy or sync the outstanding DMA mappings. So let's add a comment explaining this part. Reviewed-by: Alexander Duyck Signed-off-by: Ilias Apalodimas Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20230217222130.85205-1-ilias.apalodimas@linaro.org Signed-off-by: Jakub Kicinski commit a00da30c052f07d67da56efd6a4f1fc85956c979 Author: Vladimir Oltean Date: Mon Feb 20 14:23:31 2023 +0200 net: ethtool: fix __ethtool_dev_mm_supported() implementation The MAC Merge layer is supported when ops->get_mm() returns 0. The implementation was changed during review, and in this process, a bug was introduced. Link: https://lore.kernel.org/netdev/20230111161706.1465242-5-vladimir.oltean@nxp.com/ Fixes: 04692c9020b7 ("net: ethtool: netlink: retrieve stats from multiple sources (eMAC, pMAC)") Signed-off-by: Vladimir Oltean Reviewed-by: Ferenc Fejes Link: https://lore.kernel.org/all/20230220122343.1156614-2-vladimir.oltean@nxp.com/ Signed-off-by: Jakub Kicinski commit 7ec077744aade63729d58c2d26861c3147a4d8aa Author: Bo Liu Date: Tue Feb 21 03:30:36 2023 -0500 ethtool: pse-pd: Fix double word in comments Remove the repeated word "for" in comments. Signed-off-by: Bo Liu Reviewed-by: Oleksij Rempel Link: https://lore.kernel.org/r/20230221083036.2414-1-liubo03@inspur.com Signed-off-by: Jakub Kicinski commit 951bce29c8988209cc359e1fa35a4aaa35542fd5 Author: Xuan Zhuo Date: Tue Feb 21 15:51:40 2023 +0800 xsk: add linux/vmalloc.h to xsk.c Fix the failure of the compilation under the sh4. Because we introduced remap_vmalloc_range() earlier, this has caused the compilation failure on the sh4 platform. So this introduction of the header file of linux/vmalloc.h. config: sh-allmodconfig (https://download.01.org/0day-ci/archive/20230221/202302210041.kpPQLlNQ-lkp@intel.com/config) compiler: sh4-linux-gcc (GCC) 12.1.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=9f78bf330a66cd400b3e00f370f597e9fa939207 git remote add net-next https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git git fetch --no-tags net-next master git checkout 9f78bf330a66cd400b3e00f370f597e9fa939207 # save the config file mkdir build_dir && cp config build_dir/.config COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=sh olddefconfig COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=sh SHELL=/bin/bash net/ Fixes: 9f78bf330a66 ("xsk: support use vaddr as ring") Signed-off-by: Xuan Zhuo Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302210041.kpPQLlNQ-lkp@intel.com/ Link: https://lore.kernel.org/r/20230221075140.46988-1-xuanzhuo@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 3f0b0903fde584a7398f82fc00bf4f8138610b87 Merge: efebca0ba9cfe dac0da428f8df Author: Linus Torvalds Date: Tue Feb 21 08:54:41 2023 -0800 Merge tag 'x86_vdso_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vdso updates from Borislav Petkov: - Add getcpu support for the 32-bit version of the vDSO - Some smaller fixes * tag 'x86_vdso_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Fix -Wmissing-prototypes warnings x86/vdso: Fake 32bit VDSO build on 64bit compile for vgetcpu selftests: Emit a warning if getcpu() is missing on 32bit x86/vdso: Provide getcpu for x86-32. x86/cpu: Provide the full setup for getcpu() on x86-32 x86/vdso: Move VDSO image init to vdso2c generated code commit efebca0ba9cfe2bae79dba7b2b09b129c41cfc8e Merge: aa8c3db40adf1 f33e0c893b22b Author: Linus Torvalds Date: Tue Feb 21 08:47:36 2023 -0800 Merge tag 'x86_microcode_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loader updates from Borislav Petkov: - Fix mixed steppings support on AMD which got broken somewhere along the way - Improve revision reporting - Properly check CPUID capabilities after late microcode upgrade to avoid false positives - A garden variety of other small fixes * tag 'x86_microcode_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/core: Return an error only when necessary x86/microcode/AMD: Fix mixed steppings support x86/microcode/AMD: Add a @cpu parameter to the reloading functions x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter x86/microcode: Allow only "1" as a late reload trigger value x86/microcode/intel: Print old and new revision during early boot x86/microcode/intel: Pass the microcode revision to print_ucode_info() directly x86/microcode: Adjust late loading result reporting message x86/microcode: Check CPU capabilities after late microcode update correctly x86/microcode: Add a parameter to microcode_check() to store CPU capabilities x86/microcode: Use the DEVICE_ATTR_RO() macro x86/microcode/AMD: Handle multiple glued containers properly x86/microcode/AMD: Rename a couple of functions commit aa8c3db40adf1204e47dac9c410eea82567fe82d Merge: 1adce1b9440cd 793207bad71c5 Author: Linus Torvalds Date: Tue Feb 21 08:38:45 2023 -0800 Merge tag 'x86_cache_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - Add support for a new AMD feature called slow memory bandwidth allocation. Its goal is to control resource allocation in external slow memory which is connected to the machine like for example through CXL devices, accelerators etc * tag 'x86_cache_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Fix a silly -Wunused-but-set-variable warning Documentation/x86: Update resctrl.rst for new features x86/resctrl: Add interface to write mbm_local_bytes_config x86/resctrl: Add interface to write mbm_total_bytes_config x86/resctrl: Add interface to read mbm_local_bytes_config x86/resctrl: Add interface to read mbm_total_bytes_config x86/resctrl: Support monitor configuration x86/resctrl: Add __init attribute to rdt_get_mon_l3_config() x86/resctrl: Detect and configure Slow Memory Bandwidth Allocation x86/resctrl: Include new features in command line options x86/cpufeatures: Add Bandwidth Monitoring Event Configuration feature flag x86/resctrl: Add a new resource type RDT_RESOURCE_SMBA x86/cpufeatures: Add Slow Memory Bandwidth Allocation feature flag x86/resctrl: Replace smp_call_function_many() with on_each_cpu_mask() commit 1adce1b9440cdf0c427419b99bc9db756b5ad931 Merge: d9de5ce8a5ec8 923510c88d2b7 Author: Linus Torvalds Date: Tue Feb 21 08:27:47 2023 -0800 Merge tag 'x86_alternatives_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm alternatives updates from Borislav Petkov: - Teach the static_call patching infrastructure to handle conditional tall calls properly which can be static calls too - Add proper struct alt_instr.flags which controls different aspects of insn patching behavior * tag 'x86_alternatives_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/static_call: Add support for Jcc tail-calls x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions x86/alternatives: Introduce int3_emulate_jcc() x86/alternatives: Add alt_instr.flags commit 9c7c4bc986932218fd0df9d2a100509772028fb1 Author: Ming Lei Date: Mon Feb 20 12:14:13 2023 +0800 ublk: remove check IO_URING_F_SQE128 in ublk_ch_uring_cmd sizeof(struct ublksrv_io_cmd) is 16bytes, which can be held in 64byte SQE, so not necessary to check IO_URING_F_SQE128. With this change, we get chance to save half SQ ring memory. Fixed: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230220041413.1524335-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 9e0c7efa5ea231d85c0d41693a5115b3b971717c Author: Juhyung Park Date: Fri Feb 3 11:40:29 2023 +0900 block: remove more NULL checks after bdev_get_queue() bdev_get_queue() never returns NULL. Several commits [1][2] have been made before to remove such superfluous checks, but some still remained. For places where bdev_get_queue() is called solely for NULL checks, it is removed entirely. [1] commit ec9fd2a13d74 ("blk-lib: don't check bdev_get_queue() NULL check") [2] commit fea127b36c93 ("block: remove superfluous check for request queue in bdev_is_zoned()") Signed-off-by: Juhyung Park Reviewed-by: Pankaj Raghav Link: https://lore.kernel.org/r/20230203024029.48260-1-qkrwngud825@gmail.com Signed-off-by: Jens Axboe commit b4858dc61647e5439cbba79022bfc87328c1fb84 Author: Colin Ian King Date: Mon Feb 20 14:44:22 2023 +0000 of: dynamic: Fix spelling mistake "kojbect" -> "kobject" There is a spelling mistake in a pr_err message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Frank Rowand Link: https://lore.kernel.org/r/20230220144422.873356-1-colin.i.king@gmail.com Signed-off-by: Rob Herring commit fb4b06f521c1cdf04088151ed587c188862e3111 Author: Conor Dooley Date: Fri Feb 17 18:00:36 2023 +0000 dt-bindings: drop Sagar Kadam from SiFive binding maintainership Sagar's email listed in maintainers is bouncing as his division was sold off by the company. I attempted to contact him some days ago on what the bounce email told me was his new contact information, but am yet to receive a response. Paul and Palmer are listed on each of the bindings, both of whom were alive & well as of Wednesday so the bindings remain maintained. CC: Sagar Kadam CC: Sagar Kadam Link: https://lore.kernel.org/all/785425ca-4000-a7e4-16d6-4d68c91b158d@kernel.org/ Signed-off-by: Conor Dooley Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230217180035.39658-1-conor@kernel.org Signed-off-by: Rob Herring commit 64d666a7bd85c6208bb7f6700b426ac8943a7fa3 Author: Mukesh Ojha Date: Tue Feb 21 19:06:55 2023 +0530 dt-bindings: sram: qcom,imem: document sm8450 Add compatible for sm8450 IMEM. Signed-off-by: Mukesh Ojha Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/1676986616-21378-1-git-send-email-quic_mojha@quicinc.com Signed-off-by: Rob Herring commit 0305c98c9e1595bf4e8b3597a65ace9de98f0b5f Author: Keguang Zhang Date: Tue Feb 21 18:25:45 2023 +0800 dt-bindings: interrupt-controller: convert loongson,ls1x-intc.txt to json-schema Convert the Loongson1 interrupt controller dt-bindings to json-schema. Signed-off-by: Keguang Zhang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230221102545.2103632-1-keguang.zhang@gmail.com Signed-off-by: Rob Herring commit d9de5ce8a5ec8f97c9468244fd85ff1a10363b60 Merge: 0246725d7399d 28980db94742f Author: Linus Torvalds Date: Tue Feb 21 08:10:03 2023 -0800 Merge tag 'edac_updates_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - Add a driver for the RAS functionality on Xilinx's on chip memory controller - Add support for decoding errors from the first and second level memory on SKL-based hardware - Add support for the memory controllers in Intel Granite Rapids and Emerald Rapids machines - First round of amd64_edac driver simplification and removal of unneeded functionality - The usual cleanups and fixes * tag 'edac_updates_for_v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Shut up an -Werror,-Wsometimes-uninitialized clang false positive EDAC/amd64: Remove early_channel_count() EDAC/amd64: Remove PCI Function 0 EDAC/amd64: Remove PCI Function 6 EDAC/amd64: Remove scrub rate control for Family 17h and later EDAC/amd64: Don't set up EDAC PCI control on Family 17h+ EDAC/i10nm: Add driver decoder for Sapphire Rapids server EDAC/i10nm: Add Intel Granite Rapids server support EDAC/i10nm: Make more configurations CPU model specific EDAC/i10nm: Add Intel Emerald Rapids server support EDAC/skx_common: Delete duplicated and unreachable code EDAC/skx_common: Enable EDAC support for the "near" memory EDAC/qcom: Add platform_device_id table for module autoloading EDAC/zynqmp: Add EDAC support for Xilinx ZynqMP OCM dt-bindings: edac: Add bindings for Xilinx ZynqMP OCM commit 0246725d7399d7d6acc8fd5a1a0a1ffce9a1eaa3 Merge: 89f5349e06733 8a01ec97dc066 Author: Linus Torvalds Date: Tue Feb 21 08:04:51 2023 -0800 Merge tag 'ras_core_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Borislav Petkov: - Add support for reporting more bits of the physical address on error, on newer AMD CPUs - Mask out bits which don't belong to the address of the error being reported * tag 'ras_core_for_v6.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Mask out non-address bits from machine check bank x86/mce: Add support for Extended Physical Address MCA changes x86/mce: Define a function to extract ErrorAddr from MCA_ADDR commit 939204e4df962982cbc84acc26b29b421dd530a8 Merge: b4ff830eca097 c9c3395d5e3dc Author: Jason Gunthorpe Date: Tue Feb 21 11:11:03 2023 -0400 Merge tag 'v6.2' into iommufd.git for-next Resolve conflicts from the signature change in iommu_map: - drivers/infiniband/hw/usnic/usnic_uiom.c Switch iommu_map_atomic() to iommu_map(.., GFP_ATOMIC) - drivers/vfio/vfio_iommu_type1.c Following indenting change for GFP_KERNEL Signed-off-by: Jason Gunthorpe commit ce7980ae9080f72f08d50355c4d9084d57aece63 Author: Thomas Weißschuh Date: Fri Feb 17 03:16:25 2023 +0000 genirq/irqdesc: Make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions which prevents modification at runtime. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230217-kobj_type-irq-v1-1-fedfacaf8cdb@weissschuh.net commit 392143c9f2a31a9faaf99a6f8639eae7e71b8e61 Merge: 0c2baf6509af1 d551afc258789 Author: Petr Mladek Date: Tue Feb 21 13:41:17 2023 +0100 Merge branch 'rework/buffers-cleanup' into for-linus commit 3fb1f62f80a1d249260db5ea9e22c51e52fab9ae Author: Thomas Zimmermann Date: Thu Feb 16 15:06:20 2023 +0100 drm/fb-helper: Remove drm_fb_helper_unprepare() from drm_fb_helper_fini() Move drm_fb_helper_unprepare() from drm_fb_helper_fini() into the calling fbdev implementation. Avoids a possible stale mutex with generic fbdev code. As indicated by its name, drm_fb_helper_prepare() prepares struct drm_fb_helper before setting up the fbdev support with a call to drm_fb_helper_init(). In legacy fbdev emulation, this happens next to each other. If successful, drm_fb_helper_fini() later tear down the fbdev device and also unprepare via drm_fb_helper_unprepare(). Generic fbdev emulation prepares struct drm_fb_helper immediately after allocating the instance. It only calls drm_fb_helper_init() as part of processing a hotplug event. If the hotplug-handling fails, it runs drm_fb_helper_fini(). This unprepares the fb-helper instance and the next hotplug event runs on stale data. Solve this by moving drm_fb_helper_unprepare() from drm_fb_helper_fini() into the fbdev implementations. Call it right before freeing the fb-helper instance. Fixes: 643231b28380 ("drm/fbdev-generic: Minimize hotplug error handling") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Signed-off-by: Thomas Zimmermann Reviewed-by: Daniel Vetter Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20230216140620.17699-1-tzimmermann@suse.de commit b45bc2e09906a7c8370b7f2a6c204bcaa1b781fc Merge: 0028517724a52 f5451547b8310 Author: Vlastimil Babka Date: Tue Feb 21 13:20:10 2023 +0100 Merge branch 'slab/for-6.3/fixes' into slab/for-linus Two fixes for SLAB and SLUB - Make it possible to use kmem_cache_alloc_bulk() early in boot when interrupts are not yet enabled, as code doing that start to appear via the maple tree (by Thomas Gleixner). - Fix debugfs-related memory leak (by Greg Kroah-Hartman). commit f922c7b1c1c45740d329bf248936fdb78c0cff6e Author: Jiri Pirko Date: Mon Feb 20 14:23:36 2023 +0100 sefltests: netdevsim: wait for devlink instance after netns removal When devlink instance is put into network namespace and that network namespace gets deleted, devlink instance is moved back into init_ns. This is done as a part of cleanup_net() routine. Since cleanup_net() is called asynchronously from workqueue, there is no guarantee that the devlink instance move is done after "ip netns del" returns. So fix this race by making sure that the devlink instance is present before any other operation. Reported-by: Amir Tzin Fixes: b74c37fd35a2 ("selftests: netdevsim: add tests for devlink reload with resources") Signed-off-by: Jiri Pirko Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230220132336.198597-1-jiri@resnulli.us Signed-off-by: Paolo Abeni commit 0028517724a520cce416ab69e3f3ea0632ee20c0 Merge: cc2e9d2b26c86 81ce2ebd194cf Author: Vlastimil Babka Date: Tue Feb 21 11:49:14 2023 +0100 Merge branch 'slab/for-6.3/cleanups' into slab/for-linus A bunch of cleanups for SLAB and SLUB: - Use the standard idiom to get head page of folio (by SeongJae Park) - Simplify and inline is_debug_pagealloc_cache() in SLAB (by lvqian) - Remove unused variable in SLAB (by Gou Hao) commit b60417a9f2b890a8094477b2204d4f73c535725e Author: Roxana Nicolescu Date: Mon Feb 20 12:04:00 2023 +0100 selftest: fib_tests: Always cleanup before exit Usage of `set -e` before executing a command causes immediate exit on failure, without cleanup up the resources allocated at setup. This can affect the next tests that use the same resources, leading to a chain of failures. A simple fix is to always call cleanup function when the script exists. This approach is already used by other existing tests. Fixes: 1056691b2680 ("selftests: fib_tests: Make test results more verbose") Signed-off-by: Roxana Nicolescu Link: https://lore.kernel.org/r/20230220110400.26737-2-roxana.nicolescu@canonical.com Signed-off-by: Paolo Abeni commit fdbf807215250217c83f1cb715b883cd910102fa Author: Steve French Date: Thu Jan 19 15:20:21 2023 -0600 update internal module version number for cifs.ko From 2.41 to 2.42 Signed-off-by: Steve French commit e6cc6f175566dd21a3f6e384c24593b1c751dd74 Author: Reinette Chatre Date: Tue Feb 14 13:13:20 2023 -0800 PCI/MSI: Clarify usage of pci_msix_free_irq() pci_msix_free_irq() is used to free an interrupt on a PCI/MSI-X interrupt domain. The API description specifies that the interrupt to be freed was allocated via pci_msix_alloc_irq_at(). This description limits the usage of pci_msix_free_irq() since pci_msix_free_irq() can also be used to free MSI-X interrupts allocated with, for example, pci_alloc_irq_vectors(). Remove the text stating that the interrupt to be freed had to be allocated with pci_msix_alloc_irq_at(). The needed struct msi_map need not be from pci_msix_alloc_irq_at() but can be created from scratch using pci_irq_vector() to obtain the Linux IRQ number. Highlight that pci_msix_free_irq() cannot be used to disable MSI-X to guide users that, for example, pci_free_irq_vectors() remains to be needed. Signed-off-by: Reinette Chatre Signed-off-by: Thomas Gleixner Reviewed-by: Kevin Tian Link: https://lore.kernel.org/lkml/87r0xsd8j4.ffs@tglx Link: https://lore.kernel.org/r/4c3e7a50d6e70f408812cd7ab199c6b4b326f9de.1676408572.git.reinette.chatre@intel.com commit e77978de4765229e09c8fabcf4f8419ff367317f Author: Shyam Prasad N Date: Fri Feb 10 17:41:17 2023 +0000 cifs: update ip_addr for ses only for primary chan setup We update ses->ip_addr whenever we do a session setup. But this should happen only for primary channel in mchan scenario. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit df57109bd50b9ed6911f3c2aa914189fe4c1fe2c Author: Shyam Prasad N Date: Fri Feb 10 16:34:31 2023 +0000 cifs: use tcon allocation functions even for dummy tcon In smb2_reconnect_server, we allocate a dummy tcon for calling reconnect for just the session. This should be allocated using tconInfoAlloc, and not kmalloc. Fixes: 3663c9045f51 ("cifs: check reconnects for channels of active tcons too") Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit ea90708d3cf3d0d92c02afe445ad463fb3c6bf10 Author: Shyam Prasad N Date: Mon Dec 19 05:40:44 2022 +0000 cifs: use the least loaded channel for sending requests Till now, we've used a simple round robin approach to distribute the requests between the channels. This does not work well if the channels consume the requests at different speeds, even if the advertised speeds are the same. This change will allow the client to pick the channel with least number of requests currently in-flight. This will disregard the link speed, and select a channel based on the current load of the channels. For cases when all the channels are equally loaded, fall back to the old round robin method. Signed-off-by: Shyam Prasad N Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit bec46462567032afb05017cb10c545aab0810a73 Author: Pali Rohár Date: Mon Feb 20 09:04:35 2023 +0100 powerpc: dts: turris1x.dts: Set lower priority for CPLD syscon-reboot Due to CPLD firmware bugs, set CPLD syscon-reboot priority level to 64 (between rstcr and watchdog) to ensure that rstcr's global-utilities reset method which is preferred stay as default one, and to ensure that CPLD syscon-reboot is more preferred than watchdog reset method. Fixes: 0531a4abd1c6 ("powerpc: dts: turris1x.dts: Add CPLD reboot node") Depends-on: e6333293f27c ("power: reset: syscon-reboot: Add support for specifying priority") Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230220080435.4237-1-pali@kernel.org commit 89f5349e0673322857bd432fa23113af56673739 Merge: 238b05ec999a0 7ddf0050a21fd Author: Linus Torvalds Date: Mon Feb 20 19:04:54 2023 -0800 Merge tag 'x86-platform-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform update from Ingo Molnar: - Simplify add_rtc_cmos() - Use strscpy() in the mcelog code * tag 'x86-platform-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce/dev-mcelog: use strscpy() to instead of strncpy() x86/rtc: Simplify PNP ids check commit 238b05ec999a036872af52d23007a7fc5a2df74e Merge: 2e0ddb34e5a39 ebd3ad60a6881 Author: Linus Torvalds Date: Mon Feb 20 19:00:00 2023 -0800 Merge tag 'x86-mm-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm update from Ingo Molnar: "Micro-optimize __flush_tlb_all()" * tag 'x86-mm-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Use cpu_feature_enabled() when checking global pages support commit 2e0ddb34e5a392ad6bd6a5ada38aac53a1cc0d1a Merge: 8a68bd3e9ff6f cb3ea4b7671b7 Author: Linus Torvalds Date: Mon Feb 20 18:50:02 2023 -0800 Merge tag 'x86-fpu-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu updates from Ingo Molnar: - Replace zero-length array in struct xregs_state with flexible-array member, to help the enabling of stricter compiler checks. - Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads. * tag 'x86-fpu-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Don't set TIF_NEED_FPU_LOAD for PF_IO_WORKER threads x86/fpu: Replace zero-length array in struct xregs_state with flexible-array member commit 8a68bd3e9ff6f480fc03369023a1d981cb803079 Merge: 572640f0c0d6c ce3ba2af9695e Author: Linus Torvalds Date: Mon Feb 20 18:40:45 2023 -0800 Merge tag 'x86-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 core updates from Ingo Molnar: - Clean up the signal frame layout tests - Suppress KMSAN false positive reports in arch_within_stack_frames() * tag 'x86-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Suppress KMSAN reports in arch_within_stack_frames() x86/signal/compat: Move sigaction_compat_abi() to signal_64.c x86/signal: Move siginfo field tests commit 572640f0c0d6c681104880090dc0560b69c9d0e6 Merge: 35011c67c8b7f f9bb7f6a7eb0e Author: Linus Torvalds Date: Mon Feb 20 18:36:54 2023 -0800 Merge tag 'x86-build-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build update from Ingo Molnar: "Make the 64-bit defconfig the x86 default for all builds, unless x86-32 is requested explicitly" * tag 'x86-build-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/build: Make 64-bit defconfig the default commit 35011c67c8b7ff96c4e2dd892099ba643f9ae11e Merge: 6be3dafc7c1d3 e2869bd7af608 Author: Linus Torvalds Date: Mon Feb 20 18:32:55 2023 -0800 Merge tag 'x86-boot-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Ingo Molnar: - Robustify/fix calling startup_{32,64}() from the decompressor code, and removing x86 quirk from scripts/head-object-list.txt as a result. - Do not register processors that cannot be onlined for x2APIC * tag 'x86-boot-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/acpi/boot: Do not register processors that cannot be onlined for x2APIC scripts/head-object-list: Remove x86 from the list x86/boot: Robustify calling startup_{32,64}() from the decompressor code commit 6be3dafc7c1d323debb5910d697c5cd2cb19825f Merge: 1f2d9ffc7a5f9 65c24d7b0f914 Author: Linus Torvalds Date: Mon Feb 20 18:25:30 2023 -0800 Merge tag 'x86-asm-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Ingo Molnar: "Header fixes and a DocBook fix" * tag 'x86-asm-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/lib: Fix compiler and kernel-doc warnings x86/lib: Include to fix a missing prototypes warning at build time commit 95e158ec843666d76c09900507db08b76d77ce3e Author: Bastian Germann Date: Wed Feb 15 21:37:07 2023 +0100 dt-bindings: hwlock: sun6i: Add #hwlock-cells to example The dt-bindings tools will compile the yaml dt examples and this prevents an error about this node not existing. Signed-off-by: Bastian Germann Acked-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230215203711.6293-3-bage@debian.org commit 65f81bbd9117cf2f2090998a1ff4345742678d26 Author: Konrad Dybcio Date: Thu Feb 16 12:08:02 2023 +0100 dt-bindings: arm: Add Cortex-A715 and X3 Add compatibles for the Cortex-A715 and X3 cores found in some recent flagship designs. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230216110803.3945747-1-konrad.dybcio@linaro.org Signed-off-by: Rob Herring commit 1f2d9ffc7a5f916935749ffc6e93fb33bfe94d2f Merge: a2f0e7eee1344 7c4a5b89a0b5a Author: Linus Torvalds Date: Mon Feb 20 17:41:08 2023 -0800 Merge tag 'sched-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: - Improve the scalability of the CFS bandwidth unthrottling logic with large number of CPUs. - Fix & rework various cpuidle routines, simplify interaction with the generic scheduler code. Add __cpuidle methods as noinstr to objtool's noinstr detection and fix boatloads of cpuidle bugs & quirks. - Add new ABI: introduce MEMBARRIER_CMD_GET_REGISTRATIONS, to query previously issued registrations. - Limit scheduler slice duration to the sysctl_sched_latency period, to improve scheduling granularity with a large number of SCHED_IDLE tasks. - Debuggability enhancement on sys_exit(): warn about disabled IRQs, but also enable them to prevent a cascade of followup problems and repeat warnings. - Fix the rescheduling logic in prio_changed_dl(). - Micro-optimize cpufreq and sched-util methods. - Micro-optimize ttwu_runnable() - Micro-optimize the idle-scanning in update_numa_stats(), select_idle_capacity() and steal_cookie_task(). - Update the RSEQ code & self-tests - Constify various scheduler methods - Remove unused methods - Refine __init tags - Documentation updates - Misc other cleanups, fixes * tag 'sched-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (110 commits) sched/rt: pick_next_rt_entity(): check list_entry sched/deadline: Add more reschedule cases to prio_changed_dl() sched/fair: sanitize vruntime of entity being placed sched/fair: Remove capacity inversion detection sched/fair: unlink misfit task from cpu overutilized objtool: mem*() are not uaccess safe cpuidle: Fix poll_idle() noinstr annotation sched/clock: Make local_clock() noinstr sched/clock/x86: Mark sched_clock() noinstr x86/pvclock: Improve atomic update of last_value in pvclock_clocksource_read() x86/atomics: Always inline arch_atomic64*() cpuidle: tracing, preempt: Squash _rcuidle tracing cpuidle: tracing: Warn about !rcu_is_watching() cpuidle: lib/bug: Disable rcu_is_watching() during WARN/BUG cpuidle: drivers: firmware: psci: Dont instrument suspend code KVM: selftests: Fix build of rseq test exit: Detect and fix irq disabled state in oops cpuidle, arm64: Fix the ARM64 cpuidle logic cpuidle: mvebu: Fix duplicate flags assignment sched/fair: Limit sched slice duration ... commit a2f0e7eee1344eb9f91b22bc72d9eb0a52b849c9 Merge: 6e649d0856822 c828441f21ddc Author: Linus Torvalds Date: Mon Feb 20 17:29:55 2023 -0800 Merge tag 'perf-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: - Optimize perf_sample_data layout - Prepare sample data handling for BPF integration - Update the x86 PMU driver for Intel Meteor Lake - Restructure the x86 uncore code to fix a SPR (Sapphire Rapids) discovery breakage - Fix the x86 Zhaoxin PMU driver - Cleanups * tag 'perf-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits) perf/x86/intel/uncore: Add Meteor Lake support x86/perf/zhaoxin: Add stepping check for ZXC perf/x86/intel/ds: Fix the conversion from TSC to perf time perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery table perf/x86/uncore: Add a quirk for UPI on SPR perf/x86/uncore: Ignore broken units in discovery table perf/x86/uncore: Fix potential NULL pointer in uncore_get_alias_name perf/x86/uncore: Factor out uncore_device_to_die() perf/core: Call perf_prepare_sample() before running BPF perf/core: Introduce perf_prepare_header() perf/core: Do not pass header for sample ID init perf/core: Set data->sample_flags in perf_prepare_sample() perf/core: Add perf_sample_save_brstack() helper perf/core: Add perf_sample_save_raw_data() helper perf/core: Add perf_sample_save_callchain() helper perf/core: Save the dynamic parts of sample data size x86/kprobes: Use switch-case for 0xFF opcodes in prepare_emulation perf/core: Change the layout of perf_sample_data perf/x86/msr: Add Meteor Lake support perf/x86/cstate: Add Meteor Lake support ... commit 6e649d08568220ee88deef0a1ad8b3a935420cf2 Merge: db77b8502a407 3b4863fa5b7dd Author: Linus Torvalds Date: Mon Feb 20 17:18:23 2023 -0800 Merge tag 'locking-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: - rwsem micro-optimizations - spinlock micro-optimizations - cleanups, simplifications * tag 'locking-core-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: vduse: Remove include of rwlock.h locking/lockdep: Remove lockdep_init_map_crosslock. x86/ACPI/boot: Use try_cmpxchg() in __acpi_{acquire,release}_global_lock() x86/PAT: Use try_cmpxchg() in set_page_memtype() locking/rwsem: Disable preemption in all down_write*() and up_write() code paths locking/rwsem: Disable preemption in all down_read*() and up_read() code paths locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath locking/qspinlock: Micro-optimize pending state waiting for unlock commit 1b9b4f922f96108da3bb5d87b2d603f5dfbc5650 Author: Ben Skeggs Date: Mon Feb 20 14:39:21 2023 +1000 drm/nouveau/fb/gp102-: cache scrubber binary on first load During system shutdown nouveau might not be able to request firmware from Userspace, which then leads to a regression preventing the system from shutting down. Cache the scrubber binary for this case. Fixes: 0e44c21708761 ("drm/nouveau/flcn: new code to load+boot simple HS FWs (VPR scrubber)") Signed-off-by: Ben Skeggs Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv7Uf5=K44y8YLsiy0aMnc1zvGEQdeDe7RQF=AV+fxxzuQ@mail.gmail.com commit 3638a820c5c3b52f327cebb174fd4274bee08aa7 Author: Jiri Slaby (SUSE) Date: Mon Oct 31 12:42:29 2022 +0100 drm/nouveau/kms/nv50: fix nv50_wndw_new_ prototype gcc-13 warns about mismatching types for enums. That revealed switched arguments of nv50_wndw_new_(): drivers/gpu/drm/nouveau/dispnv50/wndw.c:696:1: error: conflicting types for 'nv50_wndw_new_' due to enum/integer mismatch; have 'int(const struct nv50_wndw_func *, struct drm_device *, enum drm_plane_type, const char *, int, const u32 *, u32, enum nv50_disp_interlock_type, u32, struct nv50_wndw **)' drivers/gpu/drm/nouveau/dispnv50/wndw.h:36:5: note: previous declaration of 'nv50_wndw_new_' with type 'int(const struct nv50_wndw_func *, struct drm_device *, enum drm_plane_type, const char *, int, const u32 *, enum nv50_disp_interlock_type, u32, u32, struct nv50_wndw **)' It can be barely visible, but the declaration says about the parameters in the middle: enum nv50_disp_interlock_type, u32 interlock_data, u32 heads, While the definition states differently: u32 heads, enum nv50_disp_interlock_type interlock_type, u32 interlock_data, Unify/fix the declaration to match the definition. Fixes: 53e0a3e70de6 ("drm/nouveau/kms/nv50-: simplify tracking of channel interlocks") Cc: Martin Liska Cc: Ben Skeggs Cc: Karol Herbst Cc: Lyude Paul Cc: David Airlie Cc: Daniel Vetter Cc: dri-devel@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20221031114229.10289-1-jirislaby@kernel.org commit 5582f3c1b14e9b6eb02983acac84a4da71b38ca9 Merge: fec67d1896add 8038510b1fe44 Author: Dave Airlie Date: Tue Feb 21 10:59:20 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-02-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-next drm/i915 fixes for the v6.3 merge window: - Fix eDP+DSI dual panel systems - Fix system suspend when fbdev isn't initialized - Fix memory leaks in scatterlist - Fix some MCR register annotations - Fix documentation build warnings Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87v8k0xyx4.fsf@intel.com commit f2b6cfda76d2119871e10fa01ecdc7178401ef22 Author: Leon Romanovsky Date: Sun Feb 19 11:09:10 2023 +0200 net/mlx5e: Align IPsec ASO result memory to be as required by hardware Hardware requires an alignment to 64 bytes to return ASO data. Missing this alignment caused to unpredictable results while ASO events were generated. Fixes: 8518d05b8f9a ("net/mlx5e: Create Advanced Steering Operation object for IPsec") Reported-by: Emeel Hakim Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/de0302c572b90c9224a72868d4e0d657b6313c4b.1676797613.git.leon@kernel.org Signed-off-by: Jakub Kicinski commit 05b953a550625dc05652e15aeb9af34771c96325 Merge: 981f40458e7a6 993fd9bd656a0 Author: Jakub Kicinski Date: Mon Feb 20 16:52:50 2023 -0800 Merge tag 'mlx5-updates-2023-02-15' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2023-02-15 1) From Gal Tariq and Parav, Few cleanups for mlx5 driver. 2) From Vlad: Allow offloading of ct 'new' match based on [1] [1] https://lore.kernel.org/netdev/20230201163100.1001180-1-vladbu@nvidia.com/ * tag 'mlx5-updates-2023-02-15' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: RX, Remove doubtful unlikely call net/mlx5e: Fix outdated TLS comment net/mlx5e: Remove unused function mlx5e_sq_xmit_simple net/mlx5e: Allow offloading of ct 'new' match net/mlx5e: Implement CT entry update net/mlx5: Simplify eq list traversal net/mlx5e: Remove redundant page argument in mlx5e_xdp_handle() net/mlx5e: Remove redundant page argument in mlx5e_xmit_xdp_buff() net/mlx5e: Switch to using napi_build_skb() ==================== Link: https://lore.kernel.org/r/20230218090513.284718-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 981f40458e7a6ffbdff1a09ece6099b3b49d08a5 Merge: 871489dd01b67 6702782845a5b Author: Jakub Kicinski Date: Mon Feb 20 16:46:11 2023 -0800 Merge branch 'net-sched-cls_api-support-hardware-miss-to-tc-action' Paul Blakey says: ==================== net/sched: cls_api: Support hardware miss to tc action This series adds support for hardware miss to instruct tc to continue execution in a specific tc action instance on a filter's action list. The mlx5 driver patch (besides the refactors) shows its usage instead of using just chain restore. Currently a filter's action list must be executed all together or not at all as driver are only able to tell tc to continue executing from a specific tc chain, and not a specific filter/action. This is troublesome with regards to action CT, where new connections should be sent to software (via tc chain restore), and established connections can be handled in hardware. Checking for new connections is done when executing the ct action in hardware (by checking the packet's tuple against known established tuples). But if there is a packet modification (pedit) action before action CT and the checked tuple is a new connection, hardware will need to revert the previous packet modifications before sending it back to software so it can re-match the same tc filter in software and re-execute its CT action. The following is an example configuration of stateless nat on mlx5 driver that isn't supported before this patchet: #Setup corrosponding mlx5 VFs in namespaces $ ip netns add ns0 $ ip netns add ns1 $ ip link set dev enp8s0f0v0 netns ns0 $ ip netns exec ns0 ifconfig enp8s0f0v0 1.1.1.1/24 up $ ip link set dev enp8s0f0v1 netns ns1 $ ip netns exec ns1 ifconfig enp8s0f0v1 1.1.1.2/24 up #Setup tc arp and ct rules on mxl5 VF representors $ tc qdisc add dev enp8s0f0_0 ingress $ tc qdisc add dev enp8s0f0_1 ingress $ ifconfig enp8s0f0_0 up $ ifconfig enp8s0f0_1 up #Original side $ tc filter add dev enp8s0f0_0 ingress chain 0 proto ip flower \ ct_state -trk ip_proto tcp dst_port 8888 \ action pedit ex munge tcp dport set 5001 pipe \ action csum ip tcp pipe \ action ct pipe \ action goto chain 1 $ tc filter add dev enp8s0f0_0 ingress chain 1 proto ip flower \ ct_state +trk+est \ action mirred egress redirect dev enp8s0f0_1 $ tc filter add dev enp8s0f0_0 ingress chain 1 proto ip flower \ ct_state +trk+new \ action ct commit pipe \ action mirred egress redirect dev enp8s0f0_1 $ tc filter add dev enp8s0f0_0 ingress chain 0 proto arp flower \ action mirred egress redirect dev enp8s0f0_1 #Reply side $ tc filter add dev enp8s0f0_1 ingress chain 0 proto arp flower \ action mirred egress redirect dev enp8s0f0_0 $ tc filter add dev enp8s0f0_1 ingress chain 0 proto ip flower \ ct_state -trk ip_proto tcp \ action ct pipe \ action pedit ex munge tcp sport set 8888 pipe \ action csum ip tcp pipe \ action mirred egress redirect dev enp8s0f0_0 #Run traffic $ ip netns exec ns1 iperf -s -p 5001& $ sleep 2 #wait for iperf to fully open $ ip netns exec ns0 iperf -c 1.1.1.2 -p 8888 #dump tc filter stats on enp8s0f0_0 chain 0 rule and see hardware packets: $ tc -s filter show dev enp8s0f0_0 ingress chain 0 proto ip | grep "hardware.*pkt" Sent hardware 9310116832 bytes 6149672 pkt Sent hardware 9310116832 bytes 6149672 pkt Sent hardware 9310116832 bytes 6149672 pkt A new connection executing the first filter in hardware will first rewrite the dst port to the new port, and then the ct action is executed, because this is a new connection, hardware will need to be send this back to software, on chain 0, to execute the first filter again in software. The dst port needs to be reverted otherwise it won't re-match the old dst port in the first filter. Because of that, currently mlx5 driver will reject offloading the above action ct rule. This series adds support for hardware partially executing a filter's action list, and letting tc software continue processing in the specific action instance where hardware left off (in the above case after the "action pedit ex munge tcp dport... of the first rule") allowing support for scenarios such as the above. ==================== Link: https://lore.kernel.org/r/20230217223620.28508-1-paulb@nvidia.com Signed-off-by: Jakub Kicinski commit 6702782845a5bf381a19b204c369e63420041665 Author: Paul Blakey Date: Sat Feb 18 00:36:20 2023 +0200 net/mlx5e: TC, Set CT miss to the specific ct action instance Currently, CT misses restore the missed chain on the tc skb extension so tc will continue from the relevant chain. Instead, restore the CT action's miss cookie on the extension, which will instruct tc to continue from the this specific CT action instance on the relevant filter's action list. Map the CT action's miss_cookie to a new miss object (ACT_MISS), and use this miss mapping instead of the current chain miss object (CHAIN_MISS) for CT action misses. To restore this new miss mapping value, add a RX restore rule for each such mapping value. Signed-off-by: Paul Blakey Reviewed-by: Roi Dayan Reviewed-by: Oz Sholmo Signed-off-by: Jakub Kicinski commit 235ff07da7ec2e5addcee68a366ac987571b4d7c Author: Paul Blakey Date: Sat Feb 18 00:36:19 2023 +0200 net/mlx5e: Rename CHAIN_TO_REG to MAPPED_OBJ_TO_REG This reg usage is always a mapped object, not necessarily containing chain info. Rename to properly convey what it stores. This patch doesn't change any functionality. Signed-off-by: Paul Blakey Reviewed-by: Roi Dayan Reviewed-by: Leon Romanovsky Signed-off-by: Jakub Kicinski commit 93a1ab2c545b88fa70f8c91b60b54e4175008742 Author: Paul Blakey Date: Sat Feb 18 00:36:18 2023 +0200 net/mlx5: Refactor tc miss handling to a single function Move tc miss handling code to en_tc.c, and remove duplicate code. Signed-off-by: Paul Blakey Reviewed-by: Roi Dayan Signed-off-by: Jakub Kicinski commit 03a283cdc8c80fd6002f8ab898ff5ccf78e33f95 Author: Paul Blakey Date: Sat Feb 18 00:36:17 2023 +0200 net/mlx5: Kconfig: Make tc offload depend on tc skb extension Tc skb extension is a basic requirement for using tc offload to support correct restoration on action miss. Depend on it. Signed-off-by: Paul Blakey Signed-off-by: Jakub Kicinski commit 606c7c43d08c4daf954ec8d58ae6dd39292fb457 Author: Paul Blakey Date: Sat Feb 18 00:36:16 2023 +0200 net/sched: flower: Support hardware miss to tc action To support hardware miss to tc action in actions on the flower classifier, implement the required getting of filter actions, and setup filter exts (actions) miss by giving it the filter's handle and actions. Signed-off-by: Paul Blakey Reviewed-by: Jiri Pirko Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 08a0063df3aed8d76a4034279117db12dbc1050f Author: Paul Blakey Date: Sat Feb 18 00:36:15 2023 +0200 net/sched: flower: Move filter handle initialization earlier To support miss to action during hardware offload the filter's handle is needed when setting up the actions (tcf_exts_init()), and before offloading. Move filter handle initialization earlier. Signed-off-by: Paul Blakey Reviewed-by: Jiri Pirko Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 80cd22c35c9001fe72bf614d29439de41933deca Author: Paul Blakey Date: Sat Feb 18 00:36:14 2023 +0200 net/sched: cls_api: Support hardware miss to tc action For drivers to support partial offload of a filter's action list, add support for action miss to specify an action instance to continue from in sw. CT action in particular can't be fully offloaded, as new connections need to be handled in software. This imposes other limitations on the actions that can be offloaded together with the CT action, such as packet modifications. Assign each action on a filter's action list a unique miss_cookie which drivers can then use to fill action_miss part of the tc skb extension. On getting back this miss_cookie, find the action instance with relevant cookie and continue classifying from there. Signed-off-by: Paul Blakey Reviewed-by: Jiri Pirko Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit db4b49025c0c7116f1d2dfe8d5bbfc983ac054de Author: Paul Blakey Date: Sat Feb 18 00:36:13 2023 +0200 net/sched: Rename user cookie and act cookie struct tc_action->act_cookie is a user defined cookie, and the related struct flow_action_entry->act_cookie is used as an handle similar to struct flow_cls_offload->cookie. Rename tc_action->act_cookie to user_cookie, and flow_action_entry->act_cookie to cookie so their names would better fit their usage. Signed-off-by: Paul Blakey Reviewed-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski commit 871489dd01b67483248edc8873c389a66e469f30 Merge: 5f22c3b6215d3 ed9a8ad7d8a1a Author: Jakub Kicinski Date: Mon Feb 20 16:40:52 2023 -0800 Merge tag 'ieee802154-for-net-next-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next Stefan Schmidt says: ==================== pull-request: ieee802154-next 2023-02-20 Miquel Raynal build upon his earlier work and introduced two new features into the ieee802154 stack. Beaconing to announce existing PAN's and passive scanning to discover the beacons and associated PAN's. The matching changes to the userspace configuration tool have been posted as well and will be released together with the kernel release. Arnd Bergmann and Dmitry Torokhov worked on converting the at86rf230 and cc2520 drivers away from the unused platform_data usage and towards the new gpiod API. (I had to add a revert as Dmitry found a regression on an already pushed tree on my side). Changes since v1 (pull request 2023-02-02) - Netlink API extack and NLA_POLICY* usage as suggested by Jakub - Removed always true condition found by kernel test robot - Simplify device removal with running background job for scanning - Fix problems with beacon sending in some cases by using the MLME tx path * tag 'ieee802154-for-net-next-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next: ieee802154: Drop device trackers mac802154: Fix an always true condition mac802154: Send beacons using the MLME Tx path ieee802154: Change error code on monitor scan netlink request ieee802154: Convert scan error messages to extack ieee802154: Use netlink policies when relevant on scan parameters ieee802154: at86rf230: switch to using gpiod API ieee802154: at86rf230: drop support for platform data Revert "at86rf230: convert to gpio descriptors" cc2520: move to gpio descriptors mac802154: Avoid superfluous endianness handling at86rf230: convert to gpio descriptors mac802154: Handle basic beaconing ieee802154: Add support for user beaconing requests mac802154: Handle passive scanning mac802154: Add MLME Tx locked helpers mac802154: Prepare forcing specific symbol duration ieee802154: Introduce a helper to validate a channel ieee802154: Define a beacon frame header ieee802154: Add support for user scanning requests ==================== Link: https://lore.kernel.org/r/20230220213749.386451-1-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit 5f22c3b6215d34b8af45c390c8d5ea2cef2ef5d2 Author: Alejandro Lucero Date: Mon Feb 20 11:01:33 2023 +0000 sfc: fix builds without CONFIG_RTC_LIB Add an embarrassingly missed semicolon plus and embarrassingly missed parenthesis breaking kernel building when CONFIG_RTC_LIB is not set like the one reported with ia64 config. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302170047.EjCPizu3-lkp@intel.com/ Fixes: 14743ddd2495 ("sfc: add devlink info support for ef100") Signed-off-by: Alejandro Lucero Link: https://lore.kernel.org/r/20230220110133.29645-1-alejandro.lucero-palau@amd.com Signed-off-by: Jakub Kicinski commit 5feeaba1063102baf789f4df263f655333924ccb Author: Yang Li Date: Mon Feb 20 14:59:58 2023 +0800 sfc: clean up some inconsistent indentings Fix some indentngs and remove the warning below: drivers/net/ethernet/sfc/mae.c:657 efx_mae_enumerate_mports() warn: inconsistent indenting Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4117 Signed-off-by: Yang Li Acked-by: Martin Habets Link: https://lore.kernel.org/r/20230220065958.52941-1-yang.lee@linux.alibaba.com Signed-off-by: Jakub Kicinski commit f8f185e39b4de91bc5235e5be0d829bea69d9b06 Author: Kees Cook Date: Sat Feb 18 10:38:50 2023 -0800 net/mlx4_en: Introduce flexible array to silence overflow warning The call "skb_copy_from_linear_data(skb, inl + 1, spc)" triggers a FORTIFY memcpy() warning on ppc64 platform: In function ‘fortify_memcpy_chk’, inlined from ‘skb_copy_from_linear_data’ at ./include/linux/skbuff.h:4029:2, inlined from ‘build_inline_wqe’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:722:4, inlined from ‘mlx4_en_xmit’ at drivers/net/ethernet/mellanox/mlx4/en_tx.c:1066:3: ./include/linux/fortify-string.h:513:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 513 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Same behaviour on x86 you can get if you use "__always_inline" instead of "inline" for skb_copy_from_linear_data() in skbuff.h The call here copies data into inlined tx destricptor, which has 104 bytes (MAX_INLINE) space for data payload. In this case "spc" is known in compile-time but the destination is used with hidden knowledge (real structure of destination is different from that the compiler can see). That cause the fortify warning because compiler can check bounds, but the real bounds are different. "spc" can't be bigger than 64 bytes (MLX4_INLINE_ALIGN), so the data can always fit into inlined tx descriptor. The fact that "inl" points into inlined tx descriptor is determined earlier in mlx4_en_xmit(). Avoid confusing the compiler with "inl + 1" constructions to get to past the inl header by introducing a flexible array "data" to the struct so that the compiler can see that we are not dealing with an array of inl structs, but rather, arbitrary data following the structure. There are no changes to the structure layout reported by pahole, and the resulting machine code is actually smaller. Reported-by: Josef Oskera Link: https://lore.kernel.org/lkml/20230217094541.2362873-1-joskera@redhat.com Fixes: f68f2ff91512 ("fortify: Detect struct member overflows in memcpy() at compile-time") Cc: Yishai Hadas Signed-off-by: Kees Cook Reviewed-by: Tariq Toukan Link: https://lore.kernel.org/r/20230218183842.never.954-kees@kernel.org Signed-off-by: Jakub Kicinski commit e7388b8a1a5bdf47a9a46803a5686387c1ce060d Author: David Howells Date: Mon Jan 16 14:19:29 2023 +0000 cifs: DIO to/from KVEC-type iterators should now work DIO to/from KVEC-type iterators should now work as the iterator is passed down to the socket in non-RDMA/non-crypto mode and in RDMA or crypto mode care is taken to handle vmap/vmalloc correctly and not take page refs when building a scatterlist. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Tom Talpey cc: Jeff Layton cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 607aea3cc2a8f46d24c78eb4efcc511af1c2f74d Author: David Howells Date: Mon Jan 24 21:13:24 2022 +0000 cifs: Remove unused code Remove a bunch of functions that are no longer used and are commented out after the conversion to use iterators throughout the I/O path. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org Link: https://lore.kernel.org/r/164928621823.457102.8777804402615654773.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165211421039.3154751.15199634443157779005.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165348881165.2106726.2993852968344861224.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165364827876.3334034.9331465096417303889.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/166126396915.708021.2010212654244139442.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/166697261080.61150.17513116912567922274.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/166732033255.3186319.5527423437137895940.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit 3d78fe73fa123964be30f0acec449dc8a2241dae Author: David Howells Date: Wed Jan 25 13:34:38 2023 +0000 cifs: Build the RDMA SGE list directly from an iterator In the depths of the cifs RDMA code, extract part of an iov iterator directly into an SGE list without going through an intermediate scatterlist. Note that this doesn't support extraction from an IOBUF- or UBUF-type iterator (ie. user-supplied buffer). The assumption is that the higher layers will extract those to a BVEC-type iterator first and do whatever is required to stop the pages from going away. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Tom Talpey cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-rdma@vger.kernel.org Link: https://lore.kernel.org/r/166697260361.61150.5064013393408112197.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/166732032518.3186319.1859601819981624629.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit d08089f649a0cfb2099c8551ac47eef0cc23fdf2 Author: David Howells Date: Mon Jan 24 21:13:24 2022 +0000 cifs: Change the I/O paths to use an iterator rather than a page list Currently, the cifs I/O paths hand lists of pages from the VM interface routines at the top all the way through the intervening layers to the socket interface at the bottom. This is a problem, however, for interfacing with netfslib which passes an iterator through to the ->issue_read() method (and will pass an iterator through to the ->issue_write() method in future). Netfslib takes over bounce buffering for direct I/O, async I/O and encrypted content, so cifs doesn't need to do that. Netfslib also converts IOVEC-type iterators into BVEC-type iterators if necessary. Further, cifs needs foliating - and folios may come in a variety of sizes, so a page list pointing to an array of heterogeneous pages may cause problems in places such as where crypto is done. Change the cifs I/O paths to hand iov_iter iterators all the way through instead. Notes: (1) Some old routines are #if'd out to be removed in a follow up patch so as to avoid confusing diff, thereby making the diff output easier to follow. I've removed functions that don't overlap with anything added. (2) struct smb_rqst loses rq_pages, rq_offset, rq_npages, rq_pagesz and rq_tailsz which describe the pages forming the buffer; instead there's an rq_iter describing the source buffer and an rq_buffer which is used to hold the buffer for encryption. (3) struct cifs_readdata and cifs_writedata are similarly modified to smb_rqst. The ->read_into_pages() and ->copy_into_pages() are then replaced with passing the iterator directly to the socket. The iterators are stored in these structs so that they are persistent and don't get deallocated when the function returns (unlike if they were stack variables). (4) Buffered writeback is overhauled, borrowing the code from the afs filesystem to gather up contiguous runs of folios. The XARRAY-type iterator is then used to refer directly to the pagecache and can be passed to the socket to transmit data directly from there. This includes: cifs_extend_writeback() cifs_write_back_from_locked_folio() cifs_writepages_region() cifs_writepages() (5) Pages are converted to folios. (6) Direct I/O uses netfs_extract_user_iter() to create a BVEC-type iterator from an IOBUF/UBUF-type source iterator. (7) smb2_get_aead_req() uses netfs_extract_iter_to_sg() to extract page fragments from the iterator into the scatterlists that the crypto layer prefers. (8) smb2_init_transform_rq() attached pages to smb_rqst::rq_buffer, an xarray, to use as a bounce buffer for encryption. An XARRAY-type iterator can then be used to pass the bounce buffer to lower layers. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Paulo Alcantara cc: Jeff Layton cc: linux-cifs@vger.kernel.org Link: https://lore.kernel.org/r/164311907995.2806745.400147335497304099.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/164928620163.457102.11602306234438271112.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165211420279.3154751.15923591172438186144.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165348880385.2106726.3220789453472800240.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165364827111.3334034.934805882842932881.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/166126396180.708021.271013668175370826.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/166697259595.61150.5982032408321852414.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/166732031756.3186319.12528413619888902872.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit 3a70e0d4c9d74cb00f7c0ec022f5599f9f7ba07d Author: Horatiu Vultur Date: Fri Feb 17 22:09:17 2023 +0100 net: lan966x: Fix possible deadlock inside PTP When doing timestamping in lan966x and having PROVE_LOCKING enabled the following warning is shown. ======================================================== WARNING: possible irq lock inversion dependency detected 6.2.0-rc7-01749-gc54e1f7f7e36 #2786 Tainted: G N -------------------------------------------------------- swapper/0/0 just changed the state of lock: c2609f50 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x16c/0x2e8 but this lock took another, SOFTIRQ-unsafe lock in the past: (&lan966x->ptp_ts_id_lock){+.+.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&lan966x->ptp_ts_id_lock); local_irq_disable(); lock(_xmit_ETHER#2); lock(&lan966x->ptp_ts_id_lock); lock(_xmit_ETHER#2); *** DEADLOCK *** 5 locks held by swapper/0/0: #0: c1001e18 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0x0/0x33c #1: c105e7c4 (rcu_read_lock){....}-{1:2}, at: ndisc_send_skb+0x134/0x81c #2: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: ip6_finish_output2+0x17c/0xc64 #3: c105e7d8 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x4c/0x1224 #4: c3056174 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x354/0x1224 the shortest dependencies between 2nd lock and 1st lock: -> (&lan966x->ptp_ts_id_lock){+.+.}-{2:2} { HARDIRQ-ON-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 lan966x_ptp_irq_handler+0x164/0x2a8 irq_thread_fn+0x1c/0x78 irq_thread+0x130/0x278 kthread+0xec/0x110 ret_from_fork+0x14/0x28 SOFTIRQ-ON-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 lan966x_ptp_irq_handler+0x164/0x2a8 irq_thread_fn+0x1c/0x78 irq_thread+0x130/0x278 kthread+0xec/0x110 ret_from_fork+0x14/0x28 INITIAL USE at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock_irqsave+0x4c/0x68 lan966x_ptp_txtstamp_request+0x128/0x1cc lan966x_port_xmit+0x224/0x43c dev_hard_start_xmit+0xa8/0x2f0 sch_direct_xmit+0x108/0x2e8 __dev_queue_xmit+0x41c/0x1224 packet_sendmsg+0xdb4/0x134c __sys_sendto+0xd0/0x154 sys_send+0x18/0x20 ret_fast_syscall+0x0/0x1c } ... key at: [] __key.2+0x0/0x8 ... acquired at: _raw_spin_lock_irqsave+0x4c/0x68 lan966x_ptp_txtstamp_request+0x128/0x1cc lan966x_port_xmit+0x224/0x43c dev_hard_start_xmit+0xa8/0x2f0 sch_direct_xmit+0x108/0x2e8 __dev_queue_xmit+0x41c/0x1224 packet_sendmsg+0xdb4/0x134c __sys_sendto+0xd0/0x154 sys_send+0x18/0x20 ret_fast_syscall+0x0/0x1c -> (_xmit_ETHER#2){+.-.}-{2:2} { HARDIRQ-ON-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 netif_freeze_queues+0x38/0x68 dev_deactivate_many+0xac/0x388 dev_deactivate+0x38/0x6c linkwatch_do_dev+0x70/0x8c __linkwatch_run_queue+0xd4/0x1e8 linkwatch_event+0x24/0x34 process_one_work+0x284/0x744 worker_thread+0x28/0x4bc kthread+0xec/0x110 ret_from_fork+0x14/0x28 IN-SOFTIRQ-W at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 sch_direct_xmit+0x16c/0x2e8 __dev_queue_xmit+0x41c/0x1224 ip6_finish_output2+0x5f4/0xc64 ndisc_send_skb+0x4cc/0x81c addrconf_rs_timer+0xb0/0x2f8 call_timer_fn+0xb4/0x33c expire_timers+0xb4/0x10c run_timer_softirq+0xf8/0x2a8 __do_softirq+0xd4/0x5fc __irq_exit_rcu+0x138/0x17c irq_exit+0x8/0x28 __irq_svc+0x90/0xbc arch_cpu_idle+0x30/0x3c default_idle_call+0x44/0xac do_idle+0xc8/0x138 cpu_startup_entry+0x18/0x1c rest_init+0xcc/0x168 arch_post_acpi_subsys_init+0x0/0x8 INITIAL USE at: lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 netif_freeze_queues+0x38/0x68 dev_deactivate_many+0xac/0x388 dev_deactivate+0x38/0x6c linkwatch_do_dev+0x70/0x8c __linkwatch_run_queue+0xd4/0x1e8 linkwatch_event+0x24/0x34 process_one_work+0x284/0x744 worker_thread+0x28/0x4bc kthread+0xec/0x110 ret_from_fork+0x14/0x28 } ... key at: [] netdev_xmit_lock_key+0x8/0x1c8 ... acquired at: __lock_acquire+0x978/0x2978 lock_acquire.part.0+0xb0/0x248 _raw_spin_lock+0x38/0x48 sch_direct_xmit+0x16c/0x2e8 __dev_queue_xmit+0x41c/0x1224 ip6_finish_output2+0x5f4/0xc64 ndisc_send_skb+0x4cc/0x81c addrconf_rs_timer+0xb0/0x2f8 call_timer_fn+0xb4/0x33c expire_timers+0xb4/0x10c run_timer_softirq+0xf8/0x2a8 __do_softirq+0xd4/0x5fc __irq_exit_rcu+0x138/0x17c irq_exit+0x8/0x28 __irq_svc+0x90/0xbc arch_cpu_idle+0x30/0x3c default_idle_call+0x44/0xac do_idle+0xc8/0x138 cpu_startup_entry+0x18/0x1c rest_init+0xcc/0x168 arch_post_acpi_subsys_init+0x0/0x8 stack backtrace: CPU: 0 PID: 0 Comm: swapper/0 Tainted: G N 6.2.0-rc7-01749-gc54e1f7f7e36 #2786 Hardware name: Generic DT based system unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from mark_lock.part.0+0x59c/0x93c mark_lock.part.0 from __lock_acquire+0x978/0x2978 __lock_acquire from lock_acquire.part.0+0xb0/0x248 lock_acquire.part.0 from _raw_spin_lock+0x38/0x48 _raw_spin_lock from sch_direct_xmit+0x16c/0x2e8 sch_direct_xmit from __dev_queue_xmit+0x41c/0x1224 __dev_queue_xmit from ip6_finish_output2+0x5f4/0xc64 ip6_finish_output2 from ndisc_send_skb+0x4cc/0x81c ndisc_send_skb from addrconf_rs_timer+0xb0/0x2f8 addrconf_rs_timer from call_timer_fn+0xb4/0x33c call_timer_fn from expire_timers+0xb4/0x10c expire_timers from run_timer_softirq+0xf8/0x2a8 run_timer_softirq from __do_softirq+0xd4/0x5fc __do_softirq from __irq_exit_rcu+0x138/0x17c __irq_exit_rcu from irq_exit+0x8/0x28 irq_exit from __irq_svc+0x90/0xbc Exception stack(0xc1001f20 to 0xc1001f68) 1f20: ffffffff ffffffff 00000001 c011f840 c100e000 c100e000 c1009314 c1009370 1f40: c10f0c1a c0d5e564 c0f5da8c 00000000 00000000 c1001f70 c010f0bc c010f0c0 1f60: 600f0013 ffffffff __irq_svc from arch_cpu_idle+0x30/0x3c arch_cpu_idle from default_idle_call+0x44/0xac default_idle_call from do_idle+0xc8/0x138 do_idle from cpu_startup_entry+0x18/0x1c cpu_startup_entry from rest_init+0xcc/0x168 rest_init from arch_post_acpi_subsys_init+0x0/0x8 Fix this by using spin_lock_irqsave/spin_lock_irqrestore also inside lan966x_ptp_irq_handler. Fixes: e85a96e48e33 ("net: lan966x: Add support for ptp interrupts") Signed-off-by: Horatiu Vultur Link: https://lore.kernel.org/r/20230217210917.2649365-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit be9832c2e9cc4c15906a77baddcd906fb4bb864b Author: Kuniyuki Iwashima Date: Fri Feb 17 12:09:20 2023 -0800 net/ulp: Remove redundant ->clone() test in inet_clone_ulp(). Commit 2c02d41d71f9 ("net/ulp: prevent ULP without clone op from entering the LISTEN status") guarantees that all ULP listeners have clone() op, so we no longer need to test it in inet_clone_ulp(). Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230217200920.85306-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit ee8d72a157ebb4b8c4b8b664f5a78a341fede2ef Merge: 01bb11ad828b3 168de0233586f Author: Jakub Kicinski Date: Mon Feb 20 15:38:41 2023 -0800 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2023-02-17 We've added 64 non-merge commits during the last 7 day(s) which contain a total of 158 files changed, 4190 insertions(+), 988 deletions(-). The main changes are: 1) Add a rbtree data structure following the "next-gen data structure" precedent set by recently-added linked-list, that is, by using kfunc + kptr instead of adding a new BPF map type, from Dave Marchevsky. 2) Add a new benchmark for hashmap lookups to BPF selftests, from Anton Protopopov. 3) Fix bpf_fib_lookup to only return valid neighbors and add an option to skip the neigh table lookup, from Martin KaFai Lau. 4) Add cgroup.memory=nobpf kernel parameter option to disable BPF memory accouting for container environments, from Yafang Shao. 5) Batch of ice multi-buffer and driver performance fixes, from Alexander Lobakin. 6) Fix a bug in determining whether global subprog's argument is PTR_TO_CTX, which is based on type names which breaks kprobe progs, from Andrii Nakryiko. 7) Prep work for future -mcpu=v4 LLVM option which includes usage of BPF_ST insn. Thus improve BPF_ST-related value tracking in verifier, from Eduard Zingerman. 8) More prep work for later building selftests with Memory Sanitizer in order to detect usages of undefined memory, from Ilya Leoshkevich. 9) Fix xsk sockets to check IFF_UP earlier to avoid a NULL pointer dereference via sendmsg(), from Maciej Fijalkowski. 10) Implement BPF trampoline for RV64 JIT compiler, from Pu Lehui. 11) Fix BPF memory allocator in combination with BPF hashtab where it could corrupt special fields e.g. used in bpf_spin_lock, from Hou Tao. 12) Fix LoongArch BPF JIT to always use 4 instructions for function address so that instruction sequences don't change between passes, from Hengqi Chen. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (64 commits) selftests/bpf: Add bpf_fib_lookup test bpf: Add BPF_FIB_LOOKUP_SKIP_NEIGH for bpf_fib_lookup riscv, bpf: Add bpf trampoline support for RV64 riscv, bpf: Add bpf_arch_text_poke support for RV64 riscv, bpf: Factor out emit_call for kernel and bpf context riscv: Extend patch_text for multiple instructions Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES" selftests/bpf: Add global subprog context passing tests selftests/bpf: Convert test_global_funcs test to test_loader framework bpf: Fix global subprog context argument resolution logic LoongArch, bpf: Use 4 instructions for function address in JIT bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state bpf: Disable bh in bpf_test_run for xdp and tc prog xsk: check IFF_UP earlier in Tx path Fix typos in selftest/bpf files selftests/bpf: Use bpf_{btf,link,map,prog}_get_info_by_fd() samples/bpf: Use bpf_{btf,link,map,prog}_get_info_by_fd() bpftool: Use bpf_{btf,link,map,prog}_get_info_by_fd() libbpf: Use bpf_{btf,link,map,prog}_get_info_by_fd() libbpf: Introduce bpf_{btf,link,map,prog}_get_info_by_fd() ... ==================== Link: https://lore.kernel.org/r/20230217221737.31122-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit deeacf35c922da579637f5db625af20baafc66ed Author: Si-Wei Liu Date: Mon Feb 6 15:12:04 2023 -0800 vdpa/mlx5: support device features provisioning This patch implements features provisioning for mlx5_vdpa. 1) Validate the provisioned features are a subset of the parent features. 2) Clearing features that are not wanted by userspace. For example: # vdpa mgmtdev show pci/0000:41:04.2: supported_classes net max_supported_vqs 65 dev_features CSUM GUEST_CSUM MTU MAC HOST_TSO4 HOST_TSO6 STATUS CTRL_VQ CTRL_VLAN MQ CTRL_MAC_ADDR VERSION_1 ACCESS_PLATFORM 1) Provision vDPA device with all features derived from the parent # vdpa dev add name vdpa1 mgmtdev pci/0000:41:04.2 # vdpa dev config show vdpa1: mac e4:11:c6:d3:45:f0 link up link_announce false max_vq_pairs 1 mtu 1500 negotiated_features CSUM GUEST_CSUM MTU HOST_TSO4 HOST_TSO6 STATUS CTRL_VQ CTRL_VLAN MQ CTRL_MAC_ADDR VERSION_1 ACCESS_PLATFORM 2) Provision vDPA device with a subset of parent features # vdpa dev add name vdpa1 mgmtdev pci/0000:41:04.2 device_features 0x300020000 # vdpa dev config show vdpa1: negotiated_features CTRL_VQ VERSION_1 ACCESS_PLATFORM Signed-off-by: Si-Wei Liu Reviewed-by: Eli Cohen Message-Id: <1675725124-7375-7-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin commit 033779a708f0b0aa89d3a9ad937fb1a97a06a10c Author: Si-Wei Liu Date: Mon Feb 6 15:12:03 2023 -0800 vdpa/mlx5: make MTU/STATUS presence conditional on feature bits The spec says: mtu only exists if VIRTIO_NET_F_MTU is set status only exists if VIRTIO_NET_F_STATUS is set We should only present MTU and STATUS conditionally depending on the feature bits. Signed-off-by: Si-Wei Liu Reviewed-by: Eli Cohen Message-Id: <1675725124-7375-6-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin commit dbb6f1c42ade73f2c1652bf167d48f20f98bb834 Author: Si-Wei Liu Date: Mon Feb 6 15:12:02 2023 -0800 vdpa: validate device feature provisioning against supported class Today when device features are explicitly provisioned, the features user supplied may contain device class specific features that are not supported by the parent management device. On the other hand, when parent management device supports more than one class, the device features to provision may be ambiguous if none of the class specific attributes is provided at the same time. Validate these cases and prompt appropriate user errors accordingly. Signed-off-by: Si-Wei Liu Message-Id: <1675725124-7375-5-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin commit e7d09cd1d4a2a83e91a2d2b1713621a8042dd73c Author: Si-Wei Liu Date: Mon Feb 6 15:12:01 2023 -0800 vdpa: validate provisioned device features against specified attribute With device feature provisioning, there's a chance for misconfiguration that the vdpa feature attribute supplied in 'vdpa dev add' command doesn't get selected on the device_features to be provisioned. For instance, when a @mac attribute is specified, the corresponding feature bit _F_MAC in device_features should be set for consistency. If there's conflict on provisioned features against the attribute, it should be treated as an error to fail the ambiguous command. Noted the opposite is not necessarily true, for e.g. it's okay to have _F_MAC set in device_features without providing a corresponding @mac attribute, in which case the vdpa vendor driver could load certain default value for attribute that is not explicitly specified. Generalize this check in vdpa core so that there's no duplicate code in each vendor driver. Signed-off-by: Si-Wei Liu Reviewed-by: Eli Cohen Message-Id: <1675725124-7375-4-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin commit 6e6d39830bc681533d97af78e2066a7e9ab6b5d8 Author: Si-Wei Liu Date: Mon Feb 6 15:12:00 2023 -0800 vdpa: conditionally read STATUS in config space The spec says: status only exists if VIRTIO_NET_F_STATUS is set Similar to MAC and MTU, vdpa_dev_net_config_fill() should read STATUS conditionally depending on the feature bits. Signed-off-by: Si-Wei Liu Reviewed-by: Parav Pandit Reviewed-by: Eli Cohen Message-Id: <1675725124-7375-3-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin commit 275487b4be8969fdb15fd2d47510d358963629d6 Author: Si-Wei Liu Date: Mon Feb 6 15:11:59 2023 -0800 vdpa: fix improper error message when adding vdpa dev In below example, before the fix, mtu attribute is supported by the parent mgmtdev, but the error message showing "All provided are not supported" is just misleading. $ vdpa mgmtdev show vdpasim_net: supported_classes net max_supported_vqs 3 dev_features MTU MAC CTRL_VQ CTRL_MAC_ADDR ANY_LAYOUT VERSION_1 ACCESS_PLATFORM $ vdpa dev add mgmtdev vdpasim_net name vdpasim0 mtu 5000 max_vqp 2 Error: vdpa: All provided attributes are not supported. kernel answers: Operation not supported After fix, the relevant error message will be like: $ vdpa dev add mgmtdev vdpasim_net name vdpasim0 mtu 5000 max_vqp 2 Error: vdpa: Some provided attributes are not supported: 0x1000. kernel answers: Operation not supported Fixes: d8ca2fa5be1b ("vdpa: Enable user to set mac and mtu of vdpa device") Signed-off-by: Si-Wei Liu Reviewed-by: Parav Pandit Reviewed-by: Eli Cohen Message-Id: <1675725124-7375-2-git-send-email-si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin commit c04e2145b8c9e1429ad2134291a830d2ba39657a Author: Eli Cohen Date: Mon Feb 6 14:20:16 2023 +0200 vdpa/mlx5: Initialize CVQ iotlb spinlock Initialize itolb spinlock. Fixes: 5262912ef3cf ("vdpa/mlx5: Add support for control VQ and MAC setting") Signed-off-by: Eli Cohen Message-Id: <20230206122016.1149373-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit aef24311bd2d8a6d39a80c34f278b0fd1692aed3 Author: Eli Cohen Date: Mon Feb 6 14:19:56 2023 +0200 vdpa/mlx5: Don't clear mr struct on destroy MR Clearing the mr struct erases the lock owner and causes warnings to be emitted. It is not required to clear the mr so remove the memset call. Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code") Signed-off-by: Eli Cohen Message-Id: <20230206121956.1149356-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 446062e6adc48f1e963ce57621b5bfcbf999cda7 Author: Eli Cohen Date: Sun Feb 5 09:29:06 2023 +0200 vdpa/mlx5: Directly assign memory key When creating a memory key, the key value should be assigned to the passed pointer and not or'ed to. No functional issue was observed due to this bug. Fixes: 29064bfdabd5 ("vdpa/mlx5: Add support library for mlx5 VDPA implementation") Signed-off-by: Eli Cohen Message-Id: <20230205072906.1108194-1-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 0d0ed4006127714e318c9a9d7796f5c8532a21e7 Author: Shunsuke Mie Date: Thu Feb 2 19:45:38 2023 +0900 tools/virtio: enable to build with retpoline Add build options to bring it close to a linux kernel. It allows for testing that is close to reality. Signed-off-by: Shunsuke Mie Message-Id: <20230202104538.2041879-1-mie@igel.co.jp> Signed-off-by: Michael S. Tsirkin commit 2e44ca3f1f0ba2022f949003f02cc091144e54a3 Author: Shunsuke Mie Date: Thu Feb 2 19:42:48 2023 +0900 vringh: fix a typo in comments for vringh_kiov Probably it is a simple copy error from struct vring_iov. Signed-off-by: Shunsuke Mie Message-Id: <20230202104248.2040652-1-mie@igel.co.jp> Signed-off-by: Michael S. Tsirkin commit 6830a6aba9d40f1491f991d7b31bb2b90187111c Author: Alvaro Karsz Date: Thu Feb 2 10:42:12 2023 +0200 vhost-vdpa: print warning when vhost_vdpa_alloc_domain fails Add a print explaining why vhost_vdpa_alloc_domain failed if the device is not IOMMU cache coherent capable. Without this print, we have no hint why the operation failed. For example: $ virsh start error: Failed to start domain error: Unable to open '/dev/vhost-vdpa-' for vdpa device: Unknown error 524 Suggested-by: Eugenio Perez Martin Signed-off-by: Alvaro Karsz Message-Id: <20230202084212.1328530-1-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez Martin commit 08707b5c3344864d8948cb67706bad489b86773d Author: Zheng Wang Date: Thu Feb 2 14:41:24 2023 +0800 scsi: virtio_scsi: fix handling of kmalloc failure There is no check about the return value of kmalloc in virtscsi_rescan_hotunplug. Add the check to avoid use of null pointer 'inq_result' in case of the failure of kmalloc. Signed-off-by: Zheng Wang Message-Id: <20230202064124.22277-1-zyytlz.wz@163.com> Signed-off-by: Michael S. Tsirkin commit 699209fcc55cb97ede9ee8c2160095e0f5dfc73c Author: Colin Ian King Date: Mon Jan 30 09:26:44 2023 +0000 vdpa: Fix a couple of spelling mistakes in some messages There are two spelling mistakes in some literal strings. Fix them. Signed-off-by: Colin Ian King Message-Id: <20230130092644.37002-1-colin.i.king@gmail.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 313389be06ff60b4ad23bdb4ff24a12e7c47cb26 Author: Kangjie Xu Date: Thu Aug 25 16:56:10 2022 +0800 vhost-net: support VIRTIO_F_RING_RESET Add VIRTIO_F_RING_RESET, which indicates that the driver can reset a queue individually. VIRTIO_F_RING_RESET feature is added to virtio-spec 1.2. The relevant information is in oasis-tcs/virtio-spec#124 oasis-tcs/virtio-spec#139 The implementation only adds the feature bit in supported features. It does not require any other changes because we reuse the existing vhost protocol. The virtqueue reset process can be concluded as two parts: 1. The driver can reset a virtqueue. When it is triggered, we use the set_backend to disable the virtqueue. 2. After the virtqueue is disabled, the driver may optionally re-enable it. The process is basically similar to when the device is started, except that the restart process does not need to set features and set mem table since they do not change. QEMU will send messages containing size, base, addr, kickfd and callfd of the virtqueue in order. Specifically, the host kernel will receive these messages in order: a. VHOST_SET_VRING_NUM b. VHOST_SET_VRING_BASE c. VHOST_SET_VRING_ADDR d. VHOST_SET_VRING_KICK e. VHOST_SET_VRING_CALL f. VHOST_NET_SET_BACKEND Finally, after we use set_backend to attach the virtqueue, the virtqueue will be enabled and start to work. Signed-off-by: Kangjie Xu Signed-off-by: Xuan Zhuo Message-Id: <20220825085610.80315-1-kangjie.xu@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit b3d4f02ee7a23716de2fffe232fd810bf0387bf1 Author: Bo Liu Date: Sun Jan 29 04:11:45 2023 -0500 vhost-scsi: convert sysfs snprintf and sprintf to sysfs_emit Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: Bo Liu Message-Id: <20230129091145.2837-1-liubo03@inspur.com> Signed-off-by: Michael S. Tsirkin commit 36871fb92b70599e6755d92ebdfcba7baa3d4f85 Author: Jason Wang Date: Thu Jan 19 14:15:25 2023 +0800 vdpa: mlx5: support per virtqueue dma device This patch implements per virtqueue dma device for mlx5_vdpa. This is needed for virtio_vdpa to work for CVQ which is backed by vringh but not DMA. We simply advertise the vDPA device itself as the DMA device for CVQ then DMA API can simply use PA so the identical mapping for CVQ can still be used. Otherwise the identical (1:1) mapping won't work when platform IOMMU is enabled since the IOVA is allocated on demand which is not necessarily the PA. This fixes the following crash when mlx5 vDPA device is bound to virtio-vdpa with platform IOMMU enabled but not in passthrough mode: BUG: unable to handle page fault for address: ff2fb3063deb1002 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1393001067 P4D 1393002067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 55 PID: 8923 Comm: kworker/u112:3 Kdump: loaded Not tainted 6.1.0+ #7 Hardware name: Dell Inc. PowerEdge R750/0PJ80M, BIOS 1.5.4 12/17/2021 Workqueue: mlx5_vdpa_wq mlx5_cvq_kick_handler [mlx5_vdpa] RIP: 0010:vringh_getdesc_iotlb+0x93/0x1d0 [vringh] Code: 14 25 40 ef 01 00 83 82 c0 0a 00 00 01 48 2b 05 93 5a 1b ea 8b 4c 24 14 48 c1 f8 06 48 c1 e0 0c 48 03 05 90 5a 1b ea 48 01 c8 <0f> b7 00 83 aa c0 0a 00 00 01 65 ff 0d bc e4 41 3f 0f 84 05 01 00 RSP: 0018:ff46821ba664fdf8 EFLAGS: 00010282 RAX: ff2fb3063deb1002 RBX: 0000000000000a20 RCX: 0000000000000002 RDX: ff2fb318d2f94380 RSI: 0000000000000002 RDI: 0000000000000001 RBP: ff2fb3065e832410 R08: ff46821ba664fe00 R09: 0000000000000001 R10: 0000000000000000 R11: 000000000000000d R12: ff2fb3065e832488 R13: ff2fb3065e8324a8 R14: ff2fb3065e8324c8 R15: ff2fb3065e8324a8 FS: 0000000000000000(0000) GS:ff2fb3257fac0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ff2fb3063deb1002 CR3: 0000001392010006 CR4: 0000000000771ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: mlx5_cvq_kick_handler+0x89/0x2b0 [mlx5_vdpa] process_one_work+0x1e2/0x3b0 ? rescuer_thread+0x390/0x390 worker_thread+0x50/0x3a0 ? rescuer_thread+0x390/0x390 kthread+0xd6/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Reviewed-by: Eli Cohen Tested-by: Eli Cohen Signed-off-by: Jason Wang Message-Id: <20230119061525.75068-6-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 99fb2b838f446a2178dec07507c457c0f1cff5ea Author: Jason Wang Date: Thu Jan 19 14:15:24 2023 +0800 vdpa: set dma mask for vDPA device Setting DMA mask for vDPA device in case that there are virtqueue that is not backed by DMA so the vDPA device could be advertised as the DMA device that is used by DMA API for software emulated virtqueues. Reviewed-by: Eli Cohen Tested-by: Eli Cohen Signed-off-by: Jason Wang Message-Id: <20230119061525.75068-5-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit a1baedb11ed4008035cf72777a6cb572fc26184f Author: Jason Wang Date: Thu Jan 19 14:15:23 2023 +0800 virtio-vdpa: support per vq dma device This patch adds the support of per vq dma device for virito-vDPA. vDPA parents then are allowed to use different DMA devices. This is useful for the parents that have software or emulated virtqueues. Reviewed-by: Eli Cohen Tested-by: Eli Cohen Signed-off-by: Jason Wang Message-Id: <20230119061525.75068-4-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 25da258fa61b1a902c781406a4e24a8284fc3d8a Author: Jason Wang Date: Thu Jan 19 14:15:22 2023 +0800 vdpa: introduce get_vq_dma_device() This patch introduces a new method to query the dma device that is use for a specific virtqueue. Reviewed-by: Eli Cohen Tested-by: Eli Cohen Signed-off-by: Jason Wang Message-Id: <20230119061525.75068-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 2713ea3c7d930aa1ff5ef7d4a57a1e4fcc3b9985 Author: Jason Wang Date: Thu Jan 19 14:15:21 2023 +0800 virtio_ring: per virtqueue dma device This patch introduces a per virtqueue dma device. This will be used for virtio devices whose virtqueue are backed by different underlayer devices. One example is the vDPA that where the control virtqueue could be implemented through software mediation. Some of the work are actually done before since the helper like vring_dma_device(). This work left are: - Let vring_dma_device() return the per virtqueue dma device instead of the vdev's parent. - Allow passing a dma_device when creating the virtqueue through a new helper, old vring creation helper will keep using vdev's parent. Reviewed-by: Eli Cohen Tested-by: Eli Cohen Signed-off-by: Jason Wang Message-Id: <20230119061525.75068-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 759aba1e6e7d238d9d37decd8ad1ecc84ebb02b0 Author: Liming Wu Date: Tue Jan 10 10:44:45 2023 +0800 vhost: remove unused paramete "enabled" is defined in vhost_init_device_iotlb, but it is never used. Let's remove it. Signed-off-by: Liming Wu Message-Id: <20230110024445.303-1-liming.wu@jaguarmicro.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella Reviewed-by: Eugenio Pérez commit 62b763ad765319b1e2261aeef5e5fcbd821883bd Author: Liming Wu Date: Thu Jan 5 15:03:56 2023 +0800 vhost-test: remove meaningless debug info remove printk as it is meaningless. Signed-off-by: Liming Wu Message-Id: <20230105070357.274-1-liming.wu@jaguarmicro.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 6c3d329e6486dd079924eba9b791309026b8ea9c Author: Jason Wang Date: Fri Dec 23 14:00:21 2022 +0800 vdpa_sim: get rid of DMA ops We used to (ab)use the DMA ops for setting up identical mappings in the IOTLB. This patch tries to get rid of the those unnecessary DMA ops by maintaining a simple identical/passthrough mappings by default. When bound to virtio_vdpa driver, DMA API will simply use PA as the IOVA and we will be all fine. When the vDPA bus tries to setup customized mapping (e.g when bound to vhost-vDPA), the identical/passthrough mapping will be removed. Signed-off-by: Jason Wang Message-Id: <20221223060021.28011-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Christoph Hellwig commit 0899774cb360769583e91d1951a68af47ce88db2 Author: Jason Wang Date: Fri Dec 23 13:55:48 2022 +0800 vdpa_sim_net: vendor satistics This patch adds support for basic vendor stats that include counters for tx, rx and cvq. Acked-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20221223055548.27810-5-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 5dbb063a3ebfd19a91d7812783fd49d5d829a0d4 Author: Jason Wang Date: Fri Dec 23 13:55:47 2022 +0800 vdpa_sim: support vendor statistics This patch adds a new config ops callback to allow individual simulator to implement the vendor stats callback. Acked-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20221223055548.27810-4-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit bb105d514a25ad3f822da285bc7b6370e20d6353 Author: Jason Wang Date: Fri Dec 23 13:55:46 2022 +0800 vdpasim: customize allocation size Allow individual simulator to customize the allocation size. Reviewed-by: Stefano Garzarella Acked-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20221223055548.27810-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 0497f23e73ec2211eff3921ed33026dea93482a5 Author: Jason Wang Date: Fri Dec 23 13:55:45 2022 +0800 vdpa_sim: switch to use __vdpa_alloc_device() This allows us to control the allocation size of the structure. Reviewed-by: Stefano Garzarella Acked-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20221223055548.27810-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 2f8200efe7300190ad88d8238b119c098b6544bd Author: Jason Wang Date: Wed Dec 21 14:21:46 2022 +0800 vdpa_sim: use weak barriers vDPA simulators are software emulated device, so let's switch to use weak barriers to avoid extra overhead in the driver. Signed-off-by: Jason Wang Message-Id: <20221221062146.15356-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella Acked-by: Eugenio Pérez commit 07b679f70d73483930e8d3c293942416d9cd5c13 Author: Suwan Kim Date: Wed Dec 21 23:54:56 2022 +0900 virtio-blk: support completion batching for the IRQ path This patch adds completion batching to the IRQ path. It reuses batch completion code of virtblk_poll(). It collects requests to io_comp_batch and processes them all at once. It can boost up the performance by 2%. To validate the performance improvement and stabilty, I did fio test with 4 vCPU VM and 12 vCPU VM respectively. Both VMs have 8GB ram and the same number of HW queues as vCPU. The fio cammad is as follows and I ran the fio 5 times and got IOPS average. (io_uring, randread, direct=1, bs=512, iodepth=64 numjobs=2,4) Test result shows about 2% improvement. 4 vcpu VM | numjobs=2 | numjobs=4 ----------------------------------------------------------- fio without patch | 367.2K IOPS | 397.6K IOPS ----------------------------------------------------------- fio with patch | 372.8K IOPS | 407.7K IOPS 12 vcpu VM | numjobs=2 | numjobs=4 ----------------------------------------------------------- fio without patch | 363.6K IOPS | 374.8K IOPS ----------------------------------------------------------- fio with patch | 373.8K IOPS | 385.3K IOPS Signed-off-by: Suwan Kim Reviewed-by: Christoph Hellwig Message-Id: <20221221145456.281218-3-suwan.kim027@gmail.com> Signed-off-by: Michael S. Tsirkin commit 489e18f3d73282f6bf6203324b3b17d459e2e750 Author: Suwan Kim Date: Wed Dec 21 23:54:55 2022 +0900 virtio-blk: set req->state to MQ_RQ_COMPLETE after polling I/O is finished Driver should set req->state to MQ_RQ_COMPLETE after it finishes to process req. But virtio-blk doesn't set MQ_RQ_COMPLETE after virtblk_poll() handles req and req->state still remains MQ_RQ_IN_FLIGHT. Fortunately so far there is no issue about it because blk_mq_end_request_batch() sets req->state to MQ_RQ_IDLE. In this patch, virblk_poll() calls blk_mq_complete_request_remote() to set req->state to MQ_RQ_COMPLETE before it adds req to a batch completion list. So it properly sets req->state after polling I/O is finished. Fixes: 4e0400525691 ("virtio-blk: support polling I/O") Signed-off-by: Suwan Kim Reviewed-by: Christoph Hellwig Message-Id: <20221221145456.281218-2-suwan.kim027@gmail.com> Signed-off-by: Michael S. Tsirkin commit 2b034e82ffc5f24ec54e47785f22f2bc33fda383 Author: Bagas Sanjaya Date: Tue Dec 20 16:58:29 2022 +0700 docs: driver-api: virtio: commentize spec version checking A sentence that checks for later spec version is meant for developers hacking the documentation source. Make it comment block (hidden from actual output). Signed-off-by: Bagas Sanjaya Message-Id: <20221220095828.27588-4-bagasdotme@gmail.com> Signed-off-by: Michael S. Tsirkin commit ae8d2247af6fd209f2042d4a72792b548c96d3df Author: Bagas Sanjaya Date: Tue Dec 20 16:58:28 2022 +0700 docs: driver-api: virtio: slightly reword virtqueues allocation paragraph "It's at this stage that" means "At this point", so use the latter as it is more effective. Signed-off-by: Bagas Sanjaya Message-Id: <20221220095828.27588-3-bagasdotme@gmail.com> Signed-off-by: Michael S. Tsirkin commit fb25d45694f30c82c30b8c720fe1207d15f67167 Author: Bagas Sanjaya Date: Tue Dec 20 16:58:27 2022 +0700 docs: driver-api: virtio: parenthesize external reference targets Parenthesize targets to links in "References" section to distinguish them from remaining texts. While at it, describe the second target. Signed-off-by: Bagas Sanjaya Message-Id: <20221220095828.27588-2-bagasdotme@gmail.com> Signed-off-by: Michael S. Tsirkin commit f9d9f57ef048ab3f78ad92293c698b3090dcdada Author: Sebastien Boeuf Date: Tue Jan 3 11:51:08 2023 +0100 vdpa_sim: Implement resume vdpa op Implement resume operation for vdpa_sim devices, so vhost-vdpa will offer that backend feature and userspace can effectively resume the device. Signed-off-by: Sebastien Boeuf Message-Id: <15a4566826033c5dd9a2167e5cfb0ef4d90cea49.1672742878.git.sebastien.boeuf@intel.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 3b688d7a086d0438649ea37990c6e811954fc780 Author: Sebastien Boeuf Date: Tue Jan 3 11:51:07 2023 +0100 vhost-vdpa: uAPI to resume the device This new ioctl adds support for resuming the device from userspace. This is required when trying to restore the device in a functioning state after it's been suspended. It is already possible to reset a suspended device, but that means the device must be reconfigured and all the IOMMU/IOTLB mappings must be recreated. This new operation allows the device to be resumed without going through a full reset. This is particularly useful when trying to perform offline migration of a virtual machine (also known as snapshot/restore) as it allows the VMM to resume the virtual machine back to a running state after the snapshot is performed. Acked-by: Jason Wang Signed-off-by: Sebastien Boeuf Message-Id: <73b75fb87d25cff59768b4955a81fe7ffe5b4770.1672742878.git.sebastien.boeuf@intel.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 69106b6fb3d73bd4252daa48ae96e600c9701147 Author: Sebastien Boeuf Date: Tue Jan 3 11:51:06 2023 +0100 vhost-vdpa: Introduce RESUME backend feature bit Userspace knows if the device can be resumed or not by checking this feature bit. It's only exposed if the vdpa driver backend implements the resume() operation callback. Userspace trying to negotiate this feature when it hasn't been exposed will result in an error. Acked-by: Jason Wang Signed-off-by: Sebastien Boeuf Message-Id: Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 1538a8a49ecbe6d3302cd7f347632338e56857f8 Author: Sebastien Boeuf Date: Tue Jan 3 11:51:05 2023 +0100 vdpa: Add resume operation Add a new operation to allow a vDPA device to be resumed after it has been suspended. Trying to resume a device that wasn't suspended will result in a no-op. This operation is optional. If it's not implemented, the associated backend feature bit will not be exposed. And if the feature bit is not exposed, invoking this operation will return an error. Acked-by: Jason Wang Signed-off-by: Sebastien Boeuf Message-Id: <6e05c4b31b47f3e29cb2bd7ebd56c81f84b8f48a.1672742878.git.sebastien.boeuf@intel.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 51a8f9d7f587290944d6fc733d1f897091c63159 Author: Alvaro Karsz Date: Tue Jan 10 18:56:38 2023 +0200 virtio: vdpa: new SolidNET DPU driver. This commit includes: 1) The driver to manage the controlplane over vDPA bus. 2) A HW monitor device to read health values from the DPU. Signed-off-by: Alvaro Karsz Acked-by: Jason Wang Message-Id: <20230110165638.123745-4-alvaro.karsz@solid-run.com> Message-Id: <20230209075128.78915-1-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin commit d089d69cc1f824936eeaa4fa172f8fa1a0949eaa Author: Alvaro Karsz Date: Tue Jan 10 18:56:37 2023 +0200 PCI: Avoid FLR for SolidRun SNET DPU rev 1 This patch fixes a FLR bug on the SNET DPU rev 1 by setting the PCI_DEV_FLAGS_NO_FLR_RESET flag. As there is a quirk to avoid FLR (quirk_no_flr), I added a new quirk to check the rev ID before calling to quirk_no_flr. Without this patch, a SNET DPU rev 1 may hang when FLR is applied. Signed-off-by: Alvaro Karsz Acked-by: Bjorn Helgaas Message-Id: <20230110165638.123745-3-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin commit db6c4dee4c104f50ed163af71c53bfdb878a8318 Author: Alvaro Karsz Date: Tue Jan 10 18:56:36 2023 +0200 PCI: Add SolidRun vendor ID Add SolidRun vendor ID to pci_ids.h The vendor ID is used in 2 different source files, the SNET vDPA driver and PCI quirks. Signed-off-by: Alvaro Karsz Acked-by: Bjorn Helgaas Message-Id: <20230110165638.123745-2-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin commit d8b3832a788dbe9d2da4a48f8cd1e022c3175514 Author: Eugenio Pérez Date: Thu Nov 17 16:55:02 2022 +0100 vdpa_sim_net: Offer VIRTIO_NET_F_STATUS VIRTIO_NET_S_LINK_UP is already returned in config reads since vdpasim creation, but the feature bit was not offered to the driver. Tested modifying VIRTIO_NET_S_LINK_UP and different values of "status" in qemu virtio-net options, using vhost_vdpa. Not considering as a fix, because there should be no driver trusting in this config read before the feature flag. Signed-off-by: Eugenio Pérez Message-Id: <20221117155502.1394700-1-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella Tested-by: Lei Yang commit 46fc0917bbabb1d5efdf8b903728b9f7fc484ce8 Author: Zhu Lingshan Date: Fri Nov 25 22:57:24 2022 +0800 vDPA/ifcvf: implement features provisioning This commit implements features provisioning for ifcvf, that means: 1)checkk whether the provisioned features are supported by the management device 2)vDPA device only presents selected feature bits Examples: a)The management device supported features: $ vdpa mgmtdev show pci/0000:01:00.5 pci/0000:01:00.5: supported_classes net max_supported_vqs 9 dev_features MTU MAC MRG_RXBUF CTRL_VQ MQ ANY_LAYOUT VERSION_1 ACCESS_PLATFORM b)Provision a vDPA device with all supported features: $ vdpa dev add name vdpa0 mgmtdev pci/0000:01:00.5 $ vdpa/vdpa dev config show vdpa0 vdpa0: mac 00:e8:ca:11:be:05 link up link_announce false max_vq_pairs 4 mtu 1500 negotiated_features MRG_RXBUF CTRL_VQ MQ VERSION_1 ACCESS_PLATFORM c)Provision a vDPA device with a subset of the supported features: $ vdpa dev add name vdpa0 mgmtdev pci/0000:01:00.5 device_features 0x300020020 $ vdpa dev config show vdpa0 mac 00:e8:ca:11:be:05 link up link_announce false negotiated_features CTRL_VQ VERSION_1 ACCESS_PLATFORM Signed-off-by: Zhu Lingshan Message-Id: <20221125145724.1129962-13-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 267000e980895b91841343d203b55b6e188d7c3c Author: Zhu Lingshan Date: Fri Nov 25 22:57:23 2022 +0800 vDPA/ifcvf: retire ifcvf_private_to_vf This commit retires ifcvf_private_to_vf, because the vf is already a member of the adapter, so it could be easily addressed by adapter->vf. Signed-off-by: Zhu Lingshan Message-Id: <20221125145724.1129962-12-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 93139037b582134deb1ed894bbc4bc1d34ff35e7 Author: Zhu Lingshan Date: Fri Nov 25 22:57:22 2022 +0800 vDPA/ifcvf: allocate the adapter in dev_add() The adapter is the container of the vdpa_device, this commits allocate the adapter in dev_add() rather than in probe(). So that the vdpa_device() could be re-created when the userspace creates the vdpa device, and free-ed in dev_del() Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-11-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 6a3b2f179b49f2c6452ecc37b4778a43848b454c Author: Zhu Lingshan Date: Fri Nov 25 22:57:21 2022 +0800 vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev This commit allocates the hw structure in the management device structure. So the hardware can be initialized once the management device is allocated in probe. Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-10-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 7cfd36b7e8be6bdaeb5af0f9729871b732a7a3c8 Author: Zhu Lingshan Date: Fri Nov 25 22:57:20 2022 +0800 vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw All ifcvf_request_irq's callees are refactored to work on ifcvf_hw, so it should be decoupled from the adapter as well Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-9-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit a70d833e696e538a0feff5e539086c74a90ddf90 Author: Zhu Lingshan Date: Fri Nov 25 22:57:19 2022 +0800 vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the adapter This commit decouples the config irq requester, the device shared irq requester and the MSI vectors allocator from the adapter. So they can be safely invoked since probe before the adapter is allocated. Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-8-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit f9a9ffb2e4dbde81090416fc51662441c2a7b73b Author: Zhu Lingshan Date: Fri Nov 25 22:57:18 2022 +0800 vDPA/ifcvf: decouple vq irq requester from the adapter This commit decouples the vq irq requester from the adapter, so that these functions can be invoked since probe. Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-7-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 23dac55cec3afdbc1b4eaed1c79f2cee00477f8b Author: Zhu Lingshan Date: Fri Nov 25 22:57:17 2022 +0800 vDPA/ifcvf: decouple config IRQ releaser from the adapter This commit decouples config IRQ releaser from the adapter, so that it could be invoked once probe or in err handlers. ifcvf_free_irq() works on ifcvf_hw in this commit Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-6-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 004cbcabab46d9346e2524c4eedd71ea57fe4f3c Author: Zhu Lingshan Date: Fri Nov 25 22:57:16 2022 +0800 vDPA/ifcvf: decouple vq IRQ releasers from the adapter This commit decouples the IRQ releasers from the adapter, so that these functions could be safely invoked once probe Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-5-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 66e3970b16d1e960afbece65739a3628273633f1 Author: Zhu Lingshan Date: Fri Nov 25 22:57:15 2022 +0800 vDPA/ifcvf: alloc the mgmt_dev before the adapter This commit reverses the order of allocating the management device and the adapter. So that it would be possible to move the allocation of the adapter to dev_add(). Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-4-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit af8eb69a62b73a2ce5f91575453534ac07f06eb4 Author: Zhu Lingshan Date: Fri Nov 25 22:57:14 2022 +0800 vDPA/ifcvf: decouple config space ops from the adapter This commit decopules the config space ops from the adapter layer, so these functions can be invoked once the device is probed. Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-3-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit d59f633dd05940739b5f46f5d4403cafb91d2742 Author: Zhu Lingshan Date: Fri Nov 25 22:57:13 2022 +0800 vDPA/ifcvf: decouple hw features manipulators from the adapter This commit gets rid of ifcvf_adapter in hw features related functions in ifcvf_base. Then these functions are more rubust and de-coupling from the ifcvf_adapter layer. So these functions could be invoded once the device is probed, even before the adapter is allocaed. Signed-off-by: Zhu Lingshan Cc: stable@vger.kernel.org Message-Id: <20221125145724.1129962-2-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 0a59975088d37f69815f656193c1e1e057feb494 Author: Eli Cohen Date: Mon Nov 14 15:17:59 2022 +0200 vdpa/mlx5: Add RX counters to debugfs For each interface, either VLAN tagged or untagged, add two hardware counters: one for unicast and another for multicast. The counters count RX packets and bytes and can be read through debugfs: $ cat /sys/kernel/debug/mlx5/mlx5_core.sf.1/vdpa-0/rx/untagged/mcast/packets $ cat /sys/kernel/debug/mlx5/mlx5_core.sf.1/vdpa-0/rx/untagged/ucast/bytes This feature is controlled via the config option MLX5_VDPA_STEERING_DEBUG. It is off by default as it may have some impact on performance. includes a fixup By Yang Yingliang : vdpa/mlx5: fix check wrong pointer in mlx5_vdpa_add_mac_vlan_rules() The local variable 'rule' is not used anymore, fix return value check after calling mlx5_add_flow_rules(). Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-9-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: Yang Yingliang Message-Id: <20230104074418.1737510-1-yangyingliang@huawei.com> Signed-off-by: Michael S. Tsirkin Acked-by: Eli Cohen Acked-by: Jason Wang commit 2942210043224c0f6e88bd9d7c9c7c5949a36567 Author: Eli Cohen Date: Mon Nov 14 15:17:58 2022 +0200 vdpa/mlx5: Add debugfs subtree Add debugfs subtree and expose flow table ID and TIR number. This information can be used by external tools to do extended troubleshooting. The information can be retrieved like so: $ cat /sys/kernel/debug/mlx5/mlx5_core.sf.1/vdpa-0/rx/table_id $ cat /sys/kernel/debug/mlx5/mlx5_core.sf.1/vdpa-0/rx/tirn Reviewed-by: Si-Wei Liu Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-8-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 72c67e9b904c29edbcb7bb010655b3958c95a309 Author: Eli Cohen Date: Mon Nov 14 15:17:57 2022 +0200 vdpa/mlx5: Move some definitions to a new header file Move some definitions from mlx5_vnet.c to newly added header file mlx5_vnet.h. We need these definitions for the following patches that add debugfs tree to expose information vital for debug. Reviewed-by: Si-Wei Liu Acked-by: Jason Wang Signed-off-by: Eli Cohen Message-Id: <20221114131759.57883-7-elic@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 195d6cc9c3d15b9474ccc76991d49a3dcc160872 Author: Stefan Schmidt Date: Sat Feb 18 22:13:17 2023 +0100 MAINTAINERS: Add Miquel Raynal as additional maintainer for ieee802154 We are growing the maintainer team for ieee802154 to spread the load for review and general maintenance. Miquel has been driving the subsystem forward over the last year and we would like to welcome him as a maintainer. Signed-off-by: Stefan Schmidt Acked-by: Miquel Raynal Link: https://lore.kernel.org/r/20230218211317.284889-4-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit 6b441772854f022441700b46588e4d4abc14180d Author: Stefan Schmidt Date: Sat Feb 18 22:13:16 2023 +0100 MAINTAINERS: Switch maintenance for mrf24j40 driver over Alan Ott has not been actively working on the driver or reviewing patches for several years. I have been taking odd fixes in through the wpan/ieee802154 tree. Update the MAINTAINERS file to reflect this reality. I wanted to thank Alan for his work on the driver. Signed-off-by: Stefan Schmidt Link: https://lore.kernel.org/r/20230218211317.284889-3-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit d1b4b4117f890978c23c8e84a58a6c4c713fb400 Author: Stefan Schmidt Date: Sat Feb 18 22:13:15 2023 +0100 MAINTAINERS: Switch maintenance for mcr20a driver over Xue Liu has not been actively working on the driver or reviewing patches for several years. I have been taking odd fixes in through the wpan/ieee802154 tree. Update the MAINTAINERS file to reflect this reality. I wanted to thank Xue Liu for his work on the driver. Signed-off-by: Stefan Schmidt Link: https://lore.kernel.org/r/20230218211317.284889-2-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit c551c569e388f6ae19e40798c7615706267f7618 Author: Stefan Schmidt Date: Sat Feb 18 22:13:14 2023 +0100 MAINTAINERS: Switch maintenance for cc2520 driver over Varka Bhadram has not been actively working on the driver or reviewing patches for several years. I have been taking odd fixes in through the wpan/ieee802154 tree. Update the MAINTAINERS file to reflect this reality. I wanted to thank Varka for his work on the driver. Signed-off-by: Stefan Schmidt Link: https://lore.kernel.org/r/20230218211317.284889-1-stefan@datenfreihafen.org Signed-off-by: Jakub Kicinski commit fec67d1896add59fd7080fb3d21b9446239e2cef Merge: ef04277600ba6 80c6d6804f314 Author: Dave Airlie Date: Tue Feb 21 10:14:51 2023 +1000 Merge tag 'amd-drm-next-6.3-2023-02-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.3-2023-02-17: amdgpu: - GC 11 fixes - Display fixes - Backlight cleanup - SMU13 fixes - SMU7 regression fix - GFX9 sw queues fix - AGP fix for GMC 11 - W1 warning fixes - S/G display fixes - Misc spelling fixes - Driver unload fix - DCN 3.1.4 fixes - Display code reorg fixes - Rotation fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230217230930.64821-1-alexander.deucher@amd.com commit db77b8502a4071a59c9424d95f87fe20bdb52c3a Merge: 950b6662e26e3 a13408c205260 Author: Linus Torvalds Date: Mon Feb 20 15:55:47 2023 -0800 Merge tag 'asm-generic-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic cleanups from Arnd Bergmann: "Only three minor changes: a cross-platform series from Mike Rapoport to consolidate asm/agp.h between architectures, and a correctness change for __generic_cmpxchg_local() from Matt Evans" * tag 'asm-generic-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: char/agp: introduce asm-generic/agp.h char/agp: consolidate {alloc,free}_gatt_pages() locking/atomic: cmpxchg: Make __generic_cmpxchg_local compare against zero-extended 'old' value commit c96abaec78f34366b3ddf1c6be52ca5c1241e15b Author: Quanfa Fu Date: Tue Feb 21 08:52:42 2023 +0900 tracing/eprobe: no need to check for negative ret value for snprintf No need to check for negative return value from snprintf() as the code does not return negative values. Link: https://lore.kernel.org/all/20230109040625.3259642-1-quanfafu@gmail.com/ Signed-off-by: Quanfa Fu Acked-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 1fcd09fd4f8494b05b7c34971f3498dda0bb06ee Author: Masami Hiramatsu (Google) Date: Tue Feb 21 08:52:42 2023 +0900 test_kprobes: Add recursed kprobe test case Add a recursed kprobe test case to the KUnit test module for kprobes. This will probe a function which is called from the pre_handler and post_handler itself. If the kprobe is correctly implemented, the recursed kprobe handlers will be skipped and the number of skipped kprobe will be counted on kprobe::nmissed. Link: https://lore.kernel.org/all/167414238758.2301956.258548940194352895.stgit@devnote3/ Signed-off-by: Masami Hiramatsu (Google) commit 8478cca1e3abd183f309cd9c2491f484acf5d377 Author: Donglin Peng Date: Tue Feb 21 08:52:42 2023 +0900 tracing/probe: add a char type to show the character value of traced arguments There are scenes that we want to show the character value of traced arguments other than a decimal or hexadecimal or string value for debug convinience. I add a new type named 'char' to do it and a new test case file named 'kprobe_args_char.tc' to do selftest for char type. For example: The to be traced function is 'void demo_func(char type, char *name);', we can add a kprobe event as follows to show argument values as we want: echo 'p:myprobe demo_func $arg1:char +0($arg2):char[5]' > kprobe_events we will get the following trace log: ... myprobe: (demo_func+0x0/0x29) arg1='A' arg2={'b','p','f','1',''} Link: https://lore.kernel.org/all/20221219110613.367098-1-dolinux.peng@gmail.com/ Signed-off-by: Donglin Peng Acked-by: Masami Hiramatsu (Google) Reported-by: kernel test robot Signed-off-by: Masami Hiramatsu (Google) commit 950b6662e26e381cf8834b9b78b08261890ee697 Merge: c72e04c26faef e43efb6d713bc Author: Linus Torvalds Date: Mon Feb 20 15:49:56 2023 -0800 Merge tag 'soc-dt-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC DT updates from Arnd Bergmann: "About a quarter of the changes are for 32-bit arm, mostly filling in device support for existing machines and adding minor cleanups, mostly for Qualcomm and Samsung based machines. Two new 32-bit SoCs are added, both are quad-core Cortex-A7 chips from Rockchips that have been around for a while but were lacking kernel support so far: RV1126 is a Vision SoC with an NPU and is used in the Edgeble Neural Compute Module 2(Neu2) board, while RK3128 is design for TV boxes and so far only comes with a dts for its refernece design. The other 32-bit boards that were added are two ASpeed AST2600 based BMC boards, the Microchip sam9x60_curiosity development board (Armv5 based!), the Enclustra PE1 FPGA-SoM baseboard, and a few more boards for i.MX53 and i.MX6ULL. On the RISC-V side, there are fewer patches, but a total of ten new single-board computers based on variations of the Allwinner D1/T113 chip, plus one more board based on Microchip Polarfire. As usual, arm64 has by far the most changes here, with over 700 non-merge changesets, among them over 400 alone for Qualcomm. The newly added SoCs this time are all recent high-end embedded SoCs for various markets, each on comes with support for its reference board: - Qualcomm SM8550 (Snapdragon 8 Gen 2) for mobile phones - Qualcomm QDU1000/QRU1000 5G RAN platform - Rockchips RK3588/RK3588s for tablets, chromebooks and SBCs - TI J784S4 for industrial and automotive applications In total, there are 46 new arm64 machines: - Reference platforms for each of the five new SoCs - Three Amlogic based development boards - Six embedded machines based on NXP i.MX8MM and i.MX8MP - The Mediatek mt7986a based Banana Pi R3 router - Six tablets based on Qualcomm MSM8916 (Snapdragon 410), SM6115 (Snapdragon 662) and SM8250 (Snapdragon 865) - Two LTE dongles, also based on MSM8916 - Seven mobile phones, based on Qualcomm MSM8953 (Snapdragon 610), SDM450 and SDM632 - Three chromebooks based on Qualcomm SC7280 (Snapdragon 7c) - Nine development boards based on Rockchips RK3588, RK3568, RK3566 and RK3328. - Five development machines based on TI K3 (AM642/AM654/AM68/AM69) The cleanup of dtc warnings continues across all platforms, adding to the total number of changes" * tag 'soc-dt-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (1035 commits) dt-bindings: riscv: correct starfive visionfive 2 compatibles ARM: dts: socfpga: Add enclustra PE1 devicetree dt-bindings: altera: Add enclustra mercury PE1 arm64: dts: qcom: msm8996: align RPM G-Link clock-controller node with bindings arm64: dts: qcom: qcs404: align RPM G-Link node with bindings arm64: dts: qcom: ipq6018: align RPM G-Link node with bindings arm64: dts: qcom: sm8550: remove invalid interconnect property from cryptobam arm64: dts: qcom: sc7280: Adjust zombie PWM frequency arm64: dts: qcom: sc8280xp-pmics: Specify interrupt parent explicitly arm64: dts: qcom: sm7225-fairphone-fp4: enable remaining i2c busses arm64: dts: qcom: sm7225-fairphone-fp4: move status property down arm64: dts: qcom: pmk8350: Use the correct PON compatible arm64: dts: qcom: sc8280xp-x13s: Enable external display arm64: dts: qcom: sc8280xp-crd: Introduce pmic_glink arm64: dts: qcom: sc8280xp: Add USB-C-related DP blocks arm64: dts: qcom: sm8350-hdk: enable GPU arm64: dts: qcom: sm8350: add GPU, GMU, GPU CC and SMMU nodes arm64: dts: qcom: sm8350: finish reordering nodes arm64: dts: qcom: sm8350: move more nodes to correct place arm64: dts: qcom: sm8350: reorder device nodes ... commit 96cd93af794cf3ef83ae1ad7291160029d7b525e Author: Masami Hiramatsu (Google) Date: Tue Feb 21 08:49:16 2023 +0900 selftests/ftrace: Fix probepoint testcase to ignore __pfx_* symbols Fix kprobe probepoint testcase to ignore __pfx_* prefix symbols. Those are introduced by commit b341b20d648b ("x86: Add prefix symbols for function padding") for identifying PADDING_BYTES of NOPs. Since kprobe events can not probe these prefix symbols, this testcase has to skip those symbols. Link: https://lore.kernel.org/all/167309835609.640500.9664678940260305746.stgit@devnote3/ Fixes: b341b20d648b ("x86: Add prefix symbols for function padding") Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) Acked-by: Shuah Khan commit a457e944df92789ab31aaf35fae9db064e3c51c4 Author: Masami Hiramatsu (Google) Date: Tue Feb 21 08:49:16 2023 +0900 selftests/ftrace: Fix eprobe syntax test case to check filter support Fix eprobe syntax test case to check whether the kernel supports the filter on eprobe for filter syntax test command. Without this fix, this test case will fail if the kernel supports eprobe but doesn't support the filter on eprobe. Link: https://lore.kernel.org/all/167309834742.640500.379128668288448035.stgit@devnote3/ Fixes: 9e14bae7d049 ("selftests/ftrace: Add eprobe syntax error testcase") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) Acked-by: Shuah Khan commit 133921530c42960c07d25d12677f9e131a2b0cdf Author: Masami Hiramatsu (Google) Date: Tue Feb 21 08:49:16 2023 +0900 tracing/eprobe: Fix to add filter on eprobe description in README file Fix to add a description of the filter on eprobe in README file. This is required to identify the kernel supports the filter on eprobe or not. Link: https://lore.kernel.org/all/167309833728.640500.12232259238201433587.stgit@devnote3/ Fixes: 752be5c5c910 ("tracing/eprobe: Add eprobe filter support") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit f1c97a1b4ef709e3f066f82e3ba3108c3b133ae6 Author: Yang Jihong Date: Tue Feb 21 08:49:16 2023 +0900 x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range When arch_prepare_optimized_kprobe calculating jump destination address, it copies original instructions from jmp-optimized kprobe (see __recover_optprobed_insn), and calculated based on length of original instruction. arch_check_optimized_kprobe does not check KPROBE_FLAG_OPTIMATED when checking whether jmp-optimized kprobe exists. As a result, setup_detour_execution may jump to a range that has been overwritten by jump destination address, resulting in an inval opcode error. For example, assume that register two kprobes whose addresses are and in "func" function. The original code of "func" function is as follows: 0xffffffff816cb5e9 <+9>: push %r12 0xffffffff816cb5eb <+11>: xor %r12d,%r12d 0xffffffff816cb5ee <+14>: test %rdi,%rdi 0xffffffff816cb5f1 <+17>: setne %r12b 0xffffffff816cb5f5 <+21>: push %rbp 1.Register the kprobe for , assume that is kp1, corresponding optimized_kprobe is op1. After the optimization, "func" code changes to: 0xffffffff816cc079 <+9>: push %r12 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp Now op1->flags == KPROBE_FLAG_OPTIMATED; 2. Register the kprobe for , assume that is kp2, corresponding optimized_kprobe is op2. register_kprobe(kp2) register_aggr_kprobe alloc_aggr_kprobe __prepare_optimized_kprobe arch_prepare_optimized_kprobe __recover_optprobed_insn // copy original bytes from kp1->optinsn.copied_insn, // jump address = 3. disable kp1: disable_kprobe(kp1) __disable_kprobe ... if (p == orig_p || aggr_kprobe_disabled(orig_p)) { ret = disarm_kprobe(orig_p, true) // add op1 in unoptimizing_list, not unoptimized orig_p->flags |= KPROBE_FLAG_DISABLED; // op1->flags == KPROBE_FLAG_OPTIMATED | KPROBE_FLAG_DISABLED ... 4. unregister kp2 __unregister_kprobe_top ... if (!kprobe_disabled(ap) && !kprobes_all_disarmed) { optimize_kprobe(op) ... if (arch_check_optimized_kprobe(op) < 0) // because op1 has KPROBE_FLAG_DISABLED, here not return return; p->kp.flags |= KPROBE_FLAG_OPTIMIZED; // now op2 has KPROBE_FLAG_OPTIMIZED } "func" code now is: 0xffffffff816cc079 <+9>: int3 0xffffffff816cc07a <+10>: push %rsp 0xffffffff816cc07b <+11>: jmp 0xffffffffa0210000 0xffffffff816cc080 <+16>: incl 0xf(%rcx) 0xffffffff816cc083 <+19>: xchg %eax,%ebp 0xffffffff816cc084 <+20>: (bad) 0xffffffff816cc085 <+21>: push %rbp 5. if call "func", int3 handler call setup_detour_execution: if (p->flags & KPROBE_FLAG_OPTIMIZED) { ... regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX; ... } The code for the destination address is 0xffffffffa021072c: push %r12 0xffffffffa021072e: xor %r12d,%r12d 0xffffffffa0210731: jmp 0xffffffff816cb5ee However, is not a valid start instruction address. As a result, an error occurs. Link: https://lore.kernel.org/all/20230216034247.32348-3-yangjihong1@huawei.com/ Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") Signed-off-by: Yang Jihong Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 868a6fc0ca2407622d2833adefe1c4d284766c4c Author: Yang Jihong Date: Tue Feb 21 08:49:16 2023 +0900 x86/kprobes: Fix __recover_optprobed_insn check optimizing logic Since the following commit: commit f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") modified the update timing of the KPROBE_FLAG_OPTIMIZED, a optimized_kprobe may be in the optimizing or unoptimizing state when op.kp->flags has KPROBE_FLAG_OPTIMIZED and op->list is not empty. The __recover_optprobed_insn check logic is incorrect, a kprobe in the unoptimizing state may be incorrectly determined as unoptimizing. As a result, incorrect instructions are copied. The optprobe_queued_unopt function needs to be exported for invoking in arch directory. Link: https://lore.kernel.org/all/20230216034247.32348-2-yangjihong1@huawei.com/ Fixes: f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code") Cc: stable@vger.kernel.org Signed-off-by: Yang Jihong Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 Author: Masami Hiramatsu (Google) Date: Tue Feb 21 08:49:16 2023 +0900 kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list Since forcibly unoptimized kprobes will be put on the freeing_list directly in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check the freeing_list even if unoptimizing_list is empty. This bug can happen if a kprobe is put in an instruction which is in the middle of the jump-replaced instruction sequence of an optprobe, *and* the optprobe is recently unregistered and queued on unoptimizing_list. In this case, the optprobe will be unoptimized forcibly (means immediately) and put it into the freeing_list, expecting the optprobe will be handled in do_unoptimize_kprobe(). But if there is no other optprobes on the unoptimizing_list, current code returns from the do_unoptimize_kprobe() soon and does not handle the optprobe which is on the freeing_list. Then the optprobe will hit the WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled in the latter loop of the do_unoptimize_kprobe(). To solve this issue, do not return from do_unoptimize_kprobes() immediately even if unoptimizing_list is empty. Moreover, this change affects another case. kill_optimized_kprobes() expects kprobe_optimizer() will just free the optprobe on freeing_list. So I changed it to just do list_move() to freeing_list if optprobes are on unoptimizing list. And the do_unoptimize_kprobe() will skip arch_disarm_kprobe() if the probe on freeing_list has gone flag. Link: https://lore.kernel.org/all/Y8URdIfVr3pq2X8w@xpf.sh.intel.com/ Link: https://lore.kernel.org/all/167448024501.3253718.13037333683110512967.stgit@devnote3/ Fixes: e4add247789e ("kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic") Reported-by: Pengfei Xu Signed-off-by: Masami Hiramatsu (Google) Cc: stable@vger.kernel.org Acked-by: Steven Rostedt (Google) commit ef04277600ba63e5826bf4e9f99e902f42a73e4f Merge: 8573df341545b 38b2d8efd03d2 Author: Dave Airlie Date: Tue Feb 21 09:44:02 2023 +1000 Merge tag 'drm-misc-next-fixes-2023-02-16' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Short summary of fixes pull: Contains fixes for DP MST and the panel orientation on an Lenovo IdeaPad model. Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/Y+4H4C4E6cZcM9+J@linux-uq9g commit c72e04c26faefc6650709066a8f019a7fb4cbb84 Merge: b32c6e029c131 af16544d4abe2 Author: Linus Torvalds Date: Mon Feb 20 15:43:36 2023 -0800 Merge tag 'soc-defconfig-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM defconfigs updates from Arnd Bergmann: "As usual, this contains all the patches to enable options for newly added device drivers in the 32-bit and 64-bit defconfig files. I have sorted the files according to the changes to Kconfig files, to make it easier to check what has changed compared to the 'make savedefconfig' output. The most notable change this time is a series from Mark Brown to add a 'virtconfig' target for arm64, which is for the moment the same as the 'defconfig' target but disables all the top-level SoC specific options in order to have a smaller and faster kernel build" * tag 'soc-defconfig-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (39 commits) arm64: defconfig: enable drivers required by the Qualcomm SA8775P platform arm64: defconfig: Enable DisplayPort on SC8280XP laptops arm64: configs: Add virtconfig kbuild: Provide a version of merge_into_defconfig without override warnings scripts: merge_config: Add option to suppress warning on overrides ARM: reorder defconfig files arm64: reorder defconfig arm64: defconfig: enable Qualcomm SDAM nvmem driver arm64: defconfig: enable SM8450 DISPCC clock driver ARM: defconfig: Add IOSCHED_BFQ to the default configs ARM: configs: multi_v7: enable NVMEM driver for STM32 ARM: Add wpcm450_defconfig for Nuvoton WPCM450 arm64: defconfig: Enable DMA_RESTRICTED_POOL arm64: defconfig: Enable missing configs for mt8192-asurada riscv: defconfig: Enable the Allwinner D1 platform and drivers ARM: imx_v6_v7_defconfig: Don't enable PROVE_LOCKING ARM: multi_v7_defconfig: Add GXP Fan and SPI support ARM: add multi_v7_lpae_defconfig kbuild: Add config fragment merge functionality ARM: multi_v7_defconfig: Add options to support TQMLS102xA series ... commit b32c6e029c1313125cc7b0a9061dda2304c23b7b Merge: ff0c7e18629b8 27aaad0e7c725 Author: Linus Torvalds Date: Mon Feb 20 15:36:37 2023 -0800 Merge tag 'arm-soc-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "The majority of the changes are for the OMAP2 platform, mostly removing some dead code that got left behind from previous cleanups. Aside from that, there are very minor updates and correctness fixes for Zynq, i.MX, Samsung, Broadcom, AT91, ep93xx, and OMAP1" * tag 'arm-soc-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (26 commits) dt-bindings: soc: samsung: exynos-pmu: allow phys as child ARM: imx: mach-imx6ul: add imx6ulz support ARM: imx: Call ida_simple_remove() for ida_simple_get arm64: drop redundant "ARMv8" from Kconfig option title ARM: ep93xx: Convert to use descriptors for GPIO LEDs ARM: s3c: fix s3c64xx_set_timer_source prototype ARM: OMAP2+: Fix spelling typos in comment ARM: OMAP2+: Remove unneeded #include ARM: OMAP2+: Remove unneeded #include ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init() ARM: BCM63xx: remove useless goto statement ARM: omap2: make functions static ARM: omap2: remove unused omap2_pm_init ARM: omap2: remove unused declarations ARM: omap2: remove unused functions ARM: omap2: smartreflex: remove on_init control ARM: omap2: remove APLL control ARM: omap2: simplify clock2xxx header ARM: omap2: remove unused omap_hwmod_reset.c ARM: omap2: remove unused headers ... commit ff0c7e18629b8bd64681313a88ce55e182c9fee6 Merge: 5b0ed5964928b a1f925bc4fa89 Author: Linus Torvalds Date: Mon Feb 20 15:28:57 2023 -0800 Merge tag 'arm-boardfile-remove-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC boardfile updates from Arnd Bergmann "Unused boardfile removal for 6.3 This is a follow-up to the deprecation of most of the old-style board files that was merged in linux-6.0, removing them for good. This branch is almost exclusively dead code removal based on those annotations. Some device driver removals went through separate subsystem trees, but the majority is in the same branch, in order to better handle dependencies between the patches and avoid breaking bisection. Unfortunately that leads to merge conflicts against other changes in the subsystem trees, but they should all be trivial to resolve by removing the files. See commit 7d0d3fa7339e ("Merge tag 'arm-boardfiles-6.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc") for the description of which machines were marked unused and are now removed. The only removals that got postponed are Terastation WXL (mv78xx0) and Jornada720 (StrongARM1100), which turned out to still have potential users" * tag 'arm-boardfile-remove-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (91 commits) mmc: omap: drop TPS65010 dependency ARM: pxa: restore mfp-pxa320.h usb: ohci-omap: avoid unused-variable warning ARM: debug: remove references in DEBUG_UART_8250_SHIFT to removed configs ARM: s3c: remove obsolete s3c-cpu-freq header MAINTAINERS: adjust SAMSUNG SOC CLOCK DRIVERS after s3c24xx support removal MAINTAINERS: update file entries after arm multi-platform rework and mach-pxa removal ARM: remove CONFIG_UNUSED_BOARD_FILES mfd: remove htc-pasic3 driver w1: remove ds1wm driver usb: remove ohci-tmio driver fbdev: remove w100fb driver fbdev: remove tmiofb driver mmc: remove tmio_mmc driver mfd: remove ucb1400 support mfd: remove toshiba tmio drivers rtc: remove v3020 driver power: remove pda_power supply driver ASoC: pxa: remove unused board support pcmcia: remove unused pxa/sa1100 drivers ... commit 16541195c6d9bcad568b7c6afbf855ddc3a856aa Author: David Howells Date: Wed Apr 6 21:09:08 2022 +0100 cifs: Add a function to read into an iter from a socket Add a helper function to read data from a socket into the given iterator. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org Link: https://lore.kernel.org/r/164928617874.457102.10021662143234315566.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165211419563.3154751.18431990381145195050.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165348879662.2106726.16881134187242702351.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165364826398.3334034.12541600783145647319.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/166126395495.708021.12328677373159554478.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/166697258876.61150.3530237818849429372.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/166732031039.3186319.10691316510079412635.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit b8713c4dbfa3ebb86c492bc2a836e3ebb748e063 Author: David Howells Date: Wed Apr 6 19:41:28 2022 +0100 cifs: Add some helper functions Add some helper functions to manipulate the folio marks by iterating through a list of folios held in an xarray rather than using a page list. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org Link: https://lore.kernel.org/r/164928616583.457102.15157033997163988344.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165211418840.3154751.3090684430628501879.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165348878940.2106726.204291614267188735.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/165364825674.3334034.3356201708659748648.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/166126394799.708021.10637797063862600488.stgit@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/166697258147.61150.9940790486999562110.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/166732030314.3186319.9209944805565413627.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit 39bc58203f040ebafbec48198a83c246b25eba99 Author: David Howells Date: Thu Oct 27 22:40:17 2022 +0100 cifs: Add a function to Hash the contents of an iterator Add a function to push the contents of a BVEC-, KVEC- or XARRAY-type iterator into a synchronous hash algorithm. UBUF- and IOBUF-type iterators are not supported on the assumption that either we're doing buffered I/O, in which case we won't see them, or we're doing direct I/O, in which case the iterator will have been extracted into a BVEC-type iterator higher up. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-crypto@vger.kernel.org Link: https://lore.kernel.org/r/166697257423.61150.12070648579830206483.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/166732029577.3186319.17162612653237909961.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit e5fbdde430171175f32094c8059eea0d0e2487ae Author: David Howells Date: Thu Oct 27 17:36:11 2022 +0100 cifs: Add a function to build an RDMA SGE list from an iterator Add a function to add elements onto an RDMA SGE list representing page fragments extracted from a BVEC-, KVEC- or XARRAY-type iterator and DMA mapped until the maximum number of elements is reached. Nothing is done to make sure the pages remain present - that must be done by the caller. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Tom Talpey cc: Jeff Layton cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-rdma@vger.kernel.org Link: https://lore.kernel.org/r/166697256704.61150.17388516338310645808.stgit@warthog.procyon.org.uk/ # rfc Link: https://lore.kernel.org/r/166732028840.3186319.8512284239779728860.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit 0185846975339a5c348373aa450a977f5242366b Author: David Howells Date: Thu Oct 27 16:19:44 2022 +0100 netfs: Add a function to extract an iterator into a scatterlist Provide a function for filling in a scatterlist from the list of pages contained in an iterator. If the iterator is UBUF- or IOBUF-type, the pages have a pin taken on them (as FOLL_PIN). If the iterator is BVEC-, KVEC- or XARRAY-type, no pin is taken on the pages and it is left to the caller to manage their lifetime. It cannot be assumed that a ref can be validly taken, particularly in the case of a KVEC iterator. Signed-off-by: David Howells cc: Jeff Layton cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: linux-cachefs@redhat.com cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 85dd2c8ff368b1446be9febde84afe1d7aec4261 Author: David Howells Date: Thu Oct 20 16:16:32 2022 +0100 netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator Add a function to extract the pages from a user-space supplied iterator (UBUF- or IOVEC-type) into a BVEC-type iterator, retaining the pages by getting a pin on them (as FOLL_PIN) as we go. This is useful in three situations: (1) A userspace thread may have a sibling that unmaps or remaps the process's VM during the operation, changing the assignment of the pages and potentially causing an error. Retaining the pages keeps some pages around, even if this occurs; futher, we find out at the point of extraction if EFAULT is going to be incurred. (2) Pages might get swapped out/discarded if not retained, so we want to retain them to avoid the reload causing a deadlock due to a DIO from/to an mmapped region on the same file. (3) The iterator may get passed to sendmsg() by the filesystem. If a fault occurs, we may get a short write to a TCP stream that's then tricky to recover from. We don't deal with other types of iterator here, leaving it to other mechanisms to retain the pages (eg. PG_locked, PG_writeback and the pipe lock). Signed-off-by: David Howells cc: Jeff Layton cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: linux-cachefs@redhat.com cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 4e260a8fd740aa0dcecafe79c4f9d3013a21f1ca Author: David Howells Date: Tue Nov 1 14:52:47 2022 +0000 cifs: Implement splice_read to pass down ITER_BVEC not ITER_PIPE Provide cifs_splice_read() to use a bvec rather than an pipe iterator as the latter cannot so easily be split and advanced, which is necessary to pass an iterator down to the bottom levels. Upstream cifs gets around this problem by using iov_iter_get_pages() to prefill the pipe and then passing the list of pages down. This is done by: (1) Bulk-allocate a bunch of pages to carry as much of the requested amount of data as possible, but without overrunning the available slots in the pipe and add them to an ITER_BVEC. (2) Synchronously call ->read_iter() to read into the buffer. (3) Discard any unused pages. (4) Load the remaining pages into the pipe in order and advance the head pointer. Signed-off-by: David Howells cc: Steve French cc: Shyam Prasad N cc: Rohith Surabattula cc: Jeff Layton cc: Al Viro cc: linux-cifs@vger.kernel.org Link: https://lore.kernel.org/r/166732028113.3186319.1793644937097301358.stgit@warthog.procyon.org.uk/ # rfc Signed-off-by: Steve French commit 7c8e01ebf2361eb397f32cd1c8ee402dda48dce0 Author: David Howells Date: Wed Feb 15 08:00:31 2023 +0000 splice: Export filemap/direct_splice_read() filemap_splice_read() and direct_splice_read() should be exported. Signed-off-by: David Howells cc: Steve French cc: Jens Axboe cc: Christoph Hellwig cc: Al Viro cc: David Hildenbrand cc: John Hubbard cc: linux-cifs@vger.kernel.org cc: linux-mm@kvack.org cc: linux-block@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 7d58fe731028128f3a7e20b9c492be48aae133ee Author: David Howells Date: Fri Oct 28 21:50:30 2022 +0100 iov_iter: Add a function to extract a page list from an iterator Add a function, iov_iter_extract_pages(), to extract a list of pages from an iterator. The pages may be returned with a pin added or nothing, depending on the type of iterator. Add a second function, iov_iter_extract_will_pin(), to determine how the cleanup should be done. There are two cases: (1) ITER_IOVEC or ITER_UBUF iterator. Extracted pages will have pins (FOLL_PIN) obtained on them so that a concurrent fork() will forcibly copy the page so that DMA is done to/from the parent's buffer and is unavailable to/unaffected by the child process. iov_iter_extract_will_pin() will return true for this case. The caller should use something like unpin_user_page() to dispose of the page. (2) Any other sort of iterator. No refs or pins are obtained on the page, the assumption is made that the caller will manage page retention. iov_iter_extract_will_pin() will return false. The pages don't need additional disposal. Signed-off-by: David Howells Reviewed-by: Christoph Hellwig Reviewed-by: Jens Axboe cc: Al Viro cc: John Hubbard cc: David Hildenbrand cc: Matthew Wilcox cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: Steve French commit f62e52d1276b6cd329fe72d36bdf912b2ce4caaf Author: David Howells Date: Thu Jan 19 12:47:23 2023 +0000 iov_iter: Define flags to qualify page extraction. Define flags to qualify page extraction to pass into iov_iter_*_pages*() rather than passing in FOLL_* flags. For now only a flag to allow peer-to-peer DMA is supported. Signed-off-by: David Howells Reviewed-by: Christoph Hellwig Reviewed-by: John Hubbard Reviewed-by: Jens Axboe cc: Al Viro cc: Logan Gunthorpe cc: linux-fsdevel@vger.kernel.org cc: linux-block@vger.kernel.org Signed-off-by: Steve French commit 33b3b041543e8b3abf9a692d0f8c2ab0e07c50cd Author: David Howells Date: Tue Feb 7 10:45:40 2023 +0000 splice: Add a func to do a splice from an O_DIRECT file without ITER_PIPE Implement a function, direct_file_splice(), that deals with this by using an ITER_BVEC iterator instead of an ITER_PIPE iterator as the former won't free its buffers when reverted. The function bulk allocates all the buffers it thinks it is going to use in advance, does the read synchronously and only then trims the buffer down. The pages we did use get pushed into the pipe. This fixes a problem with the upcoming iov_iter_extract_pages() function, whereby pages extracted from a non-user-backed iterator such as ITER_PIPE aren't pinned. __iomap_dio_rw(), however, calls iov_iter_revert() to shorten the iterator to just the bufferage it is going to use - which has the side-effect of freeing the excess pipe buffers, even though they're attached to a bio and may get written to by DMA (thanks to Hillf Danton for spotting this[1]). This then causes memory corruption that is particularly noticeable when the syzbot test[2] is run. The test boils down to: out = creat(argv[1], 0666); ftruncate(out, 0x800); lseek(out, 0x200, SEEK_SET); in = open(argv[1], O_RDONLY | O_DIRECT | O_NOFOLLOW); sendfile(out, in, NULL, 0x1dd00); run repeatedly in parallel. What I think is happening is that ftruncate() occasionally shortens the DIO read that's about to be made by sendfile's splice core by reducing i_size. This should be more efficient for DIO read by virtue of doing a bulk page allocation, but slightly less efficient by ignoring any partial page in the pipe. Reported-by: syzbot+a440341a59e3b7142895@syzkaller.appspotmail.com Signed-off-by: David Howells Reviewed-by: Jens Axboe cc: Christoph Hellwig cc: Al Viro cc: David Hildenbrand cc: John Hubbard cc: linux-mm@kvack.org cc: linux-block@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20230207094731.1390-1-hdanton@sina.com/ [1] Link: https://lore.kernel.org/r/000000000000b0b3c005f3a09383@google.com/ [2] Signed-off-by: Steve French commit 07073eb01c5f630344bc1c3e56b0e0d94aedf919 Author: David Howells Date: Tue Feb 14 15:01:42 2023 +0000 splice: Add a func to do a splice from a buffered file without ITER_PIPE Provide a function to do splice read from a buffered file, pulling the folios out of the pagecache directly by calling filemap_get_pages() to do any required reading and then pasting the returned folios into the pipe. A helper function is provided to do the actual folio pasting and will handle multipage folios by splicing as many of the relevant subpages as will fit into the pipe. The code is loosely based on filemap_read() and might belong in mm/filemap.c with that as it needs to use filemap_get_pages(). Signed-off-by: David Howells Reviewed-by: Jens Axboe cc: Christoph Hellwig cc: Al Viro cc: David Hildenbrand cc: John Hubbard cc: linux-mm@kvack.org cc: linux-block@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit dd5b9d003ebcb469de05f967af7164e6b9450ca2 Author: David Howells Date: Wed Feb 8 18:18:17 2023 +0000 mm: Pass info, not iter, into filemap_get_pages() filemap_get_pages() and a number of functions that it calls take an iterator to provide two things: the number of bytes to be got from the file specified and whether partially uptodate pages are allowed. Change these functions so that this information is passed in directly. This allows it to be called without having an iterator to hand. Signed-off-by: David Howells Reviewed-by: Christoph Hellwig Reviewed-by: Jens Axboe cc: Christoph Hellwig cc: Matthew Wilcox cc: Al Viro cc: David Hildenbrand cc: John Hubbard cc: linux-mm@kvack.org cc: linux-block@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit eb3e28c1e89b4984308777231887e41aa8a0151f Author: Kees Cook Date: Fri Feb 17 16:24:40 2023 -0800 smb3: Replace smb2pdu 1-element arrays with flex-arrays The kernel is globally removing the ambiguous 0-length and 1-element arrays in favor of flexible arrays, so that we can gain both compile-time and run-time array bounds checking[1]. Replace the trailing 1-element array with a flexible array in the following structures: struct smb2_err_rsp struct smb2_tree_connect_req struct smb2_negotiate_rsp struct smb2_sess_setup_req struct smb2_sess_setup_rsp struct smb2_read_req struct smb2_read_rsp struct smb2_write_req struct smb2_write_rsp struct smb2_query_directory_req struct smb2_query_directory_rsp struct smb2_set_info_req struct smb2_change_notify_rsp struct smb2_create_rsp struct smb2_query_info_req struct smb2_query_info_rsp Replace the trailing 1-element array with a flexible array, but leave the existing structure padding: struct smb2_file_all_info struct smb2_lock_req Adjust all related size calculations to match the changes to sizeof(). No machine code output or .data section differences are produced after these changes. [1] For lots of details, see both: https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays https://people.kernel.org/kees/bounded-flexible-arrays-in-c Cc: Steve French Cc: Paulo Alcantara Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: Namjae Jeon Cc: Sergey Senozhatsky Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Reviewed-by: Namjae Jeon Signed-off-by: Kees Cook Signed-off-by: Steve French commit 0e9bd27b2a635d54665fcc1d6398a5f6aeb6b0cb Author: Paulo Alcantara Date: Mon Feb 20 16:36:54 2023 -0300 cifs: get rid of dns resolve worker We already upcall to resolve hostnames during reconnect by calling reconn_set_ipaddr_from_hostname(), so there is no point in having a worker to periodically call it. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by Signed-off-by: Steve French commit 5b0ed5964928b0aaf0d644c17c886c7f5ea4bb3f Merge: 553637f73c314 0aa2988e4fd23 Author: Linus Torvalds Date: Mon Feb 20 14:27:21 2023 -0800 Merge tag 'for-6.3/block-2023-02-16' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - NVMe updates via Christoph: - Small improvements to the logging functionality (Amit Engel) - Authentication cleanups (Hannes Reinecke) - Cleanup and optimize the DMA mapping cod in the PCIe driver (Keith Busch) - Work around the command effects for Format NVM (Keith Busch) - Misc cleanups (Keith Busch, Christoph Hellwig) - Fix and cleanup freeing single sgl (Keith Busch) - MD updates via Song: - Fix a rare crash during the takeover process - Don't update recovery_cp when curr_resync is ACTIVE - Free writes_pending in md_stop - Change active_io to percpu - Updates to drbd, inching us closer to unifying the out-of-tree driver with the in-tree one (Andreas, Christoph, Lars, Robert) - BFQ update adding support for multi-actuator drives (Paolo, Federico, Davide) - Make brd compliant with REQ_NOWAIT (me) - Fix for IOPOLL and queue entering, fixing stalled IO waiting on timeouts (me) - Fix for REQ_NOWAIT with multiple bios (me) - Fix memory leak in blktrace cleanup (Greg) - Clean up sbitmap and fix a potential hang (Kemeng) - Clean up some bits in BFQ, and fix a bug in the request injection (Kemeng) - Clean up the request allocation and issue code, and fix some bugs related to that (Kemeng) - ublk updates and fixes: - Add support for unprivileged ublk (Ming) - Improve device deletion handling (Ming) - Misc (Liu, Ziyang) - s390 dasd fixes (Alexander, Qiheng) - Improve utility of request caching and fixes (Anuj, Xiao) - zoned cleanups (Pankaj) - More constification for kobjs (Thomas) - blk-iocost cleanups (Yu) - Remove bio splitting from drivers that don't need it (Christoph) - Switch blk-cgroups to use struct gendisk. Some of this is now incomplete as select late reverts were done. (Christoph) - Add bvec initialization helpers, and convert callers to use that rather than open-coding it (Christoph) - Misc fixes and cleanups (Jinke, Keith, Arnd, Bart, Li, Martin, Matthew, Ulf, Zhong) * tag 'for-6.3/block-2023-02-16' of git://git.kernel.dk/linux: (169 commits) brd: use radix_tree_maybe_preload instead of radix_tree_preload block: use proper return value from bio_failfast() block: bio-integrity: Copy flags when bio_integrity_payload is cloned block: Fix io statistics for cgroup in throttle path brd: mark as nowait compatible brd: check for REQ_NOWAIT and set correct page allocation mask brd: return 0/-error from brd_insert_page() block: sync mixed merged request's failfast with 1st bio's Revert "blk-cgroup: pin the gendisk in struct blkcg_gq" Revert "blk-cgroup: pass a gendisk to blkg_lookup" Revert "blk-cgroup: delay blk-cgroup initialization until add_disk" Revert "blk-cgroup: delay calling blkcg_exit_disk until disk_release" Revert "blk-cgroup: move the cgroup information to struct gendisk" nvme-pci: remove iod use_sgls nvme-pci: fix freeing single sgl block: ublk: check IO buffer based on flag need_get_data s390/dasd: Fix potential memleak in dasd_eckd_init() s390/dasd: sort out physical vs virtual pointers usage block: Remove the ALLOC_CACHE_SLACK constant block: make kobj_type structures constant ... commit 553637f73c314c742243b8dc5ef072e9dadbe581 Merge: c1ef500307953 9636e650e16f6 Author: Linus Torvalds Date: Mon Feb 20 14:10:36 2023 -0800 Merge tag 'for-6.3/dio-2023-02-16' of git://git.kernel.dk/linux Pull legacy dio update from Jens Axboe: "We only have a few file systems that use the old dio code, make them select it rather than build it unconditionally" * tag 'for-6.3/dio-2023-02-16' of git://git.kernel.dk/linux: fs: build the legacy direct I/O code conditionally fs: move sb_init_dio_done_wq out of direct-io.c commit c1ef5003079531b5aae12467a350379496752334 Merge: cce5fe5eda058 d46aa786fa53c Author: Linus Torvalds Date: Mon Feb 20 14:03:57 2023 -0800 Merge tag 'for-6.3/iter-ubuf-2023-02-16' of git://git.kernel.dk/linux Pull io_uring ITER_UBUF conversion from Jens Axboe: "Since we now have ITER_UBUF available, switch to using it for single ranges as it's more efficient than ITER_IOVEC for that" * tag 'for-6.3/iter-ubuf-2023-02-16' of git://git.kernel.dk/linux: block: use iter_ubuf for single range iov_iter: move iter_ubuf check inside restore WARN io_uring: use iter_ubuf for single range imports io_uring: switch network send/recv to ITER_UBUF iov: add import_ubuf() commit cce5fe5eda0581363a9c585dabf8a5923f15a708 Merge: eca3a04f140a7 7d3fd88d61a41 Author: Linus Torvalds Date: Mon Feb 20 13:53:39 2023 -0800 Merge tag 'for-6.3/io_uring-2023-02-16' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: - Cleanup series making the async prep and handling of REQ_F_FORCE_ASYNC easier to follow and verify (Dylan) - Enable specifying specific flags for OP_MSG_RING (Breno) - Enable use of KASAN with the internal request cache (Breno) - Split the opcode definition structs into a hot and cold part (Breno) - OP_MSG_RING fixes (Pavel, me) - Fix an issue with IOPOLL cancelation and PREEMPT_NONE (me) - Handle TIF_NOTIFY_RESUME for the io-wq threads that never return to userspace (me) - Add support for using io_uring_register() with a registered ring fd (Josh) - Improve handling of poll on the ring fd (Pavel) - Series improving the task_work handling (Pavel) - Misc cleanups, fixes, improvements (Dmitrii, Quanfa, Richard, Pavel, me) * tag 'for-6.3/io_uring-2023-02-16' of git://git.kernel.dk/linux: (51 commits) io_uring: Support calling io_uring_register with a registered ring fd io_uring,audit: don't log IORING_OP_MADVISE io_uring: mark task TASK_RUNNING before handling resume/task work io_uring: always go async for unsupported open flags io_uring: always go async for unsupported fadvise flags io_uring: for requests that require async, force it io_uring: if a linked request has REQ_F_FORCE_ASYNC then run it async io_uring: add reschedule point to handle_tw_list() io_uring: add a conditional reschedule to the IOPOLL cancelation loop io_uring: return normal tw run linking optimisation io_uring: refactor tctx_task_work io_uring: refactor io_put_task helpers io_uring: refactor req allocation io_uring: improve io_get_sqe io_uring: kill outdated comment about overflow flush io_uring: use user visible tail in io_uring_poll() io_uring: pass in io_issue_def to io_assign_file() io_uring: Enable KASAN for request cache io_uring: handle TIF_NOTIFY_RESUME when checking for task_work io_uring/msg-ring: ensure flags passing works for task_work completions ... commit d9194e009efef9613f48022f3c885191c48120f9 Author: Frank Rowand Date: Mon Feb 13 12:57:02 2023 -0600 of: dynamic: add lifecycle docbook info to node creation functions The existing docbook comments for the functions related to creating a devicetree node do not explain the reference count of a newly created node, how decrementing the reference count to zero will free the associated memory, and the caller's responsibility to call of_node_put() on the node. Explain what happens when the reference count is decremented to zero. Signed-off-by: Frank Rowand Link: https://lore.kernel.org/r/20230213185702.395776-8-frowand.list@gmail.com Signed-off-by: Rob Herring commit ec0b7e24d566a843e3cfba21a6471170fdb0f810 Author: Frank Rowand Date: Mon Feb 13 12:57:01 2023 -0600 of: add consistency check to of_node_release() Add an additional consistency check to of_node_release(), which is called when the reference count of a devicetree node is decremented to zero. The node's children should have been deleted before the node is deleted so check that no children exist. Signed-off-by: Frank Rowand Link: https://lore.kernel.org/r/20230213185702.395776-7-frowand.list@gmail.com Signed-off-by: Rob Herring commit 23522dd7033ad8dcd818f75469907a8fdac8e8a4 Author: Frank Rowand Date: Mon Feb 13 12:57:00 2023 -0600 of: do not use "%pOF" printk format on node with refcount of zero of_node_release() can not use the "%pOF" printk format to report the node name of a node when the node reference count is zero. This is because the formatter device_node_string() calls fwnode_full_name_string() which indirectly calls of_node_get(). Calling of_node_get() on the node with a zero reference count results in a WARNING and stack trace. When the reference count has been decremented to zero, this function is in the subsequent call path which frees memory related to the node. This commit resolves the unittest EXPECT errors that were created in the previous commmit. Signed-off-by: Frank Rowand Link: https://lore.kernel.org/r/20230213185702.395776-6-frowand.list@gmail.com Signed-off-by: Rob Herring commit 74df14cd301a1433947077e79ce2c610654a32e7 Author: Frank Rowand Date: Mon Feb 13 12:56:59 2023 -0600 of: unittest: add node lifecycle tests Add tests to exercise the actions that occur when the reference count of devicetree nodes decrement to zero and beyond. Decrementing to zero triggers freeing memory allocated for the node. This commit will expose a pr_err() issue in of_node_release(), resulting in some kernal warnings and stack traces. When scripts/dtc/of_unittest_expect processes the console messages, it will also report related problems for EXPECT messages due to the pr_err() issue: ** missing EXPECT begin : 5 Signed-off-by: Frank Rowand Link: https://lore.kernel.org/r/20230213185702.395776-5-frowand.list@gmail.com [robh: Fix !CONFIG_OF_DYNAMIC build] Signed-off-by: Rob Herring commit 0af2795f936f1ea1f9f1497447145dfcc7ed2823 Author: Marc Zyngier Date: Mon Feb 20 19:01:01 2023 +0000 genirq/msi: Take the per-device MSI lock before validating the control structure Calling msi_ctrl_valid() ultimately results in calling msi_get_device_domain(), which requires holding the device MSI lock. However, in msi_domain_populate_irqs() the lock is taken right after having called msi_ctrl_valid(), which is just a tad too late. Take the lock before invoking msi_ctrl_valid(). Fixes: 40742716f294 ("genirq/msi: Make msi_add_simple_msi_descs() device domain aware") Reported-by: "Russell King (Oracle)" Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Tested-by: Russell King (Oracle) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/Y/Opu6ETe3ZzZ/8E@shell.armlinux.org.uk Link: https://lore.kernel.org/r/20230220190101.314446-1-maz@kernel.org commit eca3a04f140a7380d8a7b4cd89d681706a69380c Merge: 885ce48739189 723b197bbdf1e Author: Linus Torvalds Date: Mon Feb 20 13:05:24 2023 -0800 Merge tag 'dlm-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This fixes some races in the lowcomms startup and shutdown code that were found by targeted stress testing that quickly and repeatedly joins and leaves lockspaces" * tag 'dlm-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: fs: dlm: remove unnecessary waker_up() calls fs: dlm: move state change into else branch fs: dlm: remove newline in log_print fs: dlm: reduce the shutdown timeout to 5 secs fs: dlm: make dlm sequence id more robust fs: dlm: wait until all midcomms nodes detect version fs: dlm: ignore unexpected non dlm opts msgs fs: dlm: bring back previous shutdown handling fs: dlm: send FIN ack back in right cases fs: dlm: move sending fin message into state change handling fs: dlm: don't set stop rx flag after node reset fs: dlm: fix race setting stop tx flag fs: dlm: be sure to call dlm_send_queue_flush() fs: dlm: fix use after free in midcomms commit fs: dlm: start midcomms before scand fs/dlm: Remove "select SRCU" fs: dlm: fix return value check in dlm_memory_init() commit 885ce48739189fac6645ff42d736ee0de0b5917d Merge: 274978f173276 964a54e5e1a0d Author: Linus Torvalds Date: Mon Feb 20 12:54:27 2023 -0800 Merge tag 'for-6.3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "The usual mix of performance improvements and new features. The core change is reworking how checksums are processed, with followup cleanups and simplifications. There are two minor changes in block layer and iomap code. Features: - block group allocation class heuristics: - pack files by size (up to 128k, up to 8M, more) to avoid fragmentation in block groups, assuming that file size and life time is correlated, in particular this may help during balance - with tracepoints and extensible in the future Performance: - send: cache directory utimes and only emit the command when necessary - speedup up to 10x - smaller final stream produced (no redundant utimes commands issued) - compatibility not affected - fiemap: skip backref checks for shared leaves - speedup 3x on sample filesystem with all leaves shared (e.g. on snapshots) - micro optimized b-tree key lookup, speedup in metadata operations (sample benchmark: fs_mark +10% of files/sec) Core changes: - change where checksumming is done in the io path: - checksum and read repair does verification at lower layer - cascaded cleanups and simplifications - raid56 refactoring and cleanups Fixes: - sysfs: make sure that a run-time change of a feature is correctly tracked by the feature files - scrub: better reporting of tree block errors Other: - locally enable -Wmaybe-uninitialized after fixing all warnings - misc cleanups, spelling fixes Other code: - block: export bio_split_rw - iomap: remove IOMAP_F_ZONE_APPEND" * tag 'for-6.3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (109 commits) btrfs: make kobj_type structures constant btrfs: remove the bdev argument to btrfs_rmap_block btrfs: don't rely on unchanging ->bi_bdev for zone append remaps btrfs: never return true for reads in btrfs_use_zone_append btrfs: pass a btrfs_bio to btrfs_use_append btrfs: set bbio->file_offset in alloc_new_bio btrfs: use file_offset to limit bios size in calc_bio_boundaries btrfs: do unsigned integer division in the extent buffer binary search loop btrfs: eliminate extra call when doing binary search on extent buffer btrfs: raid56: handle endio in scrub_rbio btrfs: raid56: handle endio in recover_rbio btrfs: raid56: handle endio in rmw_rbio btrfs: raid56: submit the read bios from scrub_assemble_read_bios btrfs: raid56: fold rmw_read_wait_recover into rmw_read_bios btrfs: raid56: fold recover_assemble_read_bios into recover_rbio btrfs: raid56: add a bio_list_put helper btrfs: raid56: wait for I/O completion in submit_read_bios btrfs: raid56: simplify code flow in rmw_rbio btrfs: raid56: simplify error handling and code flow in raid56_parity_write btrfs: replace btrfs_wait_tree_block_writeback by wait_on_extent_buffer_writeback ... commit f9366f4c2a29d14f5992b195e268240c2deb116e Author: Andrew Morton Date: Thu Feb 16 14:44:24 2023 -0800 include/linux/migrate.h: remove unneeded externs As suggested by Matthew. Suggested-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 32cf666eab720b597650d9dea6ff07e99cd36b3d Author: SeongJae Park Date: Thu Feb 16 17:07:03 2023 +0000 mm/memory_hotplug: cleanup return value handing in do_migrate_range() Return value mechanism of do_migrate_range() is not very simple, while no caller of the function checks the return value. Make the function return nothing to be more simple, and cleanup related unnecessary code. Link: https://lkml.kernel.org/r/20230216170703.64574-1-sj@kernel.org Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Baolin Wang Signed-off-by: SeongJae Park Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 7a079ba20090ab50d2f4203ceccd1e0f4becd1a6 Author: Peter Xu Date: Wed Feb 15 15:58:00 2023 -0500 mm/uffd: fix comment in handling pte markers The comment is obsolete after f369b07c8614 ("mm/uffd: reset write protection when unregister with wp-mode", 2022-08-20). Remove it. Link: https://lkml.kernel.org/r/20230215205800.223549-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Axel Rasmussen Signed-off-by: Andrew Morton commit cd7755800eb54e8522f5e51f4e71e6494c1f1572 Author: Baolin Wang Date: Wed Feb 15 18:39:37 2023 +0800 mm: change to return bool for isolate_movable_page() Now the isolate_movable_page() can only return 0 or -EBUSY, and no users will care about the negative return value, thus we can convert the isolate_movable_page() to return a boolean value to make the code more clear when checking the movable page isolation state. No functional changes intended. [akpm@linux-foundation.org: remove unneeded comment, per Matthew] Link: https://lkml.kernel.org/r/cb877f73f4fff8d309611082ec740a7065b1ade0.1676424378.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Linus Torvalds Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 9747b9e92418b61c2281561e0651803f1fad0159 Author: Baolin Wang Date: Wed Feb 15 18:39:36 2023 +0800 mm: hugetlb: change to return bool for isolate_hugetlb() Now the isolate_hugetlb() only returns 0 or -EBUSY, and most users did not care about the negative value, thus we can convert the isolate_hugetlb() to return a boolean value to make code more clear when checking the hugetlb isolation state. Moreover converts 2 users which will consider the negative value returned by isolate_hugetlb(). No functional changes intended. [akpm@linux-foundation.org: shorten locked section, per SeongJae Park] Link: https://lkml.kernel.org/r/12a287c5bebc13df304387087bbecc6421510849.1676424378.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Mike Kravetz Acked-by: Linus Torvalds Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit f7f9c00dfafffd7a5a1a5685e2d874c64913e2ed Author: Baolin Wang Date: Wed Feb 15 18:39:35 2023 +0800 mm: change to return bool for isolate_lru_page() The isolate_lru_page() can only return 0 or -EBUSY, and most users did not care about the negative error of isolate_lru_page(), except one user in add_page_for_migration(). So we can convert the isolate_lru_page() to return a boolean value, which can help to make the code more clear when checking the return value of isolate_lru_page(). Also convert all users' logic of checking the isolation state. No functional changes intended. Link: https://lkml.kernel.org/r/3074c1ab628d9dbf139b33f248a8bc253a3f95f0.1676424378.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Linus Torvalds Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit be2d57563822b7e00b2b16d9354637c4b6d6d5cc Author: Baolin Wang Date: Wed Feb 15 18:39:34 2023 +0800 mm: change to return bool for folio_isolate_lru() Patch series "Change the return value for page isolation functions", v3. Now the page isolation functions did not return a boolean to indicate success or not, instead it will return a negative error when failed to isolate a page. So below code used in most places seem a boolean success/failure thing, which can confuse people whether the isolation is successful. if (folio_isolate_lru(folio)) continue; Moreover the page isolation functions only return 0 or -EBUSY, and most users did not care about the negative error except for few users, thus we can convert all page isolation functions to return a boolean value, which can remove the confusion to make code more clear. No functional changes intended in this patch series. This patch (of 4): Now the folio_isolate_lru() did not return a boolean value to indicate isolation success or not, however below code checking the return value can make people think that it was a boolean success/failure thing, which makes people easy to make mistakes (see the fix patch[1]). if (folio_isolate_lru(folio)) continue; Thus it's better to check the negative error value expilictly returned by folio_isolate_lru(), which makes code more clear per Linus's suggestion[2]. Moreover Matthew suggested we can convert the isolation functions to return a boolean[3], since most users did not care about the negative error value, and can also remove the confusing of checking return value. So this patch converts the folio_isolate_lru() to return a boolean value, which means return 'true' to indicate the folio isolation is successful, and 'false' means a failure to isolation. Meanwhile changing all users' logic of checking the isolation state. No functional changes intended. [1] https://lore.kernel.org/all/20230131063206.28820-1-Kuan-Ying.Lee@mediatek.com/T/#u [2] https://lore.kernel.org/all/CAHk-=wiBrY+O-4=2mrbVyxR+hOqfdJ=Do6xoucfJ9_5az01L4Q@mail.gmail.com/ [3] https://lore.kernel.org/all/Y+sTFqwMNAjDvxw3@casper.infradead.org/ Link: https://lkml.kernel.org/r/cover.1676424378.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/8a4e3679ed4196168efadf7ea36c038f2f7d5aa9.1676424378.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: SeongJae Park Acked-by: David Hildenbrand Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Linus Torvalds Cc: Johannes Weiner Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Kravetz Cc: Muchun Song Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Roman Gushchin Cc: Shakeel Butt Signed-off-by: Andrew Morton commit d5d469247264e56960705dc5ae7e1d014861fe40 Author: Arnd Bergmann Date: Wed Feb 15 14:00:58 2023 +0100 objtool: add UACCESS exceptions for __tsan_volatile_read/write A lot of the tsan helpers are already excempt from the UACCESS warnings, but some more functions were added that need the same thing: kernel/kcsan/core.o: warning: objtool: __tsan_volatile_read16+0x0: call to __tsan_unaligned_read16() with UACCESS enabled kernel/kcsan/core.o: warning: objtool: __tsan_volatile_write16+0x0: call to __tsan_unaligned_write16() with UACCESS enabled vmlinux.o: warning: objtool: __tsan_unaligned_volatile_read16+0x4: call to __tsan_unaligned_read16() with UACCESS enabled vmlinux.o: warning: objtool: __tsan_unaligned_volatile_write16+0x4: call to __tsan_unaligned_write16() with UACCESS enabled As Marco points out, these functions don't even call each other explicitly but instead gcc (but not clang) notices the functions being identical and turns one symbol into a direct branch to the other. Link: https://lkml.kernel.org/r/20230215130058.3836177-4-arnd@kernel.org Fixes: 75d75b7a4d54 ("kcsan: Support distinguishing volatile accesses") Signed-off-by: Arnd Bergmann Acked-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Josh Poimboeuf Cc: Kuan-Ying Lee Cc: Peter Zijlstra (Intel) Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit e75a698859a3f62825af06987da6b3e6466e6e56 Author: Arnd Bergmann Date: Wed Feb 15 14:00:57 2023 +0100 kmsan: disable ftrace in kmsan core code objtool warns about some suspicous code inside of kmsan: vmlinux.o: warning: objtool: __msan_metadata_ptr_for_load_n+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_store_n+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_load_1+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_store_1+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_load_2+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_store_2+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_load_4+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_store_4+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_load_8+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_metadata_ptr_for_store_8+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_instrument_asm_store+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_chain_origin+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_poison_alloca+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_warning+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: __msan_get_context_state+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: kmsan_copy_to_user+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: kmsan_unpoison_memory+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: kmsan_unpoison_entry_regs+0x4: call to __fentry__() with UACCESS enabled vmlinux.o: warning: objtool: kmsan_report+0x4: call to __fentry__() with UACCESS enabled The Makefile contained a line to turn off ftrace for the entire directory, but this does not work. Replace it with individual lines, matching the approach in kasan. Link: https://lkml.kernel.org/r/20230215130058.3836177-3-arnd@kernel.org Signed-off-by: Arnd Bergmann Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core") Acked-by: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Josh Poimboeuf Cc: Kuan-Ying Lee Cc: Marco Elver Cc: Peter Zijlstra (Intel) Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 9701c9ff8311fed118fd09d962a90e254e761d97 Author: Arnd Bergmann Date: Wed Feb 15 14:00:56 2023 +0100 kasan: mark addr_has_metadata __always_inline Patch series "objtool warning fixes", v2. These are three of the easier fixes for objtool warnings around kasan/kmsan/kcsan. I dropped one patch since Peter had come up with a better fix, and adjusted the changelog text based on feedback. This patch (of 3): When the compiler decides not to inline this function, objtool complains about incorrect UACCESS state: mm/kasan/generic.o: warning: objtool: __asan_load2+0x11: call to addr_has_metadata() with UACCESS enabled Link: https://lore.kernel.org/all/20230208164011.2287122-1-arnd@kernel.org/ Link: https://lkml.kernel.org/r/20230215130058.3836177-2-arnd@kernel.org Signed-off-by: Arnd Bergmann Acked-by: Peter Zijlstra (Intel) Reviewed-by: Marco Elver Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Josh Poimboeuf Cc: Kuan-Ying Lee Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 274978f173276c5720a3cd8d0b6047d2c0d3a684 Merge: cd776a4342b32 df97f64dfa317 Author: Linus Torvalds Date: Mon Feb 20 12:44:08 2023 -0800 Merge tag 'fixes_for_v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull UDF and ext2 fixes from Jan Kara: - Rewrite of udf directory iteration code to address multiple syzbot reports - Fixes to udf extent handling and block mapping code to address several syzbot reports and filesystem corruption issues uncovered by fsx & fsstress - Convert udf to kmap_local() - Add sanity checks when loading udf bitmaps - Drop old VARCONV support which I've never seen used and which was broken for quite some years without anybody noticing - Finish conversion of ext2 to kmap_local() - One fix to mpage_writepages() on which other udf fixes depend * tag 'fixes_for_v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: (78 commits) udf: Avoid directory type conversion failure due to ENOMEM udf: Use unsigned variables for size calculations udf: remove reporting loc in debug output udf: Check consistency of Space Bitmap Descriptor udf: Fix file counting in LVID udf: Limit file size to 4TB udf: Don't return bh from udf_expand_dir_adinicb() udf: Convert udf_expand_file_adinicb() to avoid kmap_atomic() udf: Convert udf_adinicb_writepage() to memcpy_to_page() udf: Switch udf_adinicb_readpage() to kmap_local_page() udf: Move udf_adinicb_readpage() to inode.c udf: Mark aops implementation static udf: Switch to single address_space_operations udf: Add handling of in-ICB files to udf_bmap() udf: Convert all file types to use udf_write_end() udf: Convert in-ICB files to use udf_write_begin() udf: Convert in-ICB files to use udf_direct_IO() udf: Convert in-ICB files to use udf_writepages() udf: Unify .read_folio for normal and in-ICB files udf: Fix off-by-one error when discarding preallocation ... commit cd776a4342b322a9e3df59b2da949fac4db313a0 Merge: 6639c3ce7fd21 032bffd494e39 Author: Linus Torvalds Date: Mon Feb 20 12:38:27 2023 -0800 Merge tag 'fsnotify_for_v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "Support for auditing decisions regarding fanotify permission events" * tag 'fsnotify_for_v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify,audit: Allow audit to use the full permission event response fanotify: define struct members to hold response decision context fanotify: Ensure consistent variable type for response commit 6639c3ce7fd217c22b26aa9f2a3cb69dc19221f8 Merge: f18f9845f2f10 51e4e3153ebc3 Author: Linus Torvalds Date: Mon Feb 20 12:33:41 2023 -0800 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity updates from Eric Biggers: "Fix the longstanding implementation limitation that fsverity was only supported when the Merkle tree block size, filesystem block size, and PAGE_SIZE were all equal. Specifically, add support for Merkle tree block sizes less than PAGE_SIZE, and make ext4 support fsverity on filesystems where the filesystem block size is less than PAGE_SIZE. Effectively, this means that fsverity can now be used on systems with non-4K pages, at least on ext4. These changes have been tested using the verity group of xfstests, newly updated to cover the new code paths. Also update fs/verity/ to support verifying data from large folios. There's also a similar patch for fs/crypto/, to support decrypting data from large folios, which I'm including in here to avoid a merge conflict between the fscrypt and fsverity branches" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fscrypt: support decrypting data from large folios fsverity: support verifying data from large folios fsverity.rst: update git repo URL for fsverity-utils ext4: allow verity with fs block size < PAGE_SIZE fs/buffer.c: support fsverity in block_read_full_folio() f2fs: simplify f2fs_readpage_limit() ext4: simplify ext4_readpage_limit() fsverity: support enabling with tree block size < PAGE_SIZE fsverity: support verification with tree block size < PAGE_SIZE fsverity: replace fsverity_hash_page() with fsverity_hash_block() fsverity: use EFBIG for file too large to enable verity fsverity: store log2(digest_size) precomputed fsverity: simplify Merkle tree readahead size calculation fsverity: use unsigned long for level_start fsverity: remove debug messages and CONFIG_FS_VERITY_DEBUG fsverity: pass pos and size to ->write_merkle_tree_block fsverity: optimize fsverity_cleanup_inode() on non-verity files fsverity: optimize fsverity_prepare_setattr() on non-verity files fsverity: optimize fsverity_file_open() on non-verity files commit f18f9845f2f10d3d1fc63e4ad16ee52d2d9292fa Merge: dc483c851ff9a 097d7c1fcb8d4 Author: Linus Torvalds Date: Mon Feb 20 12:29:27 2023 -0800 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt updates from Eric Biggers: "Simplify the implementation of the test_dummy_encryption mount option by adding the 'test dummy key' on-demand" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: clean up fscrypt_add_test_dummy_key() fs/super.c: stop calling fscrypt_destroy_keyring() from __put_super() f2fs: stop calling fscrypt_add_test_dummy_key() ext4: stop calling fscrypt_add_test_dummy_key() fscrypt: add the test dummy encryption key on-demand commit dc483c851ff9a3505069cb326221dc0242d44015 Merge: 91bc559d8d3ae 8d1b80a794526 Author: Linus Torvalds Date: Mon Feb 20 12:23:40 2023 -0800 Merge tag 'erofs-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "The most noticeable feature for this cycle is per-CPU kthread decompression since Android use cases need low-latency I/O handling in order to ensure the app runtime performance, currently unbounded workqueue latencies are not quite good for production on many aarch64 hardwares and thus we need to introduce a deterministic expectation for these. Decompression is CPU-intensive and it is sleepable for EROFS, so other alternatives like decompression under softirq contexts are not considered. More details are in the corresponding commit message. Others are random cleanups around the whole codebase and we will continue to clean up further in the next few months. Due to Lunar New Year holidays, some other new features were not completely reviewed and solidified as expected and we may delay them into the next version. Summary: - Add per-cpu kthreads for low-latency decompression for Android use cases - Get rid of tagged pointer helpers since they are rarely used now - Several code cleanups to reduce codebase - Documentation and MAINTAINERS updates" * tag 'erofs-for-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: (21 commits) erofs: fix an error code in z_erofs_init_zip_subsystem() erofs: unify anonymous inodes for blob erofs: relinquish volume with mutex held erofs: maintain cookies of share domain in self-contained list erofs: remove unused device mapping in meta routine MAINTAINERS: erofs: Add Documentation/ABI/testing/sysfs-fs-erofs Documentation/ABI: sysfs-fs-erofs: update supported features erofs: remove unused EROFS_GET_BLOCKS_RAW flag erofs: update print symbols for various flags in trace erofs: make kobj_type structures constant erofs: add per-cpu threads for decompression as an option erofs: tidy up internal.h erofs: get rid of z_erofs_do_map_blocks() forward declaration erofs: move zdata.h into zdata.c erofs: remove tagged pointer helpers erofs: avoid tagged pointers to mark sync decompression erofs: get rid of erofs_inode_datablocks() erofs: simplify iloc() erofs: get rid of debug_one_dentry() erofs: remove linux/buffer_head.h dependency ... commit 91bc559d8d3aed488b4b50e9eba1d7ebb1da7bbf Merge: ea5aac6fae94b 4e1da8fe03130 Author: Linus Torvalds Date: Mon Feb 20 12:14:33 2023 -0800 Merge tag 'fs.acl.v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfs acl update from Christian Brauner: "This contains a single update to the internal get acl method and replaces an open-coded cmpxchg() comparison with with try_cmpxchg(). It's clearer and also beneficial on some architectures" * tag 'fs.acl.v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: posix_acl: Use try_cmpxchg in get_acl commit ea5aac6fae94bff4756051b0503f86e31ef6808b Merge: 05e6295f7b5e0 47d586913f2ab Author: Linus Torvalds Date: Mon Feb 20 12:03:55 2023 -0800 Merge tag 'fs.v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfs hardening update from Christian Brauner: "Jan pointed out that during shutdown both filp_close() and super block destruction will use basic printk logging when bugs are detected. This causes issues in a few scenarios: - Tools like syzkaller cannot figure out that the logged message indicates a bug. - Users that explicitly opt in to have the kernel bug on data corruption by selecting CONFIG_BUG_ON_DATA_CORRUPTION should see the kernel crash when they did actually select that option. - When there are busy inodes after the superblock is shut down later access to such a busy inodes walks through freed memory. It would be better to cleanly crash instead. All of this can be addressed by using the already existing CHECK_DATA_CORRUPTION() macro in these places when kernel bugs are detected. Its logging improvement is useful for all users. Otherwise this only has a meaningful behavioral effect when users do select CONFIG_BUG_ON_DATA_CORRUPTION which means this is backward compatible for regular users" * tag 'fs.v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: fs: Use CHECK_DATA_CORRUPTION() when kernel bugs are detected commit 05e6295f7b5e05f09e369a3eb2882ec5b40fff20 Merge: de630176bdf88 7a80e5b8c6fa7 Author: Linus Torvalds Date: Mon Feb 20 11:53:11 2023 -0800 Merge tag 'fs.idmapped.v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping Pull vfs idmapping updates from Christian Brauner: - Last cycle we introduced the dedicated struct mnt_idmap type for mount idmapping and the required infrastucture in 256c8aed2b42 ("fs: introduce dedicated idmap type for mounts"). As promised in last cycle's pull request message this converts everything to rely on struct mnt_idmap. Currently we still pass around the plain namespace that was attached to a mount. This is in general pretty convenient but it makes it easy to conflate namespaces that are relevant on the filesystem with namespaces that are relevant on the mount level. Especially for non-vfs developers without detailed knowledge in this area this was a potential source for bugs. This finishes the conversion. Instead of passing the plain namespace around this updates all places that currently take a pointer to a mnt_userns with a pointer to struct mnt_idmap. Now that the conversion is done all helpers down to the really low-level helpers only accept a struct mnt_idmap argument instead of two namespace arguments. Conflating mount and other idmappings will now cause the compiler to complain loudly thus eliminating the possibility of any bugs. This makes it impossible for filesystem developers to mix up mount and filesystem idmappings as they are two distinct types and require distinct helpers that cannot be used interchangeably. Everything associated with struct mnt_idmap is moved into a single separate file. With that change no code can poke around in struct mnt_idmap. It can only be interacted with through dedicated helpers. That means all filesystems are and all of the vfs is completely oblivious to the actual implementation of idmappings. We are now also able to extend struct mnt_idmap as we see fit. For example, we can decouple it completely from namespaces for users that don't require or don't want to use them at all. We can also extend the concept of idmappings so we can cover filesystem specific requirements. In combination with the vfs{g,u}id_t work we finished in v6.2 this makes this feature substantially more robust and thus difficult to implement wrong by a given filesystem and also protects the vfs. - Enable idmapped mounts for tmpfs and fulfill a longstanding request. A long-standing request from users had been to make it possible to create idmapped mounts for tmpfs. For example, to share the host's tmpfs mount between multiple sandboxes. This is a prerequisite for some advanced Kubernetes cases. Systemd also has a range of use-cases to increase service isolation. And there are more users of this. However, with all of the other work going on this was way down on the priority list but luckily someone other than ourselves picked this up. As usual the patch is tiny as all the infrastructure work had been done multiple kernel releases ago. In addition to all the tests that we already have I requested that Rodrigo add a dedicated tmpfs testsuite for idmapped mounts to xfstests. It is to be included into xfstests during the v6.3 development cycle. This should add a slew of additional tests. * tag 'fs.idmapped.v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/idmapping: (26 commits) shmem: support idmapped mounts for tmpfs fs: move mnt_idmap fs: port vfs{g,u}id helpers to mnt_idmap fs: port fs{g,u}id helpers to mnt_idmap fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap fs: port i_{g,u}id_{needs_}update() to mnt_idmap quota: port to mnt_idmap fs: port privilege checking helpers to mnt_idmap fs: port inode_owner_or_capable() to mnt_idmap fs: port inode_init_owner() to mnt_idmap fs: port acl to mnt_idmap fs: port xattr to mnt_idmap fs: port ->permission() to pass mnt_idmap fs: port ->fileattr_set() to pass mnt_idmap fs: port ->set_acl() to pass mnt_idmap fs: port ->get_acl() to pass mnt_idmap fs: port ->tmpfile() to pass mnt_idmap fs: port ->rename() to pass mnt_idmap fs: port ->mknod() to pass mnt_idmap fs: port ->mkdir() to pass mnt_idmap ... commit 01bb11ad828b320749764fa93ad078db20d08a9e Author: Yury Norov Date: Thu Feb 16 17:39:08 2023 -0800 sched/topology: fix KASAN warning in hop_cmp() Despite that prev_hop is used conditionally on cur_hop is not the first hop, it's initialized unconditionally. Because initialization implies dereferencing, it might happen that the code dereferences uninitialized memory, which has been spotted by KASAN. Fix it by reorganizing hop_cmp() logic. Reported-by: Bruno Goncalves Fixes: cd7f55359c90 ("sched: add sched_numa_find_nth_cpu()") Signed-off-by: Yury Norov Link: https://lore.kernel.org/r/Y+7avK6V9SyAWsXi@yury-laptop/ Signed-off-by: Jakub Kicinski commit de630176bdf885eed442902afe94eb60d8f5f826 Merge: 575a7e0f812a4 58a033c9a3e00 Author: Linus Torvalds Date: Mon Feb 20 11:21:02 2023 -0800 Merge tag 'iversion-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull i_version updates from Jeff Layton: "This overhauls how we handle i_version queries from nfsd. Instead of having special routines and grabbing the i_version field directly out of the inode in some cases, we've moved most of the handling into the various filesystems' getattr operations. As a bonus, this makes ceph's change attribute usable by knfsd as well. This should pave the way for future work to make this value queryable by userland, and to make it more resilient against rolling back on a crash" * tag 'iversion-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: nfsd: remove fetch_iversion export operation nfsd: use the getattr operation to fetch i_version nfsd: move nfsd4_change_attribute to nfsfh.c ceph: report the inode version in getattr if requested nfs: report the inode version in getattr if requested vfs: plumb i_version handling into struct kstat fs: clarify when the i_version counter must be updated fs: uninline inode_query_iversion commit 575a7e0f812a4968ad1e0c00026692ede040e13f Merge: 219ac97a486c1 c65454a947263 Author: Linus Torvalds Date: Mon Feb 20 11:10:38 2023 -0800 Merge tag 'locks-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking updates from Jeff Layton: "The main change here is that I've broken out most of the file locking definitions into a new header file. I also went ahead and completed the removal of locks_inode function" * tag 'locks-v6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: fs: remove locks_inode filelock: move file locking definitions to separate header file commit 219ac97a486c1ad9c110cb96ebdad7ba068236fb Merge: 69adb0bcb8339 85b93bbd1c976 Author: Linus Torvalds Date: Mon Feb 20 11:02:05 2023 -0800 Merge tag 'tpm-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "In additon to bug fixes, these are noteworthy changes: - In TPM I2C drivers, migrate from probe() to probe_new() (a new driver model in I2C). - TPM CRB: Pluton support - Add duplicate hash detection to the blacklist keyring in order to give more meaningful klog output than e.g. [1]" Link: https://askubuntu.com/questions/1436856/ubuntu-22-10-blacklist-problem-blacklisting-hash-13-message-on-boot [1] * tag 'tpm-v6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: add vendor flag to command code validation tpm: Add reserved memory event log tpm: Use managed allocation for bios event log tpm: tis_i2c: Convert to i2c's .probe_new() tpm: tpm_i2c_nuvoton: Convert to i2c's .probe_new() tpm: tpm_i2c_infineon: Convert to i2c's .probe_new() tpm: tpm_i2c_atmel: Convert to i2c's .probe_new() tpm: st33zp24: Convert to i2c's .probe_new() KEYS: asymmetric: Fix ECDSA use via keyctl uapi certs: don't try to update blacklist keys KEYS: Add new function key_create() certs: make blacklisted hash available in klog tpm_crb: Add support for CRB devices based on Pluton crypto: certs: fix FIPS selftest dependency commit 69adb0bcb833963050d82e645b6a1a0747662490 Merge: d644c670ef241 7ea01d3169a28 Author: Linus Torvalds Date: Mon Feb 20 10:40:42 2023 -0800 Merge tag 'rust-6.3' of https://github.com/Rust-for-Linux/linux Pull Rust updates from Miguel Ojeda: "More core additions, getting closer to a point where the first Rust modules can be upstreamed. The major ones being: - Sync: new types 'Arc', 'ArcBorrow' and 'UniqueArc'. - Types: new trait 'ForeignOwnable' and new type 'ScopeGuard'. There is also a substantial removal in terms of lines: - 'alloc' crate: remove the 'borrow' module (type 'Cow' and trait 'ToOwned')" * tag 'rust-6.3' of https://github.com/Rust-for-Linux/linux: rust: delete rust-project.json when running make clean rust: MAINTAINERS: Add the zulip link rust: types: implement `ForeignOwnable` for `Arc` rust: types: implement `ForeignOwnable` for the unit type rust: types: implement `ForeignOwnable` for `Box` rust: types: introduce `ForeignOwnable` rust: types: introduce `ScopeGuard` rust: prelude: prevent doc inline of external imports rust: sync: add support for dispatching on Arc and ArcBorrow. rust: sync: introduce `UniqueArc` rust: sync: allow type of `self` to be `ArcBorrow` rust: sync: introduce `ArcBorrow` rust: sync: allow coercion from `Arc` to `Arc` rust: sync: allow type of `self` to be `Arc` or variants rust: sync: add `Arc` for ref-counted allocations rust: compiler_builtins: make stubs non-global rust: alloc: remove the `borrow` module (`ToOwned`, `Cow`) commit d54170812ef1c80e0fa3ed3e554a0bbfc2920d9d Author: Mark Rutland Date: Mon Feb 20 16:23:17 2023 +0000 arm64: fix .idmap.text assertion for large kernels When building a kernel with many debug options enabled (which happens in test configurations use by myself and syzbot), the kernel can become large enough that portions of .text can be more than 128M away from .idmap.text (which is placed inside the .rodata section). Where idmap code branches into .text, the linker will place veneers in the .idmap.text section to make those branches possible. Unfortunately, as Ard reports, GNU LD has bseen observed to add 4K of padding when adding such veneers, e.g. | .idmap.text 0xffffffc01e48e5c0 0x32c arch/arm64/mm/proc.o | 0xffffffc01e48e5c0 idmap_cpu_replace_ttbr1 | 0xffffffc01e48e600 idmap_kpti_install_ng_mappings | 0xffffffc01e48e800 __cpu_setup | *fill* 0xffffffc01e48e8ec 0x4 | .idmap.text.stub | 0xffffffc01e48e8f0 0x18 linker stubs | 0xffffffc01e48f8f0 __idmap_text_end = . | 0xffffffc01e48f000 . = ALIGN (0x1000) | *fill* 0xffffffc01e48f8f0 0x710 | 0xffffffc01e490000 idmap_pg_dir = . This makes the __idmap_text_start .. __idmap_text_end region bigger than the 4K we require it to fit within, and triggers an assertion in arm64's vmlinux.lds.S, which breaks the build: | LD .tmp_vmlinux.kallsyms1 | aarch64-linux-gnu-ld: ID map text too big or misaligned | make[1]: *** [scripts/Makefile.vmlinux:35: vmlinux] Error 1 | make: *** [Makefile:1264: vmlinux] Error 2 Avoid this by using an `ADRP+ADD+BLR` sequence for branches out of .idmap.text, which avoids the need for veneers. These branches are only executed once per boot, and only when the MMU is on, so there should be no noticeable performance penalty in replacing `BL` with `ADRP+ADD+BLR`. At the same time, remove the "x" and "w" attributes when placing code in .idmap.text, as these are not necessary, and this will prevent the linker from assuming that it is safe to place PLTs into .idmap.text, causing it to warn if and when there are out-of-range branches within .idmap.text, e.g. | LD .tmp_vmlinux.kallsyms1 | arch/arm64/kernel/head.o: in function `primary_entry': | (.idmap.text+0x1c): relocation truncated to fit: R_AARCH64_CALL26 against symbol `dcache_clean_poc' defined in .text section in arch/arm64/mm/cache.o | arch/arm64/kernel/head.o: in function `init_el2': | (.idmap.text+0x88): relocation truncated to fit: R_AARCH64_CALL26 against symbol `dcache_clean_poc' defined in .text section in arch/arm64/mm/cache.o | make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1 | make: *** [Makefile:1252: vmlinux] Error 2 Thus, if future changes add out-of-range branches in .idmap.text, it should be easy enough to identify those from the resulting linker errors. Reported-by: syzbot+f8ac312e31226e23302b@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-arm-kernel/00000000000028ea4105f4e2ef54@google.com/ Signed-off-by: Mark Rutland Cc: Ard Biesheuvel Cc: Will Deacon Tested-by: Ard Biesheuvel Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20230220162317.1581208-1-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit b361d5d2464a88184f6e17a6462719ba79180b1a Author: Janne Grunau Date: Sun Feb 12 16:41:24 2023 +0100 ASoC: dt-bindings: apple,mca: Add t8112-mca compatible The block found on Apple's M2 SoC is compatible with the existing driver so add its per-SoC compatible. Signed-off-by: Janne Grunau Acked-by: Krzysztof Kozlowski Acked-by: Martin Povišer Link: https://lore.kernel.org/r/20230202-asahi-t8112-dt-v1-14-cb5442d1c229@jannau.net Signed-off-by: Mark Brown commit 3e161c2791f8e661eed24a2c624087084d910215 Author: Zhang Xiaoxu Date: Fri Nov 18 16:42:08 2022 +0800 cifs: Fix warning and UAF when destroy the MR list If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF. Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Acked-by: Paulo Alcantara (SUSE) Reviewed-by: Tom Talpey Signed-off-by: Zhang Xiaoxu Signed-off-by: Steve French commit e9d3401d95d62a9531082cd2453ed42f2740e3fd Author: Zhang Xiaoxu Date: Fri Nov 18 16:42:07 2022 +0800 cifs: Fix lost destroy smbd connection when MR allocate failed If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection info will be leaked. Let's set the smb direct connection info to the server before call smbd_destroy(). Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Signed-off-by: Zhang Xiaoxu Acked-by: Paulo Alcantara (SUSE) Reviewed-by: David Howells Reviewed-by: Tom Talpey Signed-off-by: Steve French commit 8e843bf38f7be0766642a91523cfa65f2b021a8a Author: Ronnie Sahlberg Date: Fri Feb 17 13:35:01 2023 +1000 cifs: return a single-use cfid if we did not get a lease If we did not get a lease we can still return a single use cfid to the caller. The cfid will not have has_lease set and will thus not be shared with any other concurrent users and will be freed immediately when the caller drops the handle. This avoids extra roundtrips for servers that do not support directory leases where they would first fail to get a cfid with a lease and then fallback to try a normal SMB2_open() Signed-off-by: Ronnie Sahlberg Cc: stable@vger.kernel.org Reviewed-by: Bharath SM Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 66d45ca1350a3bb8d5f4db8879ccad3ed492337a Author: Ronnie Sahlberg Date: Fri Feb 17 13:35:00 2023 +1000 cifs: Check the lease context if we actually got a lease Some servers may return that we got a lease in rsp->OplockLevel but then in the lease context contradict this and say we got no lease at all. Thus we need to check the context if we have a lease. Additionally, If we do not get a lease we need to make sure we close the handle before we return an error to the caller. Signed-off-by: Ronnie Sahlberg Cc: stable@vger.kernel.org Reviewed-by: Bharath SM Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 35235e19b393b54db0e0d7c424d658ba45f20468 Author: Kees Cook Date: Tue Feb 14 16:09:45 2023 -0800 cifs: Replace remaining 1-element arrays The kernel is globally removing the ambiguous 0-length and 1-element arrays in favor of flexible arrays, so that we can gain both compile-time and run-time array bounds checking[1]. Replace the trailing 1-element array with a flexible array in the following structures: struct cifs_spnego_msg struct cifs_quota_data struct get_dfs_referral_rsp struct file_alt_name_info NEGOTIATE_RSP SESSION_SETUP_ANDX TCONX_REQ TCONX_RSP TCONX_RSP_EXT ECHO_REQ ECHO_RSP OPEN_REQ OPENX_REQ LOCK_REQ RENAME_REQ COPY_REQ COPY_RSP NT_RENAME_REQ DELETE_FILE_REQ DELETE_DIRECTORY_REQ CREATE_DIRECTORY_REQ QUERY_INFORMATION_REQ SETATTR_REQ TRANSACT_IOCTL_REQ TRANSACT_CHANGE_NOTIFY_REQ TRANSACTION2_QPI_REQ TRANSACTION2_SPI_REQ TRANSACTION2_FFIRST_REQ TRANSACTION2_GET_DFS_REFER_REQ FILE_UNIX_LINK_INFO FILE_DIRECTORY_INFO FILE_FULL_DIRECTORY_INFO SEARCH_ID_FULL_DIR_INFO FILE_BOTH_DIRECTORY_INFO FIND_FILE_STANDARD_INFO Replace the trailing 1-element array with a flexible array, but leave the existing structure padding: FILE_ALL_INFO FILE_UNIX_INFO Remove unused structures: struct gea struct gealist Adjust all related size calculations to match the changes to sizeof(). No machine code output differences are produced after these changes. [1] For lots of details, see both: https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays https://people.kernel.org/kees/bounded-flexible-arrays-in-c Cc: Steve French Cc: Paulo Alcantara Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Kees Cook Signed-off-by: Steve French commit 398d5843c03261a2b68730f2f00643826bcec6ba Author: Kees Cook Date: Tue Feb 14 16:08:39 2023 -0800 cifs: Convert struct fealist away from 1-element array The kernel is globally removing the ambiguous 0-length and 1-element arrays in favor of flexible arrays, so that we can gain both compile-time and run-time array bounds checking[1]. While struct fealist is defined as a "fake" flexible array (via a 1-element array), it is only used for examination of the first array element. Walking the list is performed separately, so there is no reason to treat the "list" member of struct fealist as anything other than a single entry. Adjust the struct and code to match. Additionally, struct fea uses the "name" member either as a dynamic string, or is manually calculated from the start of the struct. Redefine the member as a flexible array. No machine code output differences are produced after these changes. [1] For lots of details, see both: https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays https://people.kernel.org/kees/bounded-flexible-arrays-in-c Cc: Steve French Cc: Paulo Alcantara Cc: Ronnie Sahlberg Cc: Shyam Prasad N Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Kees Cook Signed-off-by: Steve French commit d99e86ebde2d7b3a04190f8d14de5bf6814bf10f Author: Paulo Alcantara Date: Thu Feb 16 15:33:22 2023 -0300 cifs: fix mount on old smb servers The client was sending rfc1002 session request packet with a wrong length field set, therefore failing to mount shares against old SMB servers over port 139. Fix this by calculating the correct length as specified in rfc1002. Fixes: d7173623bf0b ("cifs: use ALIGN() and round_up() macros") Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French commit de036dcaca65cf94bf7ff09c571c077f02bc92b4 Author: Volker Lendecke Date: Wed Jan 11 12:37:58 2023 +0100 cifs: Fix uninitialized memory reads for oparms.mode Use a struct assignment with implicit member initialization Signed-off-by: Volker Lendecke Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 5574920c7a6b0ce7f3d0888ccf1efb9b7870b928 Author: Namjae Jeon Date: Wed Feb 8 18:34:37 2023 +0900 cifs: remove unneeded 2bytes of padding from smb2 tree connect Due to the 2bytes of padding from the smb2 tree connect request, there is an unneeded difference between the rfc1002 length and the actual frame length. In the case of windows client, it is sent by matching it exactly. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 225a05043cd87a37455bfbff8c35d4e276519387 Author: Matthew Wilcox (Oracle) Date: Wed Feb 8 14:56:11 2023 +0000 filemap: Remove lock_page_killable() There are no more callers; remove this function before any more appear. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: David Howells Signed-off-by: Steve French commit c191bc070eba9cbbd166322cad293dd09c48c78e Author: Matthew Wilcox (Oracle) Date: Wed Feb 8 14:56:10 2023 +0000 cifs: Use a folio in cifs_page_mkwrite() Avoids many calls to compound_head() and removes calls to various compat functions. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: David Howells Signed-off-by: Steve French commit d447e794a37288ec7a080aa1b044a8d9deebbab7 Author: Volker Lendecke Date: Wed Jan 11 12:37:58 2023 +0100 cifs: Fix uninitialized memory read in smb3_qfs_tcon() oparms was not fully initialized Signed-off-by: Volker Lendecke Reviewed-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 3891f6c7655a39065e44980f51ba46bb32be3133 Author: Stefan Metzmacher Date: Wed Feb 1 16:21:41 2023 +0100 cifs: don't try to use rdma offload on encrypted connections The aim of using encryption on a connection is to keep the data confidential, so we must not use plaintext rdma offload for that data! It seems that current windows servers and ksmbd would allow this, but that's no reason to expose the users data in plaintext! And servers hopefully reject this in future. Note modern windows servers support signed or encrypted offload, see MS-SMB2 2.2.3.1.6 SMB2_RDMA_TRANSFORM_CAPABILITIES, but we don't support that yet. Signed-off-by: Stefan Metzmacher Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit a6559cc1d35d3eeafb0296aca347b2f745a28a74 Author: Stefan Metzmacher Date: Wed Feb 1 16:21:40 2023 +0100 cifs: split out smb3_use_rdma_offload() helper We should have the logic to decide if we want rdma offload in a single spot in order to advance it in future. Signed-off-by: Stefan Metzmacher Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit d643a8a446fc46c06837d08a056f69da2ff16025 Author: Stefan Metzmacher Date: Wed Feb 1 16:21:39 2023 +0100 cifs: introduce cifs_io_parms in smb2_async_writev() This will simplify the following changes and makes it easy to get in passed in from the caller in future. Signed-off-by: Stefan Metzmacher Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 89542781737a783d94ace958548caa0651bfbc5e Author: Paulo Alcantara Date: Tue Jan 31 13:22:07 2023 -0300 cifs: get rid of unneeded conditional in cifs_get_num_sgs() Just have @skip set to 0 after first iterations of the two nested loops. Signed-off-by: Paulo Alcantara (SUSE) Reviewed-by: David Howells Signed-off-by: Steve French commit 3c0070f54b3128de498c2dd9934a21f0dd867111 Author: Paulo Alcantara Date: Mon Jan 30 20:33:29 2023 -0300 cifs: prevent data race in smb2_reconnect() Make sure to get an up-to-date TCP_Server_Info::nr_targets value prior to waiting the server to be reconnected in smb2_reconnect(). It is set in cifs_tcp_ses_needs_reconnect() and protected by TCP_Server_Info::srv_lock. Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 77e3f338df79b4584ec4a518e43db38455a6dfb3 Author: Steve French Date: Mon Jan 30 19:32:52 2023 -0600 cifs: fix indentation in make menuconfig options The options that are displayed for the smb3.1.1/cifs client in "make menuconfig" are confusing because some of them are not indented making them not appear to be related to cifs.ko Fix that by adding an if/endif (similar to what ceph and 9pm did) if fs/cifs/Kconfig Suggested-by: David Howells Signed-off-by: Steve French commit ed2f1d9cea0b3b6aef0f3eabf8072f9277de6831 Author: Steve French Date: Mon Jan 30 18:57:06 2023 -0600 cifs: update Kconfig description There were various outdated or missing things in fs/cifs/Kconfig e.g. mention of support for insecure NTLM which has been removed, and lack of mention of some important features. This also shortens it slightly, and fixes some confusing text (e.g. the SMB1 POSIX extensions option). Reviewed-by: Namjae Jeon Acked-by: Paulo Alcantara (SUSE) Acked-by: Ronnie Sahlberg Signed-off-by: Steve French commit d4fba63fe1f78dba749cf7aa04c1dff4b8666eb1 Author: Andy Shevchenko Date: Fri Jan 20 14:08:57 2023 +0200 cifs: Get rid of unneeded conditional in the smb2_get_aead_req() In the smb2_get_aead_req() the skip variable is used only for the very first iteration of the two nested loops, which means it's basically in invariant to those loops. Hence, instead of using conditional on each iteration, unconditionally assign the 'skip' variable before the loops and at the end of the inner loop. Signed-off-by: Andy Shevchenko Reviewed-by: Paulo Alcantara (SUSE) Reviewed-by: David Howells Signed-off-by: Steve French commit 05844bd661d9fd478df1175b6639bf2d9398becb Author: Shyam Prasad N Date: Fri Dec 23 10:41:25 2022 +0000 cifs: print last update time for interface list We store the last updated time for interface list while parsing the interfaces. This change is to just print that info in DebugData. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 4e551dbdba7015b67f1e7db25a10954d5dc2d123 Author: Gustavo A. R. Silva Date: Mon Jan 9 19:39:00 2023 -0600 cifs: Replace zero-length arrays with flexible-array members Zero-length arrays are deprecated[1] and we are moving towards adopting C99 flexible-array members instead. So, replace zero-length arrays in a couple of structures with flex-array members. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [2]. Link: https://www.kernel.org/doc/html/latest/process/deprecated.html#zero-length-and-one-element-arrays [1] Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [2] Link: https://github.com/KSPP/linux/issues/78 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Reviewed-by: Paulo Alcantara Signed-off-by: Steve French commit 9f5d1a8cf8a137c4be180560b796e73b2707e337 Author: Christophe JAILLET Date: Sat Jan 14 09:58:15 2023 +0100 cifs: Use kstrtobool() instead of strtobool() strtobool() is the same as kstrtobool(). However, the latter is more used within the kernel. In order to remove strtobool() and slightly simplify kstrtox.h, switch to the other function name. While at it, include the corresponding header file () Signed-off-by: Christophe JAILLET Reviewed-by: Paulo Alcantara Signed-off-by: Steve French commit d644c670ef24189a93945528720ed545d77dc514 Merge: c9c3395d5e3dc 816477edfba6e Author: Linus Torvalds Date: Mon Feb 20 09:27:39 2023 -0800 Merge tag 'remove-get_kernel_pages-for-6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee Pull TEE update from Jens Wiklander: "Remove get_kernel_pages() Vmalloc page support is removed from shm_get_kernel_pages() and the get_kernel_pages() call is replaced by calls to get_page(). With no remaining callers of get_kernel_pages() the function is removed" [ This looks like it's just some random 'tee' cleanup, but the bigger picture impetus for this is really to to to remove historical confusion with mixed use of kernel virtual addresses and 'struct page' pointers. Kernel virtual pointers in the vmalloc space is then particularly confusing - both for looking up a page pointer (when trying to then unify a "virtual address or page" interface) and _particularly_ when mixed with HIGHMEM support and the kmap*() family of remapping. This is particularly true with HIGHMEM getting much less test coverage with 32-bit architectures being increasingly legacy targets. So we actively wanted to remove get_kernel_pages() to make sure nobody else used it too, and thus the 'tee' part is "finally remove last user". See also commit 6647e76ab623 ("v4l2: don't fall back to follow_pfn() if pin_user_pages_fast() fails") for a totally different version of a conceptually similar "let's stop this confusion of different ways of referring to memory". - Linus ] * tag 'remove-get_kernel_pages-for-6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee: mm: Remove get_kernel_pages() tee: Remove call to get_kernel_pages() tee: Remove vmalloc page support highmem: Enhance is_kmap_addr() to check kmap_local_page() mappings commit d695e44157c8da8d298295d1905428fb2495bc8b Author: XU pengfei Date: Fri Feb 17 09:14:21 2023 +0800 dm: remove unnecessary (void*) conversion in event_callback() Pointer variables of void * type do not require type cast. Signed-off-by: XU pengfei Signed-off-by: Mike Snitzer commit 7dc8e24f0e09834341f84d37433840b353d64bc8 Author: Masami Hiramatsu (Google) Date: Fri Jan 20 18:16:16 2023 +0900 ktest: Restore stty setting at first in dodie The do_send_email() will call die before restoring stty if sendmail setting is not correct or sendmail is not installed. It is safer to restore it in the beginning of dodie(). Link: https://lkml.kernel.org/r/167420617635.2988775.13045295332829029437.stgit@devnote3 Cc: John 'Warthog9' Hawley Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt commit 4e7d2a8f0b52abf23b1dc13b3d88bc0923383cd5 Author: Steven Rostedt Date: Wed Jan 18 16:37:25 2023 -0500 ktest.pl: Add RUN_TIMEOUT option with default unlimited There is a disconnect between the run_command function and the wait_for_input. The wait_for_input has a default timeout of 2 minutes. But if that happens, the run_command loop will exit out to the waitpid() of the executing command. This fails in that it no longer monitors the command, and also, the ssh to the test box can hang when its finished, as it's waiting for the pipe it's writing to to flush, but the loop that reads that pipe has already exited, leaving the command stuck, and the test hangs. Instead, make the default "wait_for_input" of the run_command infinite, and allow the user to override it if they want with a default timeout option "RUN_TIMEOUT". But this fixes the hang that happens when the pipe is full and the ssh session never exits. Cc: stable@vger.kernel.org Fixes: 6e98d1b4415fe ("ktest: Add timeout to ssh command") Signed-off-by: Steven Rostedt commit 83d29d439cd3ef23041570d55841f814af2ecac0 Author: Steven Rostedt Date: Wed Jan 18 16:32:13 2023 -0500 ktest.pl: Give back console on Ctrt^C on monitor When monitoring the console output, the stdout is being redirected to do so. If Ctrl^C is hit during this mode, the stdout is not back to the console, the user does not see anything they type (no echo). Add "end_monitor" to the SIGINT interrupt handler to give back the console on Ctrl^C. Cc: stable@vger.kernel.org Fixes: 9f2cdcbbb90e7 ("ktest: Give console process a dedicated tty") Signed-off-by: Steven Rostedt commit e8bf9b98d40dbdf4e39362e3b85a70c61da68cb7 Author: Steven Rostedt Date: Wed Jan 18 11:31:25 2023 -0500 ktest.pl: Fix missing "end_monitor" when machine check fails In the "reboot" command, it does a check of the machine to see if it is still alive with a simple "ssh echo" command. If it fails, it will assume that a normal "ssh reboot" is not possible and force a power cycle. In this case, the "start_monitor" is executed, but the "end_monitor" is not, and this causes the screen will not be given back to the console. That is, after the test, a "reset" command needs to be performed, as "echo" is turned off. Cc: stable@vger.kernel.org Fixes: 6474ace999edd ("ktest.pl: Powercycle the box on reboot if no connection can be made") Signed-off-by: Steven Rostedt commit d0566564d483e6576868224286632fd95aafd4ac Author: Axel Lin Date: Mon Feb 20 18:56:14 2023 +0800 regulator: max597x: Fix error return code in max597x_get_status REGULATOR_FAILED_RETRY should not be used in max597x_get_status error path. Othewise, the regulator core will treat it as REGULATOR_STATUS_ON. Signed-off-by: Axel Lin Link: https://lore.kernel.org/r/20230220105614.356187-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit 7e43b75d6a062197b3bf39ddd1b10ce2e2d2a9b0 Author: Dharageswari.R Date: Mon Feb 20 10:06:52 2023 +0200 ASoC: Intel: sof_rt5682: Add quirk for Rex board with mx98360a amplifier Add mtl_mx98360a_rt5682 driver data for Chrome Rex board support. Signed-off-by: Dharageswari.R Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230220080652.23136-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 70d1d30355095a22c8aa98dba9ca12486deff020 Author: Trevor Wu Date: Wed Feb 15 20:50:16 2023 +0800 ASoC: mediatek: mt8188: correct etdm control return value In mt8188_etdm_clk_src_sel_put() function, val retrieved by FIELD_PREP is shifted to the corresponding bit filed, so it can compare with the register value directly. Originally, the redundant bit shift of the register value results in the wrong comparison result, so we remove bit shift operation in the patch. Fixes: 2babb4777489 ("ASoC: mediatek: mt8188: support etdm in platform driver") Signed-off-by: Trevor Wu Link: https://lore.kernel.org/r/20230215125017.16044-1-trevor.wu@mediatek.com Signed-off-by: Mark Brown commit 51c58a1ebc047acc4ac2a61a5f215c7a638a685b Author: Kiseok Jo Date: Fri Feb 17 00:44:03 2023 +0000 ASoC: SMA1303: Change the value for right output This device can output mono, left or right. LR data should be swapped to output right data. Signed-off-by: Kiseok Jo Link: https://lore.kernel.org/r/20230217004403.10220-1-kiseok.jo@irondevice.com Signed-off-by: Mark Brown commit 4b471a8b847b82a3035709dcf87661915c340c8a Author: Chuck Lever Date: Tue Feb 14 10:19:30 2023 -0500 NFSD: Clean up nfsd_symlink() The pointer dentry is assigned a value that is never read, the assignment is redundant and can be removed. Cleans up clang-scan warning: fs/nfsd/nfsctl.c:1231:2: warning: Value stored to 'dentry' is never read [deadcode.DeadStores] dentry = ERR_PTR(ret); No need to initialize "int ret = -ENOMEM;" either. These are vestiges of nfsd_mkdir(), from whence I copied nfsd_symlink(). Reported-by: Colin Ian King Reported-by: Dan Carpenter Signed-off-by: Chuck Lever commit 90d2175572470ba7f55da8447c72ddd4942923c4 Author: Chuck Lever Date: Tue Feb 14 10:07:59 2023 -0500 NFSD: copy the whole verifier in nfsd_copy_write_verifier Currently, we're only memcpy'ing the first __be32. Ensure we copy into both words. Fixes: 91d2e9b56cf5 ("NFSD: Clean up the nfsd_net::nfssvc_boot field") Reported-by: Jeff Layton Signed-off-by: Chuck Lever commit 4c475eee02375ade6e864f1db16976ba0d96a0a2 Author: Jeff Layton Date: Tue Feb 7 12:02:46 2023 -0500 nfsd: don't fsync nfsd_files on last close Most of the time, NFSv4 clients issue a COMMIT before the final CLOSE of an open stateid, so with NFSv4, the fsync in the nfsd_file_free path is usually a no-op and doesn't block. We have a customer running knfsd over very slow storage (XFS over Ceph RBD). They were using the "async" export option because performance was more important than data integrity for this application. That export option turns NFSv4 COMMIT calls into no-ops. Due to the fsync in this codepath however, their final CLOSE calls would still stall (since a CLOSE effectively became a COMMIT). I think this fsync is not strictly necessary. We only use that result to reset the write verifier. Instead of fsync'ing all of the data when we free an nfsd_file, we can just check for writeback errors when one is acquired and when it is freed. If the client never comes back, then it'll never see the error anyway and there is no point in resetting it. If an error occurs after the nfsd_file is removed from the cache but before the inode is evicted, then it will reset the write verifier on the next nfsd_file_acquire, (since there will be an unseen error). The only exception here is if something else opens and fsyncs the file during that window. Given that local applications work with this limitation today, I don't see that as an issue. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2166658 Fixes: ac3a2585f018 ("nfsd: rework refcounting in filecache") Reported-and-tested-by: Pierguido Lambri Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 2172e84ea00b0164666cf8de971c8b8b02a5938b Author: Chuck Lever Date: Sun Feb 5 11:58:44 2023 -0500 SUNRPC: Fix occasional warning when destroying gss_krb5_enctypes I'm guessing that the warning fired because there's some code path that is called on module unload where the gss_krb5_enctypes file was never set up. name 'gss_krb5_enctypes' WARNING: CPU: 0 PID: 6187 at fs/proc/generic.c:712 remove_proc_entry+0x38d/0x460 fs/proc/generic.c:712 destroy_krb5_enctypes_proc_entry net/sunrpc/auth_gss/svcauth_gss.c:1543 [inline] gss_svc_shutdown_net+0x7d/0x2b0 net/sunrpc/auth_gss/svcauth_gss.c:2120 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 setup_net+0x9bd/0xe60 net/core/net_namespace.c:356 copy_net_ns+0x320/0x6b0 net/core/net_namespace.c:483 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 copy_namespaces+0x410/0x500 kernel/nsproxy.c:179 copy_process+0x311d/0x76b0 kernel/fork.c:2272 kernel_clone+0xeb/0x9a0 kernel/fork.c:2684 __do_sys_clone+0xba/0x100 kernel/fork.c:2825 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Reported-by: syzbot+04a8437497bcfb4afa95@syzkaller.appspotmail.com Signed-off-by: Chuck Lever commit dcd779dc46540e174a6ac8d52fbed23593407317 Author: Jeff Layton Date: Fri Feb 3 13:18:34 2023 -0500 nfsd: fix courtesy client with deny mode handling in nfs4_upgrade_open The nested if statements here make no sense, as you can never reach "else" branch in the nested statement. Fix the error handling for when there is a courtesy client that holds a conflicting deny mode. Fixes: 3d6942715180 ("NFSD: add support for share reservation conflict to courteous server") Reported-by: 張智諺 Signed-off-by: Jeff Layton Reviewed-by: Dai Ngo Signed-off-by: Chuck Lever commit 81e722978ad21072470b73d8f6a50ad62c7d5b7d Author: Dai Ngo Date: Tue Jan 31 11:12:29 2023 -0800 NFSD: fix problems with cleanup on errors in nfsd4_copy When nfsd4_copy fails to allocate memory for async_copy->cp_src, or nfs4_init_copy_state fails, it calls cleanup_async_copy to do the cleanup for the async_copy which causes page fault since async_copy is not yet initialized. This patche rearranges the order of initializing the fields in async_copy and adds checks in cleanup_async_copy to skip un-initialized fields. Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy") Fixes: 87689df69491 ("NFSD: Shrink size of struct nfsd4_copy") Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 Author: Benjamin Coddington Date: Fri Jan 27 11:18:56 2023 -0500 nfsd: fix race to check ls_layouts Its possible for __break_lease to find the layout's lease before we've added the layout to the owner's ls_layouts list. In that case, setting ls_recalled = true without actually recalling the layout will cause the server to never send a recall callback. Move the check for ls_layouts before setting ls_recalled. Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 826b67e6376c2a788e3a62c4860dcd79500a27d5 Author: Jeff Layton Date: Fri Jan 27 07:09:33 2023 -0500 nfsd: don't hand out delegation on setuid files being opened for write We had a bug report that xfstest generic/355 was failing on NFSv4.0. This test sets various combinations of setuid/setgid modes and tests whether DIO writes will cause them to be stripped. What I found was that the server did properly strip those bits, but the client didn't notice because it held a delegation that was not recalled. The recall didn't occur because the client itself was the one generating the activity and we avoid recalls in that case. Clearing setuid bits is an "implicit" activity. The client didn't specifically request that we do that, so we need the server to issue a CB_RECALL, or avoid the situation entirely by not issuing a delegation. The easiest fix here is to simply not give out a delegation if the file is being opened for write, and the mode has the setuid and/or setgid bit set. Note that there is a potential race between the mode and lease being set, so we test for this condition both before and after setting the lease. This patch fixes generic/355, generic/683 and generic/684 for me. (Note that 355 fails only on v4.0, and 683 and 684 require NFSv4.2 to run and fail). Reported-by: Boyang Xue Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 319951eba0fc412a78a8fe3d2ee5e143cc318c14 Author: Chuck Lever Date: Tue Jan 24 15:40:22 2023 -0500 SUNRPC: Remove ->xpo_secure_port() There's no need for the cost of this extra virtual function call during every RPC transaction: the RQ_SECURE bit can be set properly in ->xpo_recvfrom() instead. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit fcebda5a5d0d53f5603e7b9c04b5b63abe4bac03 Author: Chuck Lever Date: Tue Jan 24 15:40:15 2023 -0500 SUNRPC: Clean up the svc_xprt_flags() macro Make this macro more conventional: - Use BIT() instead of open-coding " 1UL << " - Don't display the "XPT_" in every flag name Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4dbca1c3c6dd0f21b1b6c5898b7579d465d30468 Author: Jeff Layton Date: Tue Jan 24 11:45:38 2023 -0500 nfsd: remove fs/nfsd/fault_inject.c This file is no longer built at all. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 34e8f9ec4c9ac235f917747b23a200a5e0ec857b Author: Dai Ngo Date: Mon Jan 23 21:34:13 2023 -0800 NFSD: fix leaked reference count of nfsd4_ssc_umount_item The reference count of nfsd4_ssc_umount_item is not decremented on error conditions. This prevents the laundromat from unmounting the vfsmount of the source file. This patch decrements the reference count of nfsd4_ssc_umount_item on error. Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f Author: Jeff Layton Date: Tue Jan 17 14:38:31 2023 -0500 nfsd: clean up potential nfsd_file refcount leaks in COPY codepath There are two different flavors of the nfsd4_copy struct. One is embedded in the compound and is used directly in synchronous copies. The other is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup just involves releasing any nfsd_files held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unhash it, etc. There is at least one potential refcount leak in this code now. If the kthread_create call fails, then both the src and dst nfsd_files in the original nfsd4_copy object are leaked. The cleanup in this codepath is also sort of weird. In the async copy case, we'll have up to four nfsd_file references (src and dst for both flavors of copy structure). They are both put at the end of nfsd4_do_async_copy, even though the ones held on behalf of the embedded one outlive that structure. Change it so that we always clean up the nfsd_file refs held by the embedded copy structure before nfsd4_copy returns. Rework cleanup_async_copy to handle both inter and intra copies. Eliminate nfsd4_cleanup_intra_ssc since it now becomes a no-op. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d Author: Jeff Layton Date: Tue Jan 17 14:38:30 2023 -0500 nfsd: zero out pointers after putting nfsd_files on COPY setup error At first, I thought this might be a source of nfsd_file overputs, but the current callers seem to avoid an extra put when nfsd4_verify_copy returns an error. Still, it's "bad form" to leave the pointers filled out when we don't have a reference to them anymore, and that might lead to bugs later. Zero them out as a defensive coding measure. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit ecfa3987731b1ceb7964075cdc0235da1765622a Author: Chuck Lever Date: Wed Jan 18 10:45:36 2023 -0500 SUNRPC: Fix whitespace damage in svcauth_unix.c Signed-off-by: Chuck Lever commit edd2f5526ea87cf6fc66a08bc8a1fbb6022a502f Author: Jeff Layton Date: Wed Jan 18 12:31:39 2023 -0500 nfsd: eliminate __nfs4_get_fd This is wrapper is pointless, and just obscures what's going on. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit ee97e7301582e3100d396e1cf45c7f5a74c7be97 Author: Jeff Layton Date: Wed Jan 18 12:31:38 2023 -0500 nfsd: add some kerneldoc comments for stateid preprocessing functions Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 45ba66cc2ca22a492fb16474d1af804388757a35 Author: Jeff Layton Date: Wed Jan 18 12:31:35 2023 -0500 nfsd: eliminate find_deleg_file_locked We really don't need an accessor function here. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit fcb530973b3c48099108e6e2e7433db9188f7eeb Author: Jeff Layton Date: Wed Jan 18 12:31:34 2023 -0500 nfsd: don't take nfsd4_copy ref for OP_OFFLOAD_STATUS We're not doing any blocking operations for OP_OFFLOAD_STATUS, so taking and putting a reference is a waste of effort. Take the client lock, search for the copy and fetch the wr_bytes_written field and return. Also, make find_async_copy a static function. Signed-off-by: Jeff Layton Reviewed-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit c4a9f0552cf682489d370adccf2f3ee11a8ff272 Author: Chuck Lever Date: Sun Jan 15 12:24:38 2023 -0500 SUNRPC: Add encryption self-tests With the KUnit infrastructure recently added, we are free to define other unit tests particular to our implementation. As an example, I've added a self-test that encrypts then decrypts a string, and checks the result. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 4d2d15c0f1e05ef2478d4891b79570a87c5dd1a6 Author: Chuck Lever Date: Sun Jan 15 12:24:31 2023 -0500 SUNRPC: Add RFC 8009 encryption KUnit tests RFC 8009 provides sample encryption results. Add KUnit tests to ensure our implementation derives the expected results for the provided sample input. I hate how large this test is, but using non-standard key usage values means rfc8009_encrypt_case() can't simply reuse ->import_ctx to allocate and key its ciphers; and the test provides its own confounders, which means krb5_etm_encrypt() can't be used directly. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 003caf4f8c6af53ac48759669f0bd0dd7f69e6f5 Author: Chuck Lever Date: Sun Jan 15 12:24:25 2023 -0500 SUNRPC: Add RFC 8009 checksum KUnit tests RFC 8009 provides sample checksum results. Add KUnit tests to ensure our implementation derives the expected results for the provided sample input. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit fcbad14b585d706337f16300747069b34c77e630 Author: Chuck Lever Date: Sun Jan 15 12:24:18 2023 -0500 SUNRPC: Add KDF-HMAC-SHA2 Kunit tests RFC 8009 provides sample key derivation results, so Kunit tests are added to ensure our implementation derives the expected keys for the provided sample input. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit b958cff6b27b763b824ed6eefb28979d8f459bf4 Author: Chuck Lever Date: Sun Jan 15 12:24:12 2023 -0500 SUNRPC: Add encryption KUnit tests for the RFC 6803 encryption types Add tests for the new-to-RPCSEC Camellia cipher. Tested-by: Scott Mayhew Signed-off-by: Chuck Lever commit 02142b2ca8fc10d7771b650780ae082369632dc0 Author: Chuck Lever Date: Sun Jan 15 12:24:06 2023 -0500 SUNRPC: Add checksum KUnit tests for the RFC 6803 encryption types Test the new-to-RPCSEC CMAC digest algorithm. Tested-by: Scott Mayhew Signed-off-by: Chuck Lever commit 35f6e42e813e51fb3a40f74f23a99aa330254ce8 Author: Chuck Lever Date: Sun Jan 15 12:23:59 2023 -0500 SUNRPC: Add KDF KUnit tests for the RFC 6803 encryption types The Camellia enctypes use a new KDF, so add some tests to ensure it is working properly. Tested-by: Scott Mayhew Signed-off-by: Chuck Lever commit e1a9a3849dff9cd980fdccaa8f09cf9226f46a3a Author: Chuck Lever Date: Sun Jan 15 12:23:53 2023 -0500 SUNRPC: Add Kunit tests for RFC 3962-defined encryption/decryption Add Kunit tests for ENCTYPE_AES128_CTS_HMAC_SHA1_96. The test vectors come from RFC 3962 Appendix B. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 6eb6b8a446a174586427d1a0ab0f7635b05b44f7 Author: Chuck Lever Date: Sun Jan 15 12:23:47 2023 -0500 SUNRPC: Add KUnit tests RFC 3961 Key Derivation RFC 3961 Appendix A provides tests for the KDF specified in that document as well as other parts of Kerberos. The other three usage scenarios in Section 10 are not implemented by the Linux kernel's RPCSEC GSS Kerberos 5 mechanism, so tests are not added for those. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit ddd8c1f975ee7c2fc60ea836540b5b10f97ac919 Author: Chuck Lever Date: Sun Jan 15 12:23:40 2023 -0500 SUNRPC: Export get_gss_krb5_enctype() I plan to add KUnit tests that will need enctype profile information. Export the enctype profile lookup function. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit eebd8c2d1978f5cb6e76e4e3045220b67548cb79 Author: Chuck Lever Date: Sun Jan 15 12:23:34 2023 -0500 SUNRPC: Add KUnit tests for rpcsec_krb5.ko The Kerberos RFCs provide test vectors to verify the operation of an implementation. Introduce a KUnit test framework to exercise the Linux kernel's implementation of Kerberos. Start with test cases for the RFC 3961-defined n-fold function. The sample vectors for that are found in RFC 3961 Section 10. Run the GSS Kerberos 5 mechanism's unit tests with this command: $ ./tools/testing/kunit/kunit.py run \ --kunitconfig ./net/sunrpc/.kunitconfig Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 6e460c230d2dfb0e5a02b6e0995546bb4b9d208e Author: Chuck Lever Date: Sun Jan 15 12:23:27 2023 -0500 SUNRPC: Move remaining internal definitions to gss_krb5_internal.h The goal is to leave only protocol-defined items in gss_krb5.h so that it can be easily replaced by a generic header. Implementation specific items are moved to the new internal header. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 6e6d9eee0e78b3d13018e0eb28102b67ad5a8e86 Author: Chuck Lever Date: Sun Jan 15 12:23:21 2023 -0500 SUNRPC: Advertise support for the Camellia encryption types Add the RFC 6803 encryption types to the string of integers that is reported to gssd during upcalls. This enables gssd to utilize keys with these encryption types when support for them is built into the kernel. Tested-by: Scott Mayhew Signed-off-by: Chuck Lever commit 45b4ef46b5e88ced7edd4fba26b5fa0e3103de0b Author: Chuck Lever Date: Sun Jan 15 12:23:15 2023 -0500 SUNRPC: Add KDF_FEEDBACK_CMAC The Camellia enctypes use the KDF_FEEDBACK_CMAC Key Derivation Function defined in RFC 6803 Section 3. Tested-by: Scott Mayhew Signed-off-by: Chuck Lever commit 3394682fba3b9010c6147e94f37633f044876e5e Author: Chuck Lever Date: Sun Jan 15 12:23:08 2023 -0500 SUNRPC: Support the Camellia enctypes RFC 6803 defines two encryption types that use Camellia ciphers (RFC 3713) and CMAC digests. Implement support for those in SunRPC's GSS Kerberos 5 mechanism. There has not been an explicit request to support these enctypes. However, this new set of enctypes provides a good alternative to the AES-SHA1 enctypes that are to be deprecated at some point. As this implementation is still a "beta", the default is to not build it automatically. Tested-by: Scott Mayhew Signed-off-by: Chuck Lever commit f26ec6b1b15c5d84e4c8e5b361e2be119def498d Author: Chuck Lever Date: Sun Jan 15 12:23:02 2023 -0500 SUNRPC: Advertise support for RFC 8009 encryption types Add the RFC 8009 encryption types to the string of integers that is reported to gssd during upcalls. This enables gssd to utilize keys with these encryption types when support for them is built into the kernel. Link: https://bugzilla.linux-nfs.org/show_bug.cgi?id=400 Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 0d5b5a0f32dfc9be3521803aba53e856759f0250 Author: Chuck Lever Date: Sun Jan 15 12:22:56 2023 -0500 SUNRPC: Add RFC 8009 encryption and decryption functions RFC 8009 enctypes use different crypt formulae than previous Kerberos 5 encryption types. Section 1 of RFC 8009 explains the reason for this change: > The new types conform to the framework specified in [RFC3961], > but do not use the simplified profile, as the simplified profile > is not compliant with modern cryptographic best practices such as > calculating Message Authentication Codes (MACs) over ciphertext > rather than plaintext. Add new .encrypt and .decrypt functions to handle this variation. The new approach described above is referred to as Encrypt-then-MAC (or EtM). Hence the names of the new functions added here are prefixed with "krb5_etm_". A critical second difference with previous crypt formulae is that the cipher state is included in the computed HMAC. Note however that for RPCSEC, the initial cipher state is easy to compute on both initiator and acceptor because it is always all zeroes. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit ae2e4d2bae0007b040e8327f123911c0a6b24d68 Author: Chuck Lever Date: Sun Jan 15 12:22:49 2023 -0500 SUNRPC: Add KDF-HMAC-SHA2 The RFC 8009 encryption types use a different key derivation function than the RFC 3962 encryption types. The new key derivation function is defined in Section 3 of RFC 8009. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit a40cf7530d3104793f9361e69e84ada7960724f2 Author: Chuck Lever Date: Sun Jan 15 12:22:43 2023 -0500 SUNRPC: Add gk5e definitions for RFC 8009 encryption types Fill in entries in the supported_gss_krb5_enctypes array for the encryption types defined in RFC 8009. These new enctypes use the SHA-256 and SHA-384 message digest algorithms (as defined in FIPS-180) instead of the deprecated SHA-1 algorithm, and are thus more secure. Note that NIST has scheduled SHA-1 for deprecation: https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm Thus these new encryption types are placed under a separate CONFIG option to enable distributors to separately introduce support for the AES-SHA2 enctypes and deprecate support for the current set of AES-SHA1 encryption types as their user space allows. As this implementation is still a "beta", the default is to not build it automatically. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit dfb632432a9b2548b5a4429598bb19edf58122f0 Author: Chuck Lever Date: Sun Jan 15 12:22:36 2023 -0500 SUNRPC: Refactor CBC with CTS into helpers Cryptosystem profile enctypes all use cipher block chaining with ciphertext steal (CBC-with-CTS). However enctypes that are currently supported in the Linux kernel SunRPC implementation use only the encrypt-&-MAC approach. The RFC 8009 enctypes use encrypt-then-MAC, which performs encryption and checksumming in a different order. Refactor to make it possible to share the CBC with CTS encryption and decryption mechanisms between e&M and etM enctypes. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit af664fc9023e69d1a90800c0f815c296bf727e18 Author: Chuck Lever Date: Sun Jan 15 12:22:30 2023 -0500 SUNRPC: Add new subkey length fields The aes256-cts-hmac-sha384-192 enctype specifies the length of its checksum and integrity subkeys as 192 bits, but the length of its encryption subkey (Ke) as 256 bits. Add new fields to struct gss_krb5_enctype that specify the key lengths individually, and where needed, use the correct new field instead of ->keylength. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 8b3a09f3454240cb2c2ab3da02b86f354aab0bd6 Author: Chuck Lever Date: Sun Jan 15 12:22:24 2023 -0500 SUNRPC: Parametrize the key length passed to context_v2_alloc_cipher() Although the Kerberos specs have always listed separate subkey lengths, the Linux kernel's SunRPC GSS Kerberos enctype profiles assume the base key and the derived keys have identical lengths. The aes256-cts-hmac-sha384-192 enctype specifies the length of its checksum and integrity subkeys as 192 bits, but the length of its encryption subkey (Ke) as 256 bits. To support that enctype, parametrize context_v2_alloc_cipher() so that each of its call sites can pass in its desired key length. For now it will be the same length as before (gk5e->keylength), but a subsequent patch will change this. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit ec4aaab39afcec749ff7ed78e560213ff9e1c23c Author: Chuck Lever Date: Sun Jan 15 12:22:17 2023 -0500 SUNRPC: Clean up cipher set up for v1 encryption types De-duplicate some common code. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 2691a27d9b3e6a48adeb87a9dcf4e8a0ca84a26e Author: Chuck Lever Date: Sun Jan 15 12:22:11 2023 -0500 SUNRPC: Hoist KDF into struct gss_krb5_enctype Each Kerberos enctype can have a different KDF. Refactor the key derivation path to support different KDFs for the enctypes introduced in subsequent patches. In particular, expose the key derivation function in struct gss_krb5_enctype instead of the enctype's preferred random-to-key function. The latter is usually the identity function and is only ever called during key derivation, so have each KDF call it directly. A couple of extra clean-ups: - Deduplicate the set_cdata() helper - Have ->derive_key return negative errnos, in accordance with usual kernel coding conventions This patch is a little bigger than I'd like, but these are all mechanical changes and they are all to the same areas of code. No behavior change is intended. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit ae6ad5d0b7901b301234143e93624417ac9fd9ef Author: Chuck Lever Date: Sun Jan 15 12:22:04 2023 -0500 SUNRPC: Rename .encrypt_v2 and .decrypt_v2 methods Clean up: there is now only one encrypt and only one decrypt method, thus there is no longer a need for the v2-suffixed method names. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit d50b8152c992ac88c5f1f0cc8ade6ee0aa0a3704 Author: Chuck Lever Date: Sun Jan 15 12:21:58 2023 -0500 SUNRPC: Remove ->encrypt and ->decrypt methods from struct gss_krb5_enctype Clean up: ->encrypt is set to only one value. Replace the two remaining call sites with direct calls to krb5_encrypt(). There have never been any call sites for the ->decrypt() method. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit dfe9a123451a6e73306c988eab3dab12df001677 Author: Chuck Lever Date: Sun Jan 15 12:21:52 2023 -0500 SUNRPC: Enable rpcsec_gss_krb5.ko to be built without CRYPTO_DES Because the DES block cipher has been deprecated by Internet standard, highly secure configurations might require that DES support be blacklisted or not installed. NFS Kerberos should still be able to work correctly with only the AES-based enctypes in that situation. Also note that MIT Kerberos has begun a deprecation process for DES encryption types. Their README for 1.19.3 states: > Beginning with the krb5-1.19 release, a warning will be issued > if initial credentials are acquired using the des3-cbc-sha1 > encryption type. In future releases, this encryption type will > be disabled by default and eventually removed. > > Beginning with the krb5-1.18 release, single-DES encryption > types have been removed. Aside from the CONFIG option name change, there are two important policy changes: 1. The 'insecure enctype' group is now disabled by default. Distributors have to take action to enable support for deprecated enctypes. Implementation of these enctypes will be removed in a future kernel release. 2. des3-cbc-sha1 is now considered part of the 'insecure enctype' group, having been deprecated by RFC 8429, and is thus disabled by default After this patch is applied, SunRPC support can be built with Kerberos 5 support but without CRYPTO_DES enabled in the kernel. And, when these enctypes are disabled, the Linux kernel's SunRPC RPCSEC GSS implementation fully complies with BCP 179 / RFC 6649 and BCP 218 / RFC 8429. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 17781b2ce41a8915163d7cdada021f809ccd49f0 Author: Chuck Lever Date: Sun Jan 15 12:21:45 2023 -0500 SUNRPC: Replace KRB5_SUPPORTED_ENCTYPES macro Now that all consumers of the KRB5_SUPPORTED_ENCTYPES macro are within the SunRPC layer, the macro can be replaced with something private and more flexible. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 4df750c924f405fe773771add507117a80ae6203 Author: Chuck Lever Date: Sun Jan 15 12:21:39 2023 -0500 NFSD: Replace /proc/fs/nfsd/supported_krb5_enctypes with a symlink Now that I've added a file under /proc/net/rpc that is managed by the SunRPC's Kerberos mechanism, replace NFSD's supported_krb5_enctypes file with a symlink to the new SunRPC proc file, which contains exactly the same content. Remarkably, commit b0b0c0a26e84 ("nfsd: add proc file listing kernel's gss_krb5 enctypes") added the nfsd_supported_krb5_enctypes file in 2011, but this file has never been documented in nfsd(7). Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit bdb12fb157d8d6aea7becbe6eaacf6c7c9b73f5e Author: Chuck Lever Date: Sun Jan 15 12:21:33 2023 -0500 SUNRPC: Add /proc/net/rpc/gss_krb5_enctypes file I would like to replace the KRB5_SUPPORTED_ENCTYPES macro so that there is finer granularity about what enctype support is built in to the kernel and then advertised by it. The /proc/fs/nfsd/supported_krb5_enctypes file is a legacy API that advertises supported enctypes to rpc.svcgssd (I think?). It simply prints the value of the KRB5_SUPPORTED_ENCTYPES macro, so it will need to be replaced with something that can instead display exactly which enctypes are configured and built into the SunRPC layer. Completely decommissioning such APIs is hard. Instead, add a file that is managed by SunRPC's GSS Kerberos mechanism, which is authoritative about enctype support status. A subsequent patch will replace /proc/fs/nfsd/supported_krb5_enctypes with a symlink to this new file. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 279a67cdd491a53028eb0b52508383098c6d992b Author: Chuck Lever Date: Sun Jan 15 12:21:26 2023 -0500 SUNRPC: Remove another switch on ctx->enctype Replace another switch on encryption type so that it does not have to be modified when adding or removing support for an enctype. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit e01b2c79f4af1298b961116aba3e64367fe73286 Author: Chuck Lever Date: Sun Jan 15 12:21:20 2023 -0500 SUNRPC: Refactor the GSS-API Per Message calls in the Kerberos mechanism Replace a number of switches on encryption type so that all of them don't have to be modified when adding or removing support for an enctype. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 8270dbfcebea5b68037a84ad1710e2cfa499b82f Author: Chuck Lever Date: Sun Jan 15 12:21:13 2023 -0500 SUNRPC: Obscure Kerberos integrity keys There's no need to keep the integrity keys around if we instead allocate and key a pair of ahashes and keep those. This not only enables the subkeys to be destroyed immediately after deriving them, but it makes the Kerberos integrity code path more efficient. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 2dbe0cac3cd6d747579b0b347145326eddfd4e5c Author: Chuck Lever Date: Sun Jan 15 12:21:07 2023 -0500 SUNRPC: Obscure Kerberos signing keys There's no need to keep the signing keys around if we instead allocate and key an ahash and keep that. This not only enables the subkeys to be destroyed immediately after deriving them, but it makes the Kerberos signing code path more efficient. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 9f0b49f933ab1ec5e7140a43eec72b0c5181cabf Author: Chuck Lever Date: Sun Jan 15 12:21:01 2023 -0500 SUNRPC: Obscure Kerberos encryption keys The encryption subkeys are not used after the cipher transforms have been allocated and keyed. There is no need to retain them in struct krb5_ctx. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 7989a4f4ab5437ec82b0b59984594f848f12b36a Author: Chuck Lever Date: Sun Jan 15 12:20:54 2023 -0500 SUNRPC: Refactor set-up for aux_cipher Hoist the name of the aux_cipher into struct gss_krb5_enctype to prepare for obscuring the encryption keys just after they are derived. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 01c4e326327a635e1fac75b1aedd2c2c1e8123b5 Author: Chuck Lever Date: Sun Jan 15 12:20:48 2023 -0500 SUNRPC: Obscure Kerberos session key ctx->Ksess is never used after import has completed. Obscure it immediately so it cannot be re-used or copied. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 7f675ca7757bfeb70e19d187dc3be44deb836da8 Author: Chuck Lever Date: Sun Jan 15 12:20:41 2023 -0500 SUNRPC: Improve Kerberos confounder generation Other common Kerberos implementations use a fully random confounder for encryption. The reason for this is explained in the new comment added by this patch. The current get_random_bytes() implementation does not exhaust system entropy. Since confounder generation is part of Kerberos itself rather than the GSS-API Kerberos mechanism, the function is renamed and moved. Note that light top-down analysis shows that the SHA-1 transform is by far the most CPU-intensive part of encryption. Thus we do not expect this change to result in a significant performance impact. However, eventually it might be necessary to generate an independent stream of confounders for each Kerberos context to help improve I/O parallelism. Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 4be416a5f2803d421c950cc48e8e0c1eaaa8c773 Author: Chuck Lever Date: Sun Jan 15 12:20:35 2023 -0500 SUNRPC: Remove .conflen field from struct gss_krb5_enctype Now that arcfour-hmac is gone, the confounder length is again the same as the cipher blocksize for every implemented enctype. The gss_krb5_enctype::conflen field is no longer necessary. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit f03640a1a9782f4bf7c1db63e2e6a9598c6d2c6e Author: Chuck Lever Date: Sun Jan 15 12:20:28 2023 -0500 SUNRPC: Remove .blocksize field from struct gss_krb5_enctype It is not clear from documenting comments, specifications, or code usage what value the gss_krb5_enctype.blocksize field is supposed to store. The "encryption blocksize" depends only on the cipher being used, so that value can be derived where it's needed instead of stored as a constant. RFC 3961 Section 5.2 says: > cipher block size, c > This is the block size of the block cipher underlying the > encryption and decryption functions indicated above, used for key > derivation and for the size of the message confounder and initial > vector. (If a block cipher is not in use, some comparable > parameter should be determined.) It must be at least 5 octets. > > This is not actually an independent parameter; rather, it is a > property of the functions E and D. It is listed here to clarify > the distinction between it and the message block size, m. In the Linux kernel's implemenation of the SunRPC RPCSEC GSS Kerberos 5 mechanism, the cipher block size, which is dependent on the encryption and decryption transforms, is used only in krb5_derive_key(), so it is straightforward to replace it. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit 97648b94bd9dbb987fe7e4067deecdb47d4fd7e7 Author: Chuck Lever Date: Sun Jan 15 12:20:22 2023 -0500 SUNRPC: Add header ifdefs to linux/sunrpc/gss_krb5.h Standard convention: Ensure the contents of the header are included only once per source file. Tested-by: Scott Mayhew Reviewed-by: Simo Sorce Signed-off-by: Chuck Lever commit ccf08bed6e7a80519569456edd2ea21b7b1701c6 Author: Chuck Lever Date: Tue Jan 10 10:32:00 2023 -0500 SUNRPC: Replace pool stats with per-CPU variables Eliminate the use of bus-locked operations in svc_xprt_enqueue(), which is a hot path. Replace them with per-cpu variables to reduce cross-CPU memory bus traffic. Signed-off-by: Chuck Lever commit 65ba3d2425bf51165b6e88509c632bd15d12883d Author: Chuck Lever Date: Tue Jan 10 10:31:54 2023 -0500 SUNRPC: Use per-CPU counters to tally server RPC counts - Improves counting accuracy - Reduces cross-CPU memory traffic Signed-off-by: Chuck Lever commit f5f9d4a314da88c0a5faa6d168bf69081b7a25ae Author: Jeff Layton Date: Wed Jan 11 11:19:59 2023 -0500 nfsd: move reply cache initialization into nfsd startup There's no need to start the reply cache before nfsd is up and running, and doing so means that we register a shrinker for every net namespace instead of just the ones where nfsd is running. Move it to the per-net nfsd startup instead. Reported-by: Dai Ngo Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit db1d61656c78ccbeaa1b8741301bcd85a953f4b2 Author: Chuck Lever Date: Sun Jan 8 11:31:11 2023 -0500 SUNRPC: Go back to using gsd->body_start Now that svcauth_gss_prepare_to_wrap() no longer computes the location of RPC header fields in the response buffer, svcauth_gss_accept() can save the location of the databody rather than the location of the verifier. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4bcf0343e8a69eb22f7e83bfa7cfce32a28c9d95 Author: Chuck Lever Date: Sun Jan 8 11:31:05 2023 -0500 SUNRPC: Set rq_accept_statp inside ->accept methods To navigate around the space that svcauth_gss_accept() reserves for the RPC payload body length and sequence number fields, svcauth_gss_release() does a little dance with the reply's accept_stat, moving the accept_stat value in the response buffer down by two words. Instead, let's have the ->accept() methods each set the proper final location of the accept_stat to avoid having to move things. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit cee4db19452467eef8ab93c6eb6a3a84d11d25d7 Author: Chuck Lever Date: Sun Jan 8 11:30:59 2023 -0500 SUNRPC: Refactor RPC server dispatch method Currently, svcauth_gss_accept() pre-reserves response buffer space for the RPC payload length and GSS sequence number before returning to the dispatcher, which then adds the header's accept_stat field. The problem is the accept_stat field is supposed to go before the length and seq_num fields. So svcauth_gss_release() has to relocate the accept_stat value (see svcauth_gss_prepare_to_wrap()). To enable these fields to be added to the response buffer in the correct (final) order, the pointer to the accept_stat has to be made available to svcauth_gss_accept() so that it can set it before reserving space for the length and seq_num fields. As a first step, move the pointer to the location of the accept_stat field into struct svc_rqst. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5df25676de2e13b2cb67140fd43bcbfdd60ef0df Author: Chuck Lever Date: Sun Jan 8 11:30:52 2023 -0500 SUNRPC: Remove no-longer-used helper functions The svc_get/put helpers are no longer used. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5f69d5f65a5468960291ff0c5dfe16b8072bab8a Author: Chuck Lever Date: Sun Jan 8 11:30:46 2023 -0500 SUNRPC: Final clean-up of svc_process_common() The @resv parameter is no longer used. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 649a692e0f2bc4a3b3a2a67aec30e53548930b97 Author: Chuck Lever Date: Sun Jan 8 11:30:40 2023 -0500 SUNRPC: Convert RPC Reply header encoding to use xdr_stream The main part of RPC header encoding and the formation of error responses are now done using the xdr_stream helpers. Bounds checking before each XDR data item is encoded makes the server's encoding path safer against accidental buffer overflows. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit fcef2afffe67db884f2970817b8e721d86df2986 Author: Chuck Lever Date: Sun Jan 8 11:30:34 2023 -0500 SUNRPC: Hoist init_encode out of svc_authenticate() Now that each ->accept method has been converted, the svcxdr_init_encode() calls can be hoisted back up into the generic RPC server code. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 72a1e53a8bf6aef0fa5b10d8327f23b5759040fe Author: Chuck Lever Date: Sun Jan 8 11:30:28 2023 -0500 SUNRPC: Use xdr_stream for encoding GSS reply verifiers Done as part of hardening the server-side RPC header encoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b2f42f1d999d2b5f33de4b7cba052e356a8e28c2 Author: Chuck Lever Date: Sun Jan 8 11:30:22 2023 -0500 SUNRPC: Use xdr_stream to encode replies in server-side GSS upcall helpers This code constructs replies to the decorated NULL procedure calls that establish GSS contexts. Convert this code path to use struct xdr_stream to encode such responses. Done as part of hardening the server-side RPC header encoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7bb0dfb2234725ba085cacfd35f34c187def92b2 Author: Chuck Lever Date: Sun Jan 8 11:30:15 2023 -0500 SUNRPC: Convert unwrap data paths to use xdr_stream for replies We're now moving svcxdr_init_encode() to /before/ the flavor's ->accept method has set rq_auth_slack. Add a helper that can set rq_auth_slack /after/ svcxdr_init_encode() has been called. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit df18f9ccb98a90e51d2d3527d880375db15b1fc8 Author: Chuck Lever Date: Sun Jan 8 11:30:09 2023 -0500 SUNRPC: Use xdr_stream to encode Reply verifier in svcauth_tls_accept() Done as part of hardening the server-side RPC header encoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3b03f3c5d4dbed658ef9a76c3475b2fb37d46451 Author: Chuck Lever Date: Sun Jan 8 11:30:03 2023 -0500 SUNRPC: Use xdr_stream to encode Reply verifier in svcauth_unix_accept() Done as part of hardening the server-side RPC header encoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b2c88ca65ac829a9570a491bcf1b78f07b1e3841 Author: Chuck Lever Date: Sun Jan 8 11:29:57 2023 -0500 SUNRPC: Use xdr_stream to encode Reply verifier in svcauth_null_accept() Done as part of hardening the server-side RPC header encoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit faca8978163bf8f6c0f3043b0f03cf3fe7bf9d64 Author: Chuck Lever Date: Sun Jan 8 11:29:51 2023 -0500 SUNRPC: Move svcxdr_init_encode() into ->accept methods Refactor: So that the overhaul of each ->accept method can be done in separate smaller patches, temporarily move the svcxdr_init_encode() call into those methods. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8dd41d70f331c342842e8d349d7a1f73b0ba7ccd Author: Chuck Lever Date: Sun Jan 8 11:29:44 2023 -0500 SUNRPC: Push svcxdr_init_encode() into svc_process_common() Now that all vs_dispatch functions invoke svcxdr_init_encode(), it is common code and can be pushed down into the generic RPC server. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7b402c8db66414abb4001d0c2676553baa619a2b Author: Chuck Lever Date: Sun Jan 8 11:29:38 2023 -0500 SUNRPC: Add XDR encoding helper for opaque_auth RFC 5531 defines an MSG_ACCEPTED Reply message like this: struct accepted_reply { opaque_auth verf; union switch (accept_stat stat) { case SUCCESS: ... In the current server code, struct opaque_auth encoding is open- coded. Introduce a helper that encodes an opaque_auth data item within the context of a xdr_stream. Done as part of hardening the server-side RPC header decoding and encoding paths. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6d037b15e43945144d5041db9e62c5f389bd432b Author: Chuck Lever Date: Sun Jan 8 11:29:32 2023 -0500 SUNRPC: Remove the rpc_stat variable in svc_process_common() There's no RPC header field called rpc_stat; more precisely, the variable appears to be recording an accept_stat value. But it looks like we don't need to preserve this value at all, actually, so simply remove the variable. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 99d074d6b135ae2927b6130d448f5b7159f8dbe1 Author: Chuck Lever Date: Sun Jan 8 11:29:26 2023 -0500 SUNRPC: Check rq_auth_stat when preparing to wrap a response Commit 5b304bc5bfcc ("[PATCH] knfsd: svcrpc: gss: fix failure on SVC_DENIED in integrity case") added a check to prevent wrapping an RPC response if reply_stat == MSG_DENIED, assuming that the only way to get to svcauth_gss_release() with that reply_stat value was if the reject_stat was AUTH_ERROR (reject_stat == MISMATCH is handled earlier in svc_process_common()). The code there is somewhat confusing. For one thing, rpc_success is an accept_stat value, not a reply_stat value. The correct reply_stat value to look for is RPC_MSG_DENIED. It happens to be the same value as rpc_success, so it all works out, but it's not terribly readable. Since commit 438623a06bac ("SUNRPC: Add svc_rqst::rq_auth_stat"), the actual auth_stat value is stored in the svc_rqst, so that value is now available to svcauth_gss_prepare_to_wrap() to make its decision to wrap, based on direct information about the authentication status of the RPC caller. No behavior change is intended, this simply replaces some old code with something that should be more self-documenting. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit eb1b780f2fad2abfcc4a32c6129a117effafff12 Author: Chuck Lever Date: Sun Jan 8 11:29:20 2023 -0500 SUNRPC: Convert svcauth_gss_wrap_priv() to use xdr_stream() Actually xdr_stream does not add value here because of how gss_wrap() works. This is just a clean-up patch. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a84cfbcd5acbb20bebe40aecf9601adf97b7787b Author: Chuck Lever Date: Sun Jan 8 11:29:14 2023 -0500 SUNRPC: Add @head and @tail variables in svcauth_gss_wrap_priv() Simplify the references to the head and tail iovecs for readability. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ba8b13e5f4303979440bc5c2a45b3d720b9c0b42 Author: Chuck Lever Date: Sun Jan 8 11:29:07 2023 -0500 SUNRPC: Record gss_wrap() errors in svcauth_gss_wrap_priv() Match the error reporting in the other unwrap and wrap functions. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7b135c65bb4544a5a1f72573b11adbcfc8aade9b Author: Chuck Lever Date: Sun Jan 8 11:29:01 2023 -0500 SUNRPC: Rename automatic variables in svcauth_gss_wrap_resp_priv() Clean up variable names to match the other unwrap and wrap functions. Additionally, the explicit type cast on @gsd in unnecessary; and @resbuf is renamed to match the variable naming in the unwrap functions. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 7702378ac4d4a3be6414408d274df92bdd078249 Author: Chuck Lever Date: Sun Jan 8 11:28:55 2023 -0500 SUNRPC: Convert svcauth_gss_wrap_integ() to use xdr_stream() Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d91f0323a0638688c96988a9daf3e5f6bfb4f5ed Author: Chuck Lever Date: Sun Jan 8 11:28:49 2023 -0500 SUNRPC: Replace checksum construction in svcauth_gss_wrap_integ() Replace finicky logic: Instead of trying to find scratch space in the response buffer, use the scratch buffer from struct gss_svc_data. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 15d8f80891bb4646ff213a9eae89732976396057 Author: Chuck Lever Date: Sun Jan 8 11:28:42 2023 -0500 SUNRPC: Record gss_get_mic() errors in svcauth_gss_wrap_integ() An error computing the checksum here is an exceptional event. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 0adaddd32f57559d1a94d1e00134d8124cdaa245 Author: Chuck Lever Date: Sun Jan 8 11:28:36 2023 -0500 SUNRPC: Rename automatic variables in svcauth_gss_wrap_resp_integ() Clean up: To help orient readers, name the stack variables to match the XDR field names. Additionally, the explicit type cast on @gsd is unnecessary; and @resbuf is renamed to match the variable naming in the unwrap functions. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5a92938309829cce26c03f62d908ae85209a52b3 Author: Chuck Lever Date: Sun Jan 8 11:28:30 2023 -0500 SUNRPC: Clean up svcauth_gss_release() Now that upper layers use an xdr_stream to track the construction of each RPC Reply message, resbuf->len is kept up-to-date automatically. There's no need to recompute it in svc_gss_release(). Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit bd6aaf781dae436727928cce514881d3c32758b9 Author: Jeff Layton Date: Fri Jan 6 10:33:48 2023 -0500 nfsd: fix potential race in nfs4_find_file The WARN_ON_ONCE check is not terribly useful. It also seems possible for nfs4_find_file to race with the destruction of an fi_deleg_file while trying to take a reference to it. Now that it's safe to pass nfs_get_file a NULL pointer, remove the WARN and NULL pointer check. Take the fi_lock when fetching fi_deleg_file. Cc: NeilBrown Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 70f62231cdfd52357836733dd31db787e0412ab2 Author: Jeff Layton Date: Fri Jan 6 10:33:47 2023 -0500 nfsd: allow nfsd_file_get to sanely handle a NULL pointer ...and remove some now-useless NULL pointer checks in its callers. Suggested-by: NeilBrown Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit df24ac7a2e3a9d0bc68f1756a880e50bfe4b4522 Author: Dai Ngo Date: Sun Dec 18 16:55:53 2022 -0800 NFSD: enhance inter-server copy cleanup Currently nfsd4_setup_inter_ssc returns the vfsmount of the source server's export when the mount completes. After the copy is done nfsd4_cleanup_inter_ssc is called with the vfsmount of the source server and it searches nfsd_ssc_mount_list for a matching entry to do the clean up. The problems with this approach are (1) the need to search the nfsd_ssc_mount_list and (2) the code has to handle the case where the matching entry is not found which looks ugly. The enhancement is instead of nfsd4_setup_inter_ssc returning the vfsmount, it returns the nfsd4_ssc_umount_item which has the vfsmount embedded in it. When nfsd4_cleanup_inter_ssc is called it's passed with the nfsd4_ssc_umount_item directly to do the clean up so no searching is needed and there is no need to handle the 'not found' case. Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever [ cel: adjusted whitespace and variable/function names ] Reviewed-by: Olga Kornievskaia commit f4afc8fead386c81fda2593ad6162271d26667f8 Author: Chuck Lever Date: Mon Jan 2 12:08:04 2023 -0500 SUNRPC: Hoist svcxdr_init_decode() into svc_process() Now the entire RPC Call header parsing path is handled via struct xdr_stream-based decoders. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 1c59a532ae38cc4472a7096d7a50703bce9a153f Author: Chuck Lever Date: Mon Jan 2 12:07:58 2023 -0500 SUNRPC: Remove svc_process_common's argv parameter Clean up: With xdr_stream decoding, the @argv parameter is no longer used. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 163cdfca341b76c958567ae0966bd3575c5c6192 Author: Chuck Lever Date: Mon Jan 2 12:07:52 2023 -0500 SUNRPC: Decode most of RPC header with xdr_stream Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4119bd0306652776cb0b7caa3aea5b2a93aecb89 Author: Chuck Lever Date: Mon Jan 2 12:07:45 2023 -0500 SUNRPC: Eliminate unneeded variable Clean up: Saving the RPC program number in two places is unnecessary. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2009e32997ed568a305cf9bc7bf27d22e0f6ccda Author: Chuck Lever Date: Mon Jan 2 12:07:39 2023 -0500 SUNRPC: Re-order construction of the first reply fields Clean up: Group these together for legibility. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6898b47a0f9e118636d82c3e2c39e50f82290a91 Author: Chuck Lever Date: Mon Jan 2 12:07:32 2023 -0500 SUNRPC: Hoist init_decode out of svc_authenticate() Now that each ->accept method has been converted to use xdr_stream, the svcxdr_init_decode() calls can be hoisted back up into the generic RPC server code. The dprintk in svc_authenticate() is removed, since trace_svc_authenticate() reports the same information. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b0bc53470d1af01f62a0fe2d405cf56477804863 Author: Chuck Lever Date: Mon Jan 2 12:07:26 2023 -0500 SUNRPC: Convert the svcauth_gss_accept() pre-amble to use xdr_stream Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6734706bc0b834c334aed2551ad046bf5b6a50d4 Author: Chuck Lever Date: Mon Jan 2 12:07:20 2023 -0500 SUNRPC: Clean up svcauth_gss_accept's NULL procedure check Micro-optimizations: 1. The value of rqstp->rq_auth_stat is replaced no matter which arm of the switch is taken, so the initial assignment can be safely removed. 2. Avoid checking the value of gc->gc_proc twice in the I/O (RPC_GSS_PROC_DATA) path. The cost is a little extra code redundancy. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 0653028e8f1c97fec30710813a001ad8a2ec34f4 Author: Chuck Lever Date: Mon Jan 2 12:07:13 2023 -0500 SUNRPC: Convert gss_verify_header() to use xdr_stream Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 42140718ea26c47fb06c679451a6aa6703545136 Author: Chuck Lever Date: Mon Jan 2 12:07:07 2023 -0500 SUNRPC: Convert unwrap_priv_data() to use xdr_stream Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f4a59e822f8116baf51a9fc86590e4391bd542d2 Author: Chuck Lever Date: Mon Jan 2 12:07:00 2023 -0500 SUNRPC: Rename automatic variables in unwrap_priv_data() Clean up: To help orient readers, name the stack variables to match the XDR field names. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit b68e4c5c32275e23d35badb7287faaa310c15ba0 Author: Chuck Lever Date: Mon Jan 2 12:06:54 2023 -0500 SUNRPC: Convert unwrap_integ_data() to use xdr_stream Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit e14673c9c1c193896b155165d526a45c83094c1f Author: Chuck Lever Date: Mon Jan 2 12:06:47 2023 -0500 SUNRPC: Rename automatic variables in unwrap_integ_data() Clean up: To help orient readers, name the stack variables to match the XDR field names. For readability, I'm also going to rename the unwrap and wrap functions in a consistent manner, starting with unwrap_integ_data(). Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 26a949d1db9fd98b64ce4007da0d4a8d1c23ef22 Author: Chuck Lever Date: Mon Jan 2 12:06:41 2023 -0500 SUNRPC: Replace read_u32_from_xdr_buf() with existing XDR helper Clean up / code de-duplication - this functionality is already available in the generic XDR layer. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c020fa695af64093acf689beaa39d9e956a55f23 Author: Chuck Lever Date: Mon Jan 2 12:06:35 2023 -0500 SUNRPC: Convert server-side GSS upcall helpers to use xdr_stream The entire RPC_GSS_PROC_INIT path is converted over to xdr_stream for decoding the Call credential and verifier. Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 1cbfb921978f98d8b3cdd04b3b2a98e7f4e0fcef Author: Chuck Lever Date: Mon Jan 2 12:06:28 2023 -0500 SUNRPC: Remove gss_read_verf() gss_read_verf() is already short. Fold it into its only caller. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4d51366deeb4e216154511fb04fa195393a2d33d Author: Chuck Lever Date: Mon Jan 2 12:06:22 2023 -0500 SUNRPC: Remove gss_read_common_verf() gss_read_common_verf() is now just a wrapper for dup_netobj(), thus it can be replaced with direct calls to dup_netobj(). Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 20ebe927ede7ad8f89c7826bea04264310fd3fff Author: Chuck Lever Date: Mon Jan 2 12:06:15 2023 -0500 SUNRPC: Hoist common verifier decoding code into svcauth_gss_proc_init() Pre-requisite to replacing gss_read_common_verf(). Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 4ac5e7a6904bc23fec8ba60af686b2ed5cf027ff Author: Chuck Lever Date: Mon Jan 2 12:06:09 2023 -0500 SUNRPC: Move the server-side GSS upcall to a noinline function Since upcalls are infrequent, ensure the compiler places the upcall mechanism out-of-line from the I/O path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit e8e38e14009afa90f320b9e806f416954b7dc315 Author: Chuck Lever Date: Mon Jan 2 12:06:03 2023 -0500 SUNRPC: Convert svcauth_tls_accept() to use xdr_stream Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 6181b0c6432bf0807512e85e0c5863f7aca8e515 Author: Chuck Lever Date: Mon Jan 2 12:05:56 2023 -0500 SUNRPC: Convert svcauth_unix_accept() to use xdr_stream Done as part of hardening the server-side RPC header decoding path. Since the server-side of the Linux kernel SunRPC implementation ignores the contents of the Call's machinename field, there's no need for its RPC_AUTH_UNIX authenticator to reject names that are larger than UNX_MAXNODENAME. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit bee13639c0940abdea4dcaaf7f9bc0b88a68322b Author: Chuck Lever Date: Mon Jan 2 12:05:50 2023 -0500 SUNRPC: Convert svcauth_null_accept() to use xdr_stream Done as part of hardening the server-side RPC header decoding path. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 846b5756d7632523b5bfce78c163aa883aa9d587 Author: Chuck Lever Date: Mon Jan 2 12:05:43 2023 -0500 SUNRPC: Add an XDR decoding helper for struct opaque_auth RFC 5531 defines the body of an RPC Call message like this: struct call_body { unsigned int rpcvers; unsigned int prog; unsigned int vers; unsigned int proc; opaque_auth cred; opaque_auth verf; /* procedure-specific parameters start here */ }; In the current server code, decoding a struct opaque_auth type is open-coded in several places, and is thus difficult to harden everywhere. Introduce a helper for decoding an opaque_auth within the context of a xdr_stream. This helper can be shared with all authentication flavor implemenations, even on the client-side. Done as part of hardening the server-side RPC header decoding paths. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 1e9e177df3e36e93a37bafc3c610ed019e6f48e7 Author: Chuck Lever Date: Mon Jan 2 12:05:37 2023 -0500 SUNRPC: Move svcxdr_init_decode() into ->accept methods Refactor: So that the overhaul of each ->accept method can be done in separate smaller patches, temporarily move the svcxdr_init_decode() call into those methods. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit dba5eaa46b0282cb9607d362c8887dfcb44bfd2e Author: Chuck Lever Date: Mon Jan 2 12:05:30 2023 -0500 SUNRPC: Push svcxdr_init_decode() into svc_process_common() Now that all vs_dispatch functions invoke svcxdr_init_decode(), it is common code and can be pushed down into the generic RPC server. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f78e44545814b26ab6af7cdd5b022293ceac867e Author: Richard Weinberger Date: Wed Dec 7 09:43:09 2022 +0100 NFS: nfs_encode_fh: Remove S_AUTOMOUNT check Now with NFSD being able to cross into auto mounts, the check can be removed. Signed-off-by: Richard Weinberger Reviewed-by: Ian Kent Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever Acked-by: Anna Schumaker commit e1f19857f94be09f9526f180e64f20138bd4e394 Author: Richard Weinberger Date: Wed Dec 7 09:43:08 2022 +0100 fs: namei: Allow follow_down() to uncover auto mounts This function is only used by NFSD to cross mount points. If a mount point is of type auto mount, follow_down() will not uncover it. Add LOOKUP_AUTOMOUNT to the lookup flags to have ->d_automount() called when NFSD walks down the mount tree. Signed-off-by: Richard Weinberger Reviewed-by: Ian Kent Reviewed-by: Jeff Layton Acked-by: Al Viro Signed-off-by: Chuck Lever commit 50f5fdaea9cd6941e51ea6e07d8c15265917bb86 Author: Richard Weinberger Date: Wed Dec 7 09:43:07 2022 +0100 NFSD: Teach nfsd_mountpoint() auto mounts Currently nfsd_mountpoint() tests for mount points using d_mountpoint(), this works only when a mount point is already uncovered. In our case the mount point is of type auto mount and can be coverted. i.e. ->d_automount() was not called. Using d_managed() nfsd_mountpoint() can test whether a mount point is either already uncovered or can be uncovered later. Signed-off-by: Richard Weinberger Reviewed-by: Ian Kent Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 91dc288f4edf0d768e46c2c6d33e0ab703403459 Author: Randy Dunlap Date: Sun Feb 19 15:15:25 2023 -0800 MIPS: vpe-mt: drop physical_memsize When neither LANTIQ nor MIPS_MALTA is set, 'physical_memsize' is not declared. This causes the build to fail with: mips-linux-ld: arch/mips/kernel/vpe-mt.o: in function `vpe_run': arch/mips/kernel/vpe-mt.c:(.text.vpe_run+0x280): undefined reference to `physical_memsize' LANTIQ is not using 'physical_memsize' and MIPS_MALTA's use of it is self-contained in mti-malta/malta-dtshim.c. Use of physical_memsize in vpe-mt.c appears to be unused, so eliminate this loader mode completely and require VPE programs to be compiled with DFLT_STACK_SIZE and DFLT_HEAP_SIZE defined. Fixes: 9050d50e2244 ("MIPS: lantiq: Set physical_memsize") Fixes: 1a2a6d7e8816 ("MIPS: APRP: Split VPE loader into separate files.") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Link: https://lore.kernel.org/all/202302030625.2g3E98sY-lkp@intel.com/ Cc: Dengcheng Zhu Cc: John Crispin Cc: Thomas Bogendoerfer Cc: Philippe Mathieu-Daudé Cc: "Steven J. Hill" Cc: Qais Yousef Cc: Yang Yingliang Cc: Hauke Mehrtens Cc: James Hogan Cc: linux-mips@vger.kernel.org Signed-off-by: Thomas Bogendoerfer commit 88cd618dcc7b63baa1478730b02eaba3e3148467 Author: Bagas Sanjaya Date: Mon Feb 20 19:47:21 2023 +0700 debugfs: drop inline constant formatting for ERR_PTR(-ERROR) Stephen Rothwell reported htmldocs warning when merging driver-core tree for linux-next: Documentation/filesystems/api-summary:146: fs/debugfs/inode.c:804: WARNING: Inline literal start-string without end-string. The warning is due to inline constant formatting (``%CONST``) doesn't play nice with complex-name constants like ERR_PTR(-ERROR). Drop the formatting for that constant above to be consistent with similar error constants and also to fix the above warning. Link: https://lore.kernel.org/lkml/20230220163133.481e43d8@canb.auug.org.au/ Fixes: d3002468cb5d5d ("debugfs: update comment of debugfs_rename()") Reported-by: Stephen Rothwell Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20230220124721.11657-1-bagasdotme@gmail.com Signed-off-by: Greg Kroah-Hartman commit feabecaff5902f896531dde90646ca5dfa9d4f7d Author: Sergey Shtylyov Date: Wed Aug 17 23:00:45 2022 +0300 genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() If ipi_send_{mask|single}() is called with an invalid interrupt number, all the local variables there will be NULL. ipi_send_verify() which is invoked from these functions does verify its 'data' parameter, resulting in a kernel oops in irq_data_get_affinity_mask() as the passed NULL pointer gets dereferenced. Add a missing NULL pointer check in ipi_send_verify()... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 3b8e29a82dd1 ("genirq: Implement ipi_send_mask/single()") Signed-off-by: Sergey Shtylyov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/b541232d-c2b6-1fe9-79b4-a7129459e4d0@omp.ru commit 3fcdf2dfefb6313ea0395519d1784808c0b6559b Author: Florian Fainelli Date: Fri Feb 17 10:34:14 2023 -0800 net: bcmgenet: Support wake-up from s2idle When we suspend into s2idle we also need to enable the interrupt line that generates the MPD and HFB interrupts towards the host CPU interrupt controller (typically the ARM GIC or MIPS L1) to make it exit s2idle. When we suspend into other modes such as "standby" or "mem" we engage a power management state machine which will gate off the CPU L1 controller (priv->irq0) and ungate the side band wake-up interrupt (priv->wol_irq). It is safe to have both enabled as wake-up sources because they are mutually exclusive given any suspend mode. Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit 5f1eb1ff58ea122e24adf0bc940f268ed2227462 Author: Eric Dumazet Date: Fri Feb 17 18:24:54 2023 +0000 scm: add user copy checks to put_cmsg() This is a followup of commit 2558b8039d05 ("net: use a bounce buffer for copying skb->mark") x86 and powerpc define user_access_begin, meaning that they are not able to perform user copy checks when using user_write_access_begin() / unsafe_copy_to_user() and friends [1] Instead of waiting bugs to trigger on other arches, add a check_object_size() in put_cmsg() to make sure that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y will perform more security checks. [1] We can not generically call check_object_size() from unsafe_copy_to_user() because UACCESS is enabled at this point. Signed-off-by: Eric Dumazet Cc: Kees Cook Acked-by: Kees Cook Signed-off-by: David S. Miller commit fce10282a03db59bdb1cba6333d0564461d47bd6 Author: Paolo Abeni Date: Fri Feb 17 19:09:20 2023 +0100 devlink: drop leftover duplicate/unused code The recent merge from net left-over some unused code in leftover.c - nomen omen. Just drop the unused bits. Signed-off-by: Paolo Abeni Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit f6aa90a7a94a64f8c7ad28e09c1339624a824506 Merge: 4d3e050b54887 6ad172748db49 Author: David S. Miller Date: Mon Feb 20 11:31:22 2023 +0000 Merge tag 'linux-can-next-for-6.3-20230217' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2023-02-17 - fixed this is a pull request of 4 patches for net-next/master. The first patch is by Yang Li and converts the ctucanfd driver to devm_platform_ioremap_resource(). The last 3 patches are by Frank Jungclaus, target the esd_usb driver and contains preparations for the upcoming support of the esd CAN-USB/3 hardware. ==================== Signed-off-by: David S. Miller commit 4d3e050b548878a14edfa2aeaca5d583b8b980ef Author: Horatiu Vultur Date: Fri Feb 17 14:28:31 2023 +0100 net: lan966x: Use automatic selection of VCAP rule actionset Since commit 81e164c4aec5 ("net: microchip: sparx5: Add automatic selection of VCAP rule actionset") the VCAP API has the capability to select automatically the actionset based on the actions that are attached to the rule. So it is not needed anymore to hardcode the actionset in the driver, therefore it is OK to remove this. Signed-off-by: Horatiu Vultur Reviewed-by: Alexander Lobakin Signed-off-by: David S. Miller commit cf70d01a62c712ee715df1f7892b58c77474bcfb Author: Ben Dooks Date: Fri Dec 23 15:38:15 2022 +0000 pwm: dwc: Use devm_pwmchip_add() Add the PWM chip using devm_pwmchip_add() to avoid having to manually remove it. This is useful for subsequent patches adding platform device support. Signed-off-by: Ben Dooks Reviewed-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit a357d1493f0c66ce8006dd28c07646d1f891259a Author: Ben Dooks Date: Fri Dec 23 15:38:14 2022 +0000 pwm: dwc: Move memory allocation to own function In preparation for adding other bus support, move the allocation of the PWM structure out of the main driver code. Signed-off-by: Ben Dooks Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit f7c843d6d7f82d26ee9efe689f9b3208dbf7ed87 Author: Ben Dooks Date: Fri Dec 23 15:38:13 2022 +0000 pwm: dwc: Change &pci->dev to dev in probe The dwc_pwm_probe() assigns dev to be &pci->dev but then uses &pci->dev throughout the function. Change these all to the 'dev' variable to make lines shorter. Signed-off-by: Ben Dooks Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 38d711aacc3d6df13bec75577f966c43b83576fb Merge: e469b6268d8cb 3a7d84eae03be Author: David S. Miller Date: Mon Feb 20 11:22:54 2023 +0000 Merge branch 'default_rps_mask-follow-up' Paolo Abeni says: ==================== net: default_rps_mask follow-up The first patch namespacify the setting. In the common case, once proper isolation is in place in the main namespace, forwarding to/from each child netns will allways happen on the desidered CPUs. Any additional RPS stage inside the child namespace will not provide additional isolation and could hurt performance badly if picking a CPU on a remote node. The 2nd patch adds more self-tests coverage. ==================== Signed-off-by: David S. Miller commit 3a7d84eae03bef4c02c39822b2ea6be5ac73de7b Author: Paolo Abeni Date: Fri Feb 17 13:28:50 2023 +0100 self-tests: more rps self tests Explicitly check for child netns and main ns independency Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit 50bcfe8df7c73ce51762f65d218b4ef0cc5da3ee Author: Paolo Abeni Date: Fri Feb 17 13:28:49 2023 +0100 net: make default_rps_mask a per netns attribute That really was meant to be a per netns attribute from the beginning. The idea is that once proper isolation is in place in the main namespace, additional demux in the child namespaces will be redundant. Let's make child netns default rps mask empty by default. To avoid bloating the netns with a possibly large cpumask, allocate it on-demand during the first write operation. Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller commit e469b6268d8cb7c6cf6b9cd5ce7f403de695627f Merge: 1155a2281de9e 38ae319229692 Author: David S. Miller Date: Mon Feb 20 11:18:13 2023 +0000 Merge tag 'wireless-next-2023-02-17' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Kalle Valo says: ==================== wireless-next patches for v6.3 Third set of patches for v6.3. This time only a set of small fixes submitted during the last day or two. ==================== Signed-off-by: David S. Miller commit 4090871d772629a5574fb405319f008717512b48 Merge: 7f604e92fb805 96a4627dbbd48 Author: Paolo Bonzini Date: Mon Feb 20 06:12:42 2023 -0500 Merge tag 'kvmarm-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.3 - Provide a virtual cache topology to the guest to avoid inconsistencies with migration on heterogenous systems. Non secure software has no practical need to traverse the caches by set/way in the first place. - Add support for taking stage-2 access faults in parallel. This was an accidental omission in the original parallel faults implementation, but should provide a marginal improvement to machines w/o FEAT_HAFDBS (such as hardware from the fruit company). - A preamble to adding support for nested virtualization to KVM, including vEL2 register state, rudimentary nested exception handling and masking unsupported features for nested guests. - Fixes to the PSCI relay that avoid an unexpected host SVE trap when resuming a CPU when running pKVM. - VGIC maintenance interrupt support for the AIC - Improvements to the arch timer emulation, primarily aimed at reducing the trap overhead of running nested. - Add CONFIG_USERFAULTFD to the KVM selftests config fragment in the interest of CI systems. - Avoid VM-wide stop-the-world operations when a vCPU accesses its own redistributor. - Serialize when toggling CPACR_EL1.SMEN to avoid unexpected exceptions in the host. - Aesthetic and comment/kerneldoc fixes - Drop the vestiges of the old Columbia mailing list and add [Oliver] as co-maintainer This also drags in arm64's 'for-next/sme2' branch, because both it and the PSCI relay changes touch the EL2 initialization code. commit 1155a2281de9e7c08c5c6e265b32b28d1fe9ea07 Merge: 129ff4de58ff0 2954fe60e33da Author: David S. Miller Date: Mon Feb 20 10:53:56 2023 +0000 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter updates for net-next: 1) Add safeguard to check for NULL tupe in objects updates via NFT_MSG_NEWOBJ, this should not ever happen. From Alok Tiwari. 2) Incorrect pointer check in the new destroy rule command, from Yang Yingliang. 3) Incorrect status bitcheck in nf_conntrack_udp_packet(), from Florian Westphal. 4) Simplify seq_print_acct(), from Ilia Gavrilov. 5) Use 2-arg optimal variant of kfree_rcu() in IPVS, from Julian Anastasov. 6) TCP connection enters CLOSE state in conntrack for locally originated TCP reset packet from the reject target, from Florian Westphal. The fixes #2 and #3 in this series address issues from the previous pull nf-next request in this net-next cycle. ==================== Signed-off-by: David S. Miller commit 129ff4de58ff0ca981b833834d8b9bddb71d4bfe Author: Arnd Bergmann Date: Fri Feb 17 10:58:06 2023 +0100 net: microchip: sparx5: reduce stack usage The vcap_admin structures in vcap_api_next_lookup_advanced_test() take several hundred bytes of stack frame, but when CONFIG_KASAN_STACK is enabled, each one of them also has extra padding before and after it, which ends up blowing the warning limit: In file included from drivers/net/ethernet/microchip/vcap/vcap_api.c:3521: drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c: In function 'vcap_api_next_lookup_advanced_test': drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c:1954:1: error: the frame size of 1448 bytes is larger than 1400 bytes [-Werror=frame-larger-than=] 1954 | } Reduce the total stack usage by replacing the five structures with an array that only needs one pair of padding areas. Fixes: 1f741f001160 ("net: microchip: sparx5: Add KUNIT tests for enabling/disabling chains") Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Lobakin Signed-off-by: David S. Miller commit a59f832a71c938779b8abdb022d6d39903e635c3 Author: Arnd Bergmann Date: Fri Feb 17 10:56:39 2023 +0100 sfc: use IS_ENABLED() checks for CONFIG_SFC_SRIOV One local variable has become unused after a recent change: drivers/net/ethernet/sfc/ef100_nic.c: In function 'ef100_probe_netdev_pf': drivers/net/ethernet/sfc/ef100_nic.c:1155:21: error: unused variable 'net_dev' [-Werror=unused-variable] struct net_device *net_dev = efx->net_dev; ^~~~~~~ The variable is still used in an #ifdef. Replace the #ifdef with an if(IS_ENABLED()) check that lets the compiler see where it is used, rather than adding another #ifdef. This also fixes an uninitialized return value in ef100_probe_netdev_pf() that gcc did not spot. Fixes: 7e056e2360d9 ("sfc: obtain device mac address based on firmware handle for ef100") Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 8173c2f9a1a4a5afcf465a62bc8b616c1fef252d Author: Michal Swiatkowski Date: Fri Feb 17 11:50:17 2023 +0100 ice: properly alloc ICE_VSI_LB Devlink reload patchset introduced regression. ICE_VSI_LB wasn't taken into account when doing default allocation. Fix it by adding a case for ICE_VSI_LB in ice_vsi_alloc_def(). Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Reported-by: Maciej Fijalkowski Acked-by: Maciej Fijalkowski Signed-off-by: Michal Swiatkowski Reviewed-by: Alexander Lobakin Signed-off-by: David S. Miller commit 0d39ad3e1b045ca1600169ca8de1267ab4ae1a81 Author: Colin Ian King Date: Fri Feb 17 09:25:28 2023 +0000 sfc: Fix spelling mistake "creationg" -> "creating" There is a spelling mistake in a pci_warn message. Fix it. Signed-off-by: Colin Ian King Reviewed-by:  Alejandro Lucero Signed-off-by: David S. Miller commit 933a01ad599766cf9bcda788f956f425a8b0b0a2 Author: Geetha sowjanya Date: Fri Feb 17 11:21:12 2023 +0530 octeontx2-af: Add NIX Errata workaround on CN10K silicon This patch adds workaround for below 2 HW erratas 1. Due to improper clock gating, NIXRX may free the same NPA buffer multiple times.. to avoid this, always enable NIX RX conditional clock. 2. NIX FIFO does not get initialized on reset, if the SMQ flush is triggered before the first packet is processed, it will lead to undefined state. The workaround to perform SMQ flush only if packet count is non-zero in MDQ. Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Sai Krishna Signed-off-by: David S. Miller commit c2a978c171a6d44d4d9710e7e4455f75d34aecee Author: Andrew Lunn Date: Fri Feb 17 04:15:20 2023 +0100 net: phy: Read EEE abilities when using .features A PHY driver can use a static integer value to indicate what link mode features it supports, i.e, its abilities.. This is the old way, but useful when dynamically determining the devices features does not work, e.g. support of fibre. EEE support has been moved into phydev->supported_eee. This needs to be set otherwise the code assumes EEE is not supported. It is normally set as part of reading the devices abilities. However if a static integer value was used, the dynamic reading of the abilities is not performed. Add a call to genphy_c45_read_eee_abilities() to read the EEE abilities. Fixes: 8b68710a3121 ("net: phy: start using genphy_c45_ethtool_get/set_eee()") Signed-off-by: Andrew Lunn Reviewed-by: Oleksij Rempel Signed-off-by: David S. Miller commit 0b1dbf889d0bebfa533a6220b0379300d4007204 Merge: cf06eef0c86bd 2f987d4866107 Author: David S. Miller Date: Mon Feb 20 10:04:22 2023 +0000 Merge branch 'phydev-locks' Andrew Lunn says: ==================== Add additional phydev locks The phydev lock should be held when accessing members of phydev, or calling into the driver. Some of the phy_ethtool_ functions are missing locks. Add them. To avoid deadlock the marvell driver is modified since it calls one of the functions which gain locks, which would result in a deadlock. The missing locks have not caused noticeable issues, so these patches are for net-next. ==================== Signed-off-by: David S. Miller commit 2f987d486610752b364fd238fa3bb1a142d80b44 Author: Andrew Lunn Date: Fri Feb 17 04:07:14 2023 +0100 net: phy: Add locks to ethtool functions The phydev lock should be held while accessing members of phydev, or calling into the driver. Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit 3365777a6a2243f1cca5a441f2c89002d16fc580 Author: Andrew Lunn Date: Fri Feb 17 04:07:13 2023 +0100 net: phy: marvell: Use the unlocked genphy_c45_ethtool_get_eee() phy_ethtool_get_eee() is about to gain locking of the phydev lock. This means it cannot be used within a PHY driver without causing a deadlock. Swap to using genphy_c45_ethtool_get_eee() which assumes the lock has already been taken. Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller commit a7515af9fb8f0890fe540b108def4a86b9e8330a Author: Doug Berger Date: Thu Feb 16 11:41:28 2023 -0800 net: bcmgenet: fix MoCA LED control When the bcmgenet_mii_config() code was refactored it was missed that the LED control for the MoCA interface got overwritten by the port_ctrl value. Its previous programming is restored here. Fixes: 4f8d81b77e66 ("net: bcmgenet: Refactor register access in bcmgenet_mii_config") Signed-off-by: Doug Berger Acked-by: Florian Fainelli Signed-off-by: David S. Miller commit 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac Author: Shigeru Yoshida Date: Fri Feb 17 01:37:10 2023 +0900 l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() When a file descriptor of pppol2tp socket is passed as file descriptor of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register(). This situation is reproduced by the following program: int main(void) { int sock; struct sockaddr_pppol2tp addr; sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); if (sock < 0) { perror("socket"); return 1; } addr.sa_family = AF_PPPOX; addr.sa_protocol = PX_PROTO_OL2TP; addr.pppol2tp.pid = 0; addr.pppol2tp.fd = sock; addr.pppol2tp.addr.sin_family = PF_INET; addr.pppol2tp.addr.sin_port = htons(0); addr.pppol2tp.addr.sin_addr.s_addr = inet_addr("192.168.0.1"); addr.pppol2tp.s_tunnel = 1; addr.pppol2tp.s_session = 0; addr.pppol2tp.d_tunnel = 0; addr.pppol2tp.d_session = 0; if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("connect"); return 1; } return 0; } This program causes the following lockdep warning: ============================================ WARNING: possible recursive locking detected 6.2.0-rc5-00205-gc96618275234 #56 Not tainted -------------------------------------------- repro/8607 is trying to acquire lock: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0 but task is already holding lock: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(sk_lock-AF_PPPOX); lock(sk_lock-AF_PPPOX); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by repro/8607: #0: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 stack backtrace: CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: dump_stack_lvl+0x100/0x178 __lock_acquire.cold+0x119/0x3b9 ? lockdep_hardirqs_on_prepare+0x410/0x410 lock_acquire+0x1e0/0x610 ? l2tp_tunnel_register+0x2b7/0x11c0 ? lock_downgrade+0x710/0x710 ? __fget_files+0x283/0x3e0 lock_sock_nested+0x3a/0xf0 ? l2tp_tunnel_register+0x2b7/0x11c0 l2tp_tunnel_register+0x2b7/0x11c0 ? sprintf+0xc4/0x100 ? l2tp_tunnel_del_work+0x6b0/0x6b0 ? debug_object_deactivate+0x320/0x320 ? lockdep_init_map_type+0x16d/0x7a0 ? lockdep_init_map_type+0x16d/0x7a0 ? l2tp_tunnel_create+0x2bf/0x4b0 ? l2tp_tunnel_create+0x3c6/0x4b0 pppol2tp_connect+0x14e1/0x1a30 ? pppol2tp_put_sk+0xd0/0xd0 ? aa_sk_perm+0x2b7/0xa80 ? aa_af_perm+0x260/0x260 ? bpf_lsm_socket_connect+0x9/0x10 ? pppol2tp_put_sk+0xd0/0xd0 __sys_connect_file+0x14f/0x190 __sys_connect+0x133/0x160 ? __sys_connect_file+0x190/0x190 ? lockdep_hardirqs_on+0x7d/0x100 ? ktime_get_coarse_real_ts64+0x1b7/0x200 ? ktime_get_coarse_real_ts64+0x147/0x200 ? __audit_syscall_entry+0x396/0x500 __x64_sys_connect+0x72/0xb0 do_syscall_64+0x38/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd This patch fixes the issue by getting/creating the tunnel before locking the pppol2tp socket. Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") Cc: Cong Wang Signed-off-by: Shigeru Yoshida Reviewed-by: Guillaume Nault Signed-off-by: David S. Miller commit 47e91fdfa511139f2549687edb0d8649b123227b Author: Benjamin Tissoires Date: Thu Feb 16 11:22:58 2023 +0100 HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcp_init_work() to complete, we might kick in the devm free code path and thus have unavailable struct mcp_2221 while in delayed work. Canceling the delayed_work item is enough to solve the issue, because cancel_delayed_work_sync will prevent the work item to requeue itself. Fixes: 960f9df7c620 ("HID: mcp2221: add ADC/DAC support via iio subsystem") CC: stable@vger.kernel.org Acked-by: Jiri Kosina Link: https://lore.kernel.org/r/20230215-wip-mcp2221-v2-1-109f71fd036e@redhat.com Signed-off-by: Benjamin Tissoires commit cf06eef0c86bd2088bafecb211e06a2855b4c327 Merge: dd1b527831a3e ac03694bc0097 Author: David S. Miller Date: Mon Feb 20 08:54:24 2023 +0000 Merge branch 'icmp6-drop-reason' Eric Dumazet says: ==================== ipv6: icmp6: better drop reason support This series aims to have more precise drop reason reports for icmp6. This should reduce false positives on most usual cases. This can be extended as needed later. ==================== Signed-off-by: David S. Miller commit ac03694bc009703022cf45a9c90675d5505c584c Author: Eric Dumazet Date: Thu Feb 16 16:28:42 2023 +0000 ipv6: icmp6: add drop reason support to icmpv6_echo_reply() Change icmpv6_echo_reply() to return a drop reason. For the moment, return NOT_SPECIFIED or SKB_CONSUMED. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit c34b8bb11ebc135e970653bd6fc8e3f863fb6a81 Author: Eric Dumazet Date: Thu Feb 16 16:28:41 2023 +0000 ipv6: icmp6: add SKB_DROP_REASON_IPV6_NDISC_NS_OTHERHOST Hosts can often receive neighbour discovery messages that are not for them. Use a dedicated drop reason to make clear the packet is dropped for this normal case. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 784d4477f07b930df73bc77e842e03f1dacb83aa Author: Eric Dumazet Date: Thu Feb 16 16:28:40 2023 +0000 ipv6: icmp6: add SKB_DROP_REASON_IPV6_NDISC_BAD_OPTIONS This is a generic drop reason for any error detected in ndisc_parse_options(). Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit ec993edf05ca4eee5878edf51fdb5ffa2b1decc3 Author: Eric Dumazet Date: Thu Feb 16 16:28:39 2023 +0000 ipv6: icmp6: add drop reason support to ndisc_redirect_rcv() Change ndisc_redirect_rcv() to return a drop reason. For the moment, return PKT_TOO_SMALL, NOT_SPECIFIED and values from icmpv6_notify(). More reasons are added later. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 2f326d9d9ff46fb2e45fb3b6ae77eff04332dde6 Author: Eric Dumazet Date: Thu Feb 16 16:28:38 2023 +0000 ipv6: icmp6: add drop reason support to ndisc_router_discovery() Change ndisc_router_discovery() to return a drop reason. For the moment, return PKT_TOO_SMALL, NOT_SPECIFIED and SKB_CONSUMED. More reasons are added later. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 243e37c642ac1d52858bc5f3559e380babf21169 Author: Eric Dumazet Date: Thu Feb 16 16:28:37 2023 +0000 ipv6: icmp6: add drop reason support to ndisc_recv_rs() Change ndisc_recv_rs() to return a drop reason. For the moment, return PKT_TOO_SMALL, NOT_SPECIFIED or SKB_CONSUMED. More reasons are added later. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 3009f9ae21ec539985977dcaa0cebb628afeb181 Author: Eric Dumazet Date: Thu Feb 16 16:28:36 2023 +0000 ipv6: icmp6: add drop reason support to ndisc_recv_na() Change ndisc_recv_na() to return a drop reason. For the moment, return PKT_TOO_SMALL, NOT_SPECIFIED or SKB_CONSUMED. More reasons are added later. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 7c9c8913f4523cda30a710736844d74bfee060a4 Author: Eric Dumazet Date: Thu Feb 16 16:28:35 2023 +0000 ipv6: icmp6: add drop reason support to ndisc_recv_ns() Change ndisc_recv_ns() to return a drop reason. For the moment, return PKT_TOO_SMALL, NOT_SPECIFIED or SKB_CONSUMED. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit dd1b527831a3ed659afa01b672d8e1f7e6ca95a5 Author: Eric Dumazet Date: Thu Feb 16 15:47:18 2023 +0000 net: add location to trace_consume_skb() kfree_skb() includes the location, it makes sense to add it to consume_skb() as well. After patch: taskd_EventMana 8602 [004] 420.406239: skb:consume_skb: skbaddr=0xffff893a4a6d0500 location=unix_stream_read_generic swapper 0 [011] 422.732607: skb:consume_skb: skbaddr=0xffff89597f68cee0 location=mlx4_en_free_tx_desc discipline 9141 [043] 423.065653: skb:consume_skb: skbaddr=0xffff893a487e9c00 location=skb_consume_udp swapper 0 [010] 423.073166: skb:consume_skb: skbaddr=0xffff8949ce9cdb00 location=icmpv6_rcv borglet 8672 [014] 425.628256: skb:consume_skb: skbaddr=0xffff8949c42e9400 location=netlink_dump swapper 0 [028] 426.263317: skb:consume_skb: skbaddr=0xffff893b1589dce0 location=net_rx_action wget 14339 [009] 426.686380: skb:consume_skb: skbaddr=0xffff893a51b552e0 location=tcp_rcv_state_process Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 436864095a95fcc611c20c44a111985fa9848730 Author: Jakub Sitnicki Date: Thu Feb 16 13:43:40 2023 +0100 selftests/net: Interpret UDP_GRO cmsg data as an int value Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an int (see udp_cmsg_recv), not a u16 value, as strace confirms: recvmsg(8, {msg_name=..., msg_iov=[{iov_base="\0\0..."..., iov_len=96000}], msg_iovlen=1, msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4 cmsg_level=SOL_UDP, cmsg_type=0x68}], <-- UDP_GRO msg_controllen=24, msg_flags=0}, 0) = 11200 Interpreting the data as an u16 value won't work on big-endian platforms. Since it is too late to back out of this API decision [1], fix the test. [1]: https://lore.kernel.org/netdev/20230131174601.203127-1-jakub@cloudflare.com/ Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") Suggested-by: Eric Dumazet Signed-off-by: Jakub Sitnicki Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 908d4bb7c54caa58253a363d63e797a468eaf321 Author: Manish Chopra Date: Thu Feb 16 03:54:47 2023 -0800 qede: fix interrupt coalescing configuration On default driver load device gets configured with unexpected higher interrupt coalescing values instead of default expected values as memory allocated from krealloc() is not supposed to be zeroed out and may contain garbage values. Fix this by allocating the memory of required size first with kcalloc() and then use krealloc() to resize and preserve the contents across down/up of the interface. Signed-off-by: Manish Chopra Fixes: b0ec5489c480 ("qede: preserve per queue stats across up/down of interface") Cc: stable@vger.kernel.org Cc: Bhaskar Upadhaya Cc: David S. Miller Link: https://bugzilla.redhat.com/show_bug.cgi?id=2160054 Signed-off-by: Alok Prasad Signed-off-by: Ariel Elior Signed-off-by: David S. Miller commit 9f78bf330a66cd400b3e00f370f597e9fa939207 Author: Xuan Zhuo Date: Thu Feb 16 16:30:47 2023 +0800 xsk: support use vaddr as ring When we try to start AF_XDP on some machines with long running time, due to the machine's memory fragmentation problem, there is no sufficient contiguous physical memory that will cause the start failure. If the size of the queue is 8 * 1024, then the size of the desc[] is 8 * 1024 * 8 = 16 * PAGE, but we also add struct xdp_ring size, so it is 16page+. This is necessary to apply for a 4-order memory. If there are a lot of queues, it is difficult to these machine with long running time. Here, that we actually waste 15 pages. 4-Order memory is 32 pages, but we only use 17 pages. This patch replaces __get_free_pages() by vmalloc() to allocate memory to solve these problems. Signed-off-by: Xuan Zhuo Acked-by: Magnus Karlsson Reviewed-by: Alexander Lobakin Signed-off-by: David S. Miller commit 475f9ff63ee8c296aa46c6e9e9ad9bdd301c6bdf Author: D. Wythe Date: Thu Feb 16 14:39:05 2023 +0800 net/smc: fix application data exception There is a certain probability that following exceptions will occur in the wrk benchmark test: Running 10s test @ http://11.213.45.6:80 8 threads and 64 connections Thread Stats Avg Stdev Max +/- Stdev Latency 3.72ms 13.94ms 245.33ms 94.17% Req/Sec 1.96k 713.67 5.41k 75.16% 155262 requests in 10.10s, 23.10MB read Non-2xx or 3xx responses: 3 We will find that the error is HTTP 400 error, which is a serious exception in our test, which means the application data was corrupted. Consider the following scenarios: CPU0 CPU1 buf_desc->used = 0; cmpxchg(buf_desc->used, 0, 1) deal_with(buf_desc) memset(buf_desc->cpu_addr,0); This will cause the data received by a victim connection to be cleared, thus triggering an HTTP 400 error in the server. This patch exchange the order between clear used and memset, add barrier to ensure memory consistency. Fixes: 1c5526968e27 ("net/smc: Clear memory when release and reuse buffer") Signed-off-by: D. Wythe Reviewed-by: Wenjia Zhang Signed-off-by: David S. Miller commit e40b801b3603a8f90b46acbacdea3505c27f01c0 Author: D. Wythe Date: Thu Feb 16 14:37:36 2023 +0800 net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() There is a certain chance to trigger the following panic: PID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: "kworker/1:48" #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7 #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60 #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7 #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715 #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654 #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62 [exception RIP: ib_alloc_mr+19] RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004 RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc] #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc] #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc] The reason here is that when the server tries to create a second link, smc_llc_srv_add_link() has no protection and may add a new link to link group. This breaks the security environment protected by llc_conf_mutex. Fixes: 2d2209f20189 ("net/smc: first part of add link processing as SMC server") Signed-off-by: D. Wythe Reviewed-by: Larysa Zaremba Reviewed-by: Wenjia Zhang Signed-off-by: David S. Miller commit b148d400f820637bcc95f6aca64c8763a2db858f Merge: c078381856230 64cb6aad12328 Author: Paolo Abeni Date: Mon Feb 20 08:46:59 2023 +0100 Merge branch 'taprio-queuemaxsdu-fixes' Vladimir Oltean says: ==================== taprio queueMaxSDU fixes This fixes 3 issues noticed while attempting to reoffload the dynamically calculated queueMaxSDU values. These are: - Dynamic queueMaxSDU is not calculated correctly due to a lost patch - Dynamically calculated queueMaxSDU needs to be clamped on the low end - Dynamically calculated queueMaxSDU needs to be clamped on the high end ==================== Link: https://lore.kernel.org/r/20230215224632.2532685-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 64cb6aad12328015202af5b2a9623c6bcc021855 Author: Vladimir Oltean Date: Thu Feb 16 00:46:32 2023 +0200 net/sched: taprio: dynamic max_sdu larger than the max_mtu is unlimited It makes no sense to keep randomly large max_sdu values, especially if larger than the device's max_mtu. These are visible in "tc qdisc show". Such a max_sdu is practically unlimited and will cause no packets for that traffic class to be dropped on enqueue. Just set max_sdu_dynamic to U32_MAX, which in the logic below causes taprio to save a max_frm_len of U32_MAX and a max_sdu presented to user space of 0 (unlimited). Signed-off-by: Vladimir Oltean Reviewed-by: Kurt Kanzenbach Signed-off-by: Paolo Abeni commit bdf366bd867c4565b535a5825df7ddcb4773fc28 Author: Vladimir Oltean Date: Thu Feb 16 00:46:31 2023 +0200 net/sched: taprio: don't allow dynamic max_sdu to go negative after stab adjustment The overhead specified in the size table comes from the user. With small time intervals (or gates always closed), the overhead can be larger than the max interval for that traffic class, and their difference is negative. What we want to happen is for max_sdu_dynamic to have the smallest non-zero value possible (1) which means that all packets on that traffic class are dropped on enqueue. However, since max_sdu_dynamic is u32, a negative is represented as a large value and oversized dropping never happens. Use max_t with int to force a truncation of max_frm_len to no smaller than dev->hard_header_len + 1, which in turn makes max_sdu_dynamic no smaller than 1. Fixes: fed87cc6718a ("net/sched: taprio: automatically calculate queueMaxSDU based on TC gate durations") Signed-off-by: Vladimir Oltean Reviewed-by: Kurt Kanzenbach Signed-off-by: Paolo Abeni commit 09dbdf28f9f9fa27e16895c67fbd94ff36124766 Author: Vladimir Oltean Date: Thu Feb 16 00:46:30 2023 +0200 net/sched: taprio: fix calculation of maximum gate durations taprio_calculate_gate_durations() depends on netdev_get_num_tc() and this returns 0. So it calculates the maximum gate durations for no traffic class. I had tested the blamed commit only with another patch in my tree, one which in the end I decided isn't valuable enough to submit ("net/sched: taprio: mask off bits in gate mask that exceed number of TCs"). The problem is that having this patch threw off my testing. By moving the netdev_set_num_tc() call earlier, we implicitly gave to taprio_calculate_gate_durations() the information it needed. Extract only the portion from the unsubmitted change which applies the mqprio configuration to the netdev earlier. Link: https://patchwork.kernel.org/project/netdevbpf/patch/20230130173145.475943-15-vladimir.oltean@nxp.com/ Fixes: a306a90c8ffe ("net/sched: taprio: calculate tc gate durations") Signed-off-by: Vladimir Oltean Reviewed-by: Kurt Kanzenbach Signed-off-by: Paolo Abeni commit c078381856230f1e8e13738661d83c2b4b433819 Author: David Howells Date: Wed Feb 15 21:48:05 2023 +0000 rxrpc: Fix overproduction of wakeups to recvmsg() Fix three cases of overproduction of wakeups: (1) rxrpc_input_split_jumbo() conditionally notifies the app that there's data for recvmsg() to collect if it queues some data - and then its only caller, rxrpc_input_data(), goes and wakes up recvmsg() anyway. Fix the rxrpc_input_data() to only do the wakeup in failure cases. (2) If a DATA packet is received for a call by the I/O thread whilst recvmsg() is busy draining the call's rx queue in the app thread, the call will left on the recvmsg() queue for recvmsg() to pick up, even though there isn't any data on it. This can cause an unexpected recvmsg() with a 0 return and no MSG_EOR set after the reply has been posted to a service call. Fix this by discarding pending calls from the recvmsg() queue that don't need servicing yet. (3) Not-yet-completed calls get requeued after having data read from them, even if they have no data to read. Fix this by only requeuing them if they have data waiting on them; if they don't, the I/O thread will requeue them when data arrives or they fail. Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Link: https://lore.kernel.org/r/3386149.1676497685@warthog.procyon.org.uk Signed-off-by: Paolo Abeni commit d269ac136ede573c90c18a66961143294ef564e5 Merge: 1c93e48cc3914 f651334e1ef5d Author: Paolo Abeni Date: Mon Feb 20 08:14:22 2023 +0100 Merge branch 'net-final-gsi-register-updates' Alex Elder says: ==================== net: final GSI register updates I believe this is the last set of changes required to allow IPA v5.0 to be supported. There is a little cleanup work remaining, but that can happen in the next Linux release cycle. Otherwise we just need config data and register definitions for IPA v5.0 (and DTS updates). These are ready but won't be posted without further testing. The first patch in this series fixes a minor bug in a patch just posted, which I found too late. The second eliminates the GSI memory "adjustment"; this was done previously to avoid/delay the need to implement a more general way to define GSI register offsets. Note that this patch causes "checkpatch" warnings due to indentation that aligns with an open parenthesis. The third patch makes use of the newly-defined register offsets, to eliminate the need for a function that hid a few details. The next modifies a different helper function to work properly for IPA v5.0+. The fifth patch changes the way the event ring size is specified based on how it's now done for IPA v5.0+. And the last defines a new register required for IPA v5.0+. ==================== Link: https://lore.kernel.org/r/20230215195352.755744-1-elder@linaro.org Signed-off-by: Paolo Abeni commit f651334e1ef5d1c8fba16a27dff2f3629e7e86e9 Author: Alex Elder Date: Wed Feb 15 13:53:52 2023 -0600 net: ipa: add HW_PARAM_4 GSI register Starting at IPA v5.0, the number of event rings per EE is defined in a field in a new HW_PARAM_4 GSI register rather than HW_PARAM_2. Define this new register and its fields, and update the code that checks the number of rings supported by hardware to use the proper field based on IPA version. Signed-off-by: Alex Elder Signed-off-by: Paolo Abeni commit 37cd29ec84016297e5b834345dd272a7d3bd8fae Author: Alex Elder Date: Wed Feb 15 13:53:51 2023 -0600 net: ipa: support different event ring encoding Starting with IPA v5.0, a channel's event ring index is encoded in a field in the CH_C_CNTXT_1 GSI register rather than CH_C_CNTXT_0. Define a new field ID for the former register and encode the event ring in the appropriate register. Signed-off-by: Alex Elder Signed-off-by: Paolo Abeni commit 62747512ebe6cd292e280aa7dc1dd37d36dcb637 Author: Alex Elder Date: Wed Feb 15 13:53:50 2023 -0600 net: ipa: avoid setting an undefined field The GSI channel protocol field in the CH_C_CNTXT_0 GSI register is widened starting IPA v5.0, making the CHTYPE_PROTOCOL_MSB field added in IPA v4.5 unnecessary. Update the code to reflect this. Signed-off-by: Alex Elder Signed-off-by: Paolo Abeni commit f75f44ddd4cb4bb0ede9c6c7f29679e9794552df Author: Alex Elder Date: Wed Feb 15 13:53:49 2023 -0600 net: ipa: kill ev_ch_e_cntxt_1_length_encode() Now that we explicitly define each register field width there is no need to have a special encoding function for the event ring length. Add a field for this to the EV_CH_E_CNTXT_1 GSI register, and use it in place of ev_ch_e_cntxt_1_length_encode() (which can be removed). Signed-off-by: Alex Elder Signed-off-by: Paolo Abeni commit 59b12b1d27f3f82e56462f0da6413e1849a06d3a Author: Alex Elder Date: Wed Feb 15 13:53:48 2023 -0600 net: ipa: kill gsi->virt_raw Starting at IPA v4.5, almost all GSI registers had their offsets changed by a fixed amount (shifted downward by 0xd000). Rather than defining offsets for all those registers dependent on version, an adjustment was applied for most register accesses. This was implemented in commit cdeee49f3ef7f ("net: ipa: adjust GSI register addresses"). It was later modified to be a bit more obvious about the adjusment, in commit 571b1e7e58ad3 ("net: ipa: use a separate pointer for adjusted GSI memory"). We now are able to define every GSI register with its own offset, so there's no need to implement this special adjustment. So get rid of the "virt_raw" pointer, and just maintain "virt" as the (non-adjusted) base address of I/O mapped GSI register memory. Redefine the offsets of all GSI registers (other than the INTER_EE ones, which were not subject to the adjustment) for IPA v4.5+, subtracting 0xd000 from their defined offsets instead. Move the ERROR_LOG and ERROR_LOG_CLR definitions further down in the register definition files so all registers are defined in order of their offset. Signed-off-by: Alex Elder Signed-off-by: Paolo Abeni commit ecfa80ce3b8740d0760f44cbd9e60f446682b3fa Author: Alex Elder Date: Wed Feb 15 13:53:47 2023 -0600 net: ipa: fix an incorrect assignment I spotted an error in a patch posted this week, unfortunately just after it got accepted. The effect of the bug is that time-based interrupt moderation is disabled. This is not technically a bug, but it is not what is intended. The problem is that a |= assignment got implemented as a simple assignment, so the previously assigned value was ignored. Fixes: edc6158b18af ("net: ipa: define fields for event-ring related registers") Signed-off-by: Alex Elder Signed-off-by: Paolo Abeni commit 1c93e48cc39147723abdcadc251611f6f0c18dee Author: Lorenzo Bianconi Date: Wed Feb 15 15:32:57 2023 +0100 net: dpaa2-eth: do not always set xsk support in xdp_features flag Do not always add NETDEV_XDP_ACT_XSK_ZEROCOPY bit in xdp_features flag but check if the NIC really supports it. Signed-off-by: Lorenzo Bianconi Reviewed-by: Larysa Zaremba Link: https://lore.kernel.org/r/3dba6ea42dc343a9f2d7d1a6a6a6c173235e1ebf.1676471386.git.lorenzo@kernel.org Signed-off-by: Paolo Abeni commit 6f8675a6b06dabe62015c6747df5e957cd159338 Author: Christophe Leroy Date: Sat Feb 18 10:28:50 2023 +0100 powerpc/e500: Add missing prototype for 'relocate_init' Kernel test robot reports: arch/powerpc/mm/nohash/e500.c:314:21: warning: no previous prototype for 'relocate_init' [-Wmissing-prototypes] 314 | notrace void __init relocate_init(u64 dt_ptr, phys_addr_t start) | ^~~~~~~~~~~~~ Add it in mm/mmu_decl.h, close to associated is_second_reloc variable declaration. Reported-by: kernel test robot Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/oe-kbuild-all/202302181136.wgyCKUcs-lkp@intel.com/ Link: https://lore.kernel.org/r/ac9107acf24135e1a07e8f84d2090572d43e3fe4.1676712510.git.christophe.leroy@csgroup.eu commit d3ca9f7aeba793d74361d88a8800b2f205c9236b Author: Hangyu Hua Date: Fri Feb 17 22:29:34 2023 +0900 ksmbd: fix possible memory leak in smb2_lock() argv needs to be free when setup_async_work fails or when the current process is woken up. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Hangyu Hua Acked-by: Namjae Jeon Signed-off-by: Steve French commit e1d447157f232c650e6f32c9fb89ff3d0207c69a Author: Darrell Kavanagh Date: Wed Feb 15 11:50:45 2023 +0000 firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 Another Lenovo convertable which reports a landscape resolution of 1920x1200 with a pitch of (1920 * 4) bytes, while the actual framebuffer has a resolution of 1200x1920 with a pitch of (1200 * 4) bytes. Signed-off-by: Darrell Kavanagh Reviewed-by: Hans de Goede Signed-off-by: Ard Biesheuvel commit 0e68b5517d3767562889f1d83fdb828c26adb24f Author: Pierre Gondois Date: Wed Feb 15 17:10:47 2023 +0100 arm64: efi: Make efi_rt_lock a raw_spinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs the following: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: kworker/u320:0 preempt_count: 2, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by kworker/u320:0/9: #0: ffff3fff8c27d128 ((wq_completion)efi_rts_wq){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) #1: ffff80000861bdd0 ((work_completion)(&efi_rts_work.work)){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) #2: ffffdf7e1ed3e460 (efi_rt_lock){+.+.}-{3:3}, at: efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) Preemption disabled at: efi_virtmap_load (./arch/arm64/include/asm/mmu_context.h:248) CPU: 0 PID: 9 Comm: kworker/u320:0 Tainted: G W 6.2.0-rc3-rt1 Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18 Workqueue: efi_rts_wq efi_call_rts Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:158) show_stack (arch/arm64/kernel/stacktrace.c:165) dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) dump_stack (lib/dump_stack.c:114) __might_resched (kernel/sched/core.c:10134) rt_spin_lock (kernel/locking/rtmutex.c:1769 (discriminator 4)) efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) [...] This seems to come from commit ff7a167961d1 ("arm64: efi: Execute runtime services from a dedicated stack") which adds a spinlock. This spinlock is taken through: efi_call_rts() \-efi_call_virt() \-efi_call_virt_pointer() \-arch_efi_call_virt_setup() Make 'efi_rt_lock' a raw_spinlock to avoid being preempted. [ardb: The EFI runtime services are called with a different set of translation tables, and are permitted to use the SIMD registers. The context switch code preserves/restores neither, and so EFI calls must be made with preemption disabled, rather than only disabling migration.] Fixes: ff7a167961d1 ("arm64: efi: Execute runtime services from a dedicated stack") Signed-off-by: Pierre Gondois Cc: # v6.1+ Signed-off-by: Ard Biesheuvel commit 66fb1d5df6ace316a4a6e2c31e13fc123ea2b644 Author: Edward Srouji Date: Thu Feb 16 11:13:45 2023 +0200 IB/mlx5: Extend debug control for CC parameters This patch adds rtt_resp_dscp to the current debug controllability of congestion control (CC) parameters. rtt_resp_dscp can be read or written through debugfs. If set, its value overwrites the DSCP of the generated RTT response. Signed-off-by: Edward Srouji Reviewed-by: Maor Gottlieb Link: https://lore.kernel.org/r/1dcc3440ee53c688f19f579a051ded81a2aaa70a.1676538714.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 85cc91e2ba4262a602ec65e2b76c4391a9e60d3d Author: Elvira Khabirova Date: Sat Feb 18 23:43:59 2023 +0100 mips: fix syscall_get_nr The implementation of syscall_get_nr on mips used to ignore the task argument and return the syscall number of the calling thread instead of the target thread. The bug was exposed to user space by commit 201766a20e30f ("ptrace: add PTRACE_GET_SYSCALL_INFO request") and detected by strace test suite. Link: https://github.com/strace/strace/issues/235 Fixes: c2d9f1775731 ("MIPS: Fix syscall_get_nr for the syscall exit tracing.") Cc: # v3.19+ Co-developed-by: Dmitry V. Levin Signed-off-by: Dmitry V. Levin Signed-off-by: Elvira Khabirova Signed-off-by: Thomas Bogendoerfer commit 6f02e39fa40f16c24e7a5c599a854c0d1682788d Author: Randy Dunlap Date: Fri Feb 17 12:07:49 2023 -0800 MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set When MIPS_CPS=y, MIPS_CPS_PM is not set, HOTPLUG_CPU is not set, and KEXEC=y, cps_shutdown_this_cpu() attempts to call cps_pm_enter_state(), which is not built when MIPS_CPS_PM is not set. Conditionally execute the else branch based on CONFIG_HOTPLUG_CPU to remove the build error. This build failure is from a randconfig file. mips-linux-ld: arch/mips/kernel/smp-cps.o: in function `$L162': smp-cps.c:(.text.cps_kexec_nonboot_cpu+0x31c): undefined reference to `cps_pm_enter_state' Fixes: 1447864bee4c ("MIPS: kexec: CPS systems to halt nonboot CPUs") Signed-off-by: Randy Dunlap Cc: Dengcheng Zhu Cc: Paul Burton Cc: Thomas Bogendoerfer Cc: linux-mips@vger.kernel.org Cc: Sergei Shtylyov Signed-off-by: Thomas Bogendoerfer commit ab47b3dae55300868efd0d4eb0d66a5d43315092 Author: H. Nikolaus Schaller Date: Wed Feb 15 18:31:56 2023 +0100 MIPS: DTS: jz4780: add #clock-cells to rtc_dev This makes the driver present the clk32k signal if requested. It is needed to clock the PMU of the BCM4330 WiFi and Bluetooth module of the CI20 board. Signed-off-by: H. Nikolaus Schaller Reviewed-by: Paul Cercueil Signed-off-by: Thomas Bogendoerfer commit 0f7bfd6f8164be32dbbdf36aa1e5d00485c53cd7 Author: Baokun Li Date: Tue Jan 10 21:34:36 2023 +0800 ext4: fix task hung in ext4_xattr_delete_inode Syzbot reported a hung task problem: ================================================================== INFO: task syz-executor232:5073 blocked for more than 143 seconds. Not tainted 6.2.0-rc2-syzkaller-00024-g512dee0c00ad #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-exec232 state:D stack:21024 pid:5073 ppid:5072 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x995/0xe20 kernel/sched/core.c:6555 schedule+0xcb/0x190 kernel/sched/core.c:6631 __wait_on_freeing_inode fs/inode.c:2196 [inline] find_inode_fast+0x35a/0x4c0 fs/inode.c:950 iget_locked+0xb1/0x830 fs/inode.c:1273 __ext4_iget+0x22e/0x3ed0 fs/ext4/inode.c:4861 ext4_xattr_inode_iget+0x68/0x4e0 fs/ext4/xattr.c:389 ext4_xattr_inode_dec_ref_all+0x1a7/0xe50 fs/ext4/xattr.c:1148 ext4_xattr_delete_inode+0xb04/0xcd0 fs/ext4/xattr.c:2880 ext4_evict_inode+0xd7c/0x10b0 fs/ext4/inode.c:296 evict+0x2a4/0x620 fs/inode.c:664 ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474 __ext4_fill_super fs/ext4/super.c:5516 [inline] ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa5406fd5ea RSP: 002b:00007ffc7232f968 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa5406fd5ea RDX: 0000000020000440 RSI: 0000000020000000 RDI: 00007ffc7232f970 RBP: 00007ffc7232f970 R08: 00007ffc7232f9b0 R09: 0000000000000432 R10: 0000000000804a03 R11: 0000000000000202 R12: 0000000000000004 R13: 0000555556a7a2c0 R14: 00007ffc7232f9b0 R15: 0000000000000000 ================================================================== The problem is that the inode contains an xattr entry with ea_inum of 15 when cleaning up an orphan inode <15>. When evict inode <15>, the reference counting of the corresponding EA inode is decreased. When EA inode <15> is found by find_inode_fast() in __ext4_iget(), it is found that the EA inode holds the I_FREEING flag and waits for the EA inode to complete deletion. As a result, when inode <15> is being deleted, we wait for inode <15> to complete the deletion, resulting in an infinite loop and triggering Hung Task. To solve this problem, we only need to check whether the ino of EA inode and parent is the same before getting EA inode. Link: https://syzkaller.appspot.com/bug?extid=77d6fcc37bbb92f26048 Reported-by: syzbot+77d6fcc37bbb92f26048@syzkaller.appspotmail.com Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230110133436.996350-1-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit e6b9bd7290d334451ce054e98e752abc055e0034 Author: Zhihao Cheng Date: Tue Jan 10 09:53:27 2023 +0800 jbd2: fix data missing when reusing bh which is ready to be checkpointed Following process will make data lost and could lead to a filesystem corrupted problem: 1. jh(bh) is inserted into T1->t_checkpoint_list, bh is dirty, and jh->b_transaction = NULL 2. T1 is added into journal->j_checkpoint_transactions. 3. Get bh prepare to write while doing checkpoing: PA PB do_get_write_access jbd2_log_do_checkpoint spin_lock(&jh->b_state_lock) if (buffer_dirty(bh)) clear_buffer_dirty(bh) // clear buffer dirty set_buffer_jbddirty(bh) transaction = journal->j_checkpoint_transactions jh = transaction->t_checkpoint_list if (!buffer_dirty(bh)) __jbd2_journal_remove_checkpoint(jh) // bh won't be flushed jbd2_cleanup_journal_tail __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved) 4. Aborting journal/Power-cut before writing latest bh on journal area. In this way we get a corrupted filesystem with bh's data lost. Fix it by moving the clearing of buffer_dirty bit just before the call to __jbd2_journal_file_buffer(), both bit clearing and jh->b_transaction assignment are under journal->j_list_lock locked, so that jbd2_log_do_checkpoint() will wait until jh's new transaction fininshed even bh is currently not dirty. And journal_shrink_one_cp_list() won't remove jh from checkpoint list if the buffer head is reused in do_get_write_access(). Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216898 Cc: Signed-off-by: Zhihao Cheng Signed-off-by: zhanchengbin Suggested-by: Jan Kara Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230110015327.1181863-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 3039d8b8692408438a618fac2776b629852663c3 Author: Baokun Li Date: Sat Jan 7 11:21:26 2023 +0800 ext4: update s_journal_inum if it changes after journal replay When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem. So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541 Reported-by: Luís Henriques Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230107032126.4165860-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 5cd740287ae5e3f9d1c46f5bfe8778972fd6d3fe Author: Baokun Li Date: Sat Jan 7 11:21:25 2023 +0800 ext4: fail ext4_iget if special inode unallocated In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is called to get an inode whose i_nlink is 0 when the flag exists, no error is returned. If the inode is a special inode, a null pointer dereference may occur. If the value of i_nlink is 0 for any inodes (except boot loader inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system is corrupted. Therefore, make the ext4_iget() function return an error if it gets such an abnormal special inode. Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539 Reported-by: Luís Henriques Suggested-by: Theodore Ts'o Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230107032126.4165860-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit d99a55a94a0db8eda4a336a6f21730b844b8d2d2 Author: Kees Cook Date: Wed Jan 4 13:09:12 2023 -0800 ext4: fix function prototype mismatch for ext4_feat_ktype With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. ext4_feat_ktype was setting the "release" handler to "kfree", which doesn't have a matching function prototype. Add a simple wrapper with the correct prototype. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Note that this code is only reached when ext4 is a loadable module and it is being unloaded: CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698) ... RIP: 0010:kobject_put+0xbb/0x1b0 ... Call Trace: ext4_exit_sysfs+0x14/0x60 [ext4] cleanup_module+0x67/0xedb [ext4] Fixes: b99fee58a20a ("ext4: create ext4_feat kobject dynamically") Cc: Theodore Ts'o Cc: Eric Biggers Cc: stable@vger.kernel.org Build-tested-by: Gustavo A. R. Silva Reviewed-by: Gustavo A. R. Silva Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230103234616.never.915-kees@kernel.org Signed-off-by: Kees Cook Reviewed-by: Eric Biggers Link: https://lore.kernel.org/r/20230104210908.gonna.388-kees@kernel.org Signed-off-by: Theodore Ts'o commit 7fc51f923ea6b1c6f304789965414149eaedb358 Author: XU pengfei Date: Wed Jan 4 13:52:29 2023 +0800 ext4: remove unnecessary variable initialization Variables are assigned first and then used. Initialization is not required. Signed-off-by: XU pengfei Link: https://lore.kernel.org/r/20230104055229.3663-1-xupengfei@nfschina.com commit 3f5424790d4377839093b68c12b130077a4e4510 Author: zhanchengbin Date: Tue Jan 3 10:28:12 2023 +0800 ext4: fix inode tree inconsistency caused by ENOMEM If ENOMEM fails when the extent is splitting, we need to restore the length of the split extent. In the ext4_split_extent_at function, only in ext4_ext_create_new_leaf will it alloc memory and change the shape of the extent tree,even if an ENOMEM is returned at this time, the extent tree is still self-consistent, Just restore the split extent lens in the function ext4_split_extent_at. ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf 1)ext4_ext_split ext4_find_extent 2)ext4_ext_grow_indepth ext4_find_extent Signed-off-by: zhanchengbin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230103022812.130603-1-zhanchengbin1@huawei.com Signed-off-by: Theodore Ts'o commit f31173c19901a96bb2ebf6bcfec8a08df7095c91 Author: Jun Nie Date: Tue Jan 3 09:45:17 2023 +0800 ext4: refuse to create ea block when umounted The ea block expansion need to access s_root while it is already set as NULL when umount is triggered. Refuse this request to avoid panic. Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08 Link: https://lore.kernel.org/r/20230103014517.495275-3-jun.nie@linaro.org Cc: stable@kernel.org Signed-off-by: Jun Nie Signed-off-by: Theodore Ts'o commit 1e9d62d252812575ded7c620d8fc67c32ff06c16 Author: Jun Nie Date: Tue Jan 3 09:45:16 2023 +0800 ext4: optimize ea_inode block expansion Copy ea data from inode entry when expanding ea block if possible. Then remove the ea entry if expansion success. Thus memcpy to a temporary buffer may be avoided. If the expansion fails, we do not need to recovery the removed ea entry neither in this way. Reported-by: syzbot+2dacb8f015bf1420155f@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=3613786cb88c93aa1c6a279b1df6a7b201347d08 Link: https://lore.kernel.org/r/20230103014517.495275-2-jun.nie@linaro.org Cc: stable@kernel.org Signed-off-by: Jun Nie Signed-off-by: Theodore Ts'o commit 08abd0466ec9113908e674d042ec2a36dfc2875c Author: Tanmay Bhushan <007047221b@gmail.com> Date: Fri Dec 30 15:18:58 2022 +0100 ext4: remove dead code in updating backup sb ext4_update_backup_sb checks for err having some value after unlocking buffer. But err has not been updated till that point in any code which will lead execution of the code in question. Signed-off-by: Tanmay Bhushan <007047221b@gmail.com> Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221230141858.3828-1-007047221b@gmail.com Signed-off-by: Theodore Ts'o commit 6f3ee0e22b4c62f44b8fa3c8de6e369a4d112a75 Merge: 188a569658584 a83bf176fed4e Author: Thomas Gleixner Date: Sun Feb 19 00:07:56 2023 +0100 Merge tag 'irqchip-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - New and improved irqdomain locking, closing a number of races that became apparent now that we are able to probe drivers in parallel - A bunch of OF node refcounting bugs have been fixed - We now have a new IPI mux, lifted from the Apple AIC code and made common. It is expected that riscv will eventually benefit from it - Two small fixes for the Broadcom L2 drivers - Various cleanups and minor bug fixes Link: https://lore.kernel.org/r/20230218143452.3817627-1-maz@kernel.org commit 7568a21e52f60930ba8ae7897c2521bdab3ef5a4 Author: Wang ShaoBo Date: Wed Nov 23 14:51:24 2022 +0800 tracing: Remove unnecessary NULL assignment Remove unnecessary NULL assignment int create_new_subsystem(). Link: https://lkml.kernel.org/r/20221123065124.3982439-1-bobo.shaobowang@huawei.com Signed-off-by: Wang ShaoBo Signed-off-by: Steven Rostedt (Google) commit e7bb66f79a7b19a47b3eff745ea9f7ba1ae76032 Author: Jianlin Lv Date: Wed Nov 2 16:02:36 2022 +0000 tracepoint: Allow livepatch module add trace event In the case of keeping the system running, the preferred method for tracing the kernel is dynamic tracing (kprobe), but the drawback of this method is that events are lost, especially when tracing packages in the network stack. Livepatching provides a potential solution, which is to reimplement the function you want to replace and insert a static tracepoint. In such a way, custom stable static tracepoints can be expanded without rebooting the system. Link: https://lkml.kernel.org/r/20221102160236.11696-1-iecedge@gmail.com Signed-off-by: Jianlin Lv Signed-off-by: Steven Rostedt (Google) commit 2455f0e124d317dd08d337a7550a78a224d4ba41 Author: Ross Zwisler Date: Wed Feb 15 15:33:45 2023 -0700 tracing: Always use canonical ftrace path The canonical location for the tracefs filesystem is at /sys/kernel/tracing. But, from Documentation/trace/ftrace.rst: Before 4.1, all ftrace tracing control files were within the debugfs file system, which is typically located at /sys/kernel/debug/tracing. For backward compatibility, when mounting the debugfs file system, the tracefs file system will be automatically mounted at: /sys/kernel/debug/tracing Many comments and Kconfig help messages in the tracing code still refer to this older debugfs path, so let's update them to avoid confusion. Link: https://lore.kernel.org/linux-trace-kernel/20230215223350.2658616-2-zwisler@google.com Acked-by: Masami Hiramatsu (Google) Reviewed-by: Mukesh Ojha Signed-off-by: Ross Zwisler Signed-off-by: Steven Rostedt (Google) commit 03fada47311a3e668f73efc9278c4a559e64ee85 Author: Mehdi Djait Date: Sat Feb 18 14:51:11 2023 +0100 iio: accel: kionix-kx022a: Get the timestamp from the driver's private data in the trigger_handler The trigger_handler gets called from the IRQ thread handler using iio_trigger_poll_chained() which will only call the bottom half of the pollfunc and therefore pf->timestamp will not get set. Use instead the timestamp from the driver's private data which is always set in the IRQ handler. Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer") Link: https://lore.kernel.org/linux-iio/Y+6QoBLh1k82cJVN@carbian/ Reviewed-by: Matti Vaittinen Signed-off-by: Mehdi Djait Link: https://lore.kernel.org/r/20230218135111.90061-1-mehdi.djait.k@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 0c6ef985a1fd8a74dcb5cad941ddcadd55cb8697 Author: Nuno Sá Date: Fri Jan 20 13:46:45 2023 +0100 iio: adc: ad7791: fix IRQ flags The interrupt is triggered on the falling edge rather than being a level low interrupt. Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20230120124645.819910-1-nuno.sa@analog.com Signed-off-by: Jonathan Cameron commit 4ecc96cba8d93d86abf46d17067e9b4c96241a29 Author: Thomas Weißschuh Date: Thu Feb 16 01:10:59 2023 +0000 xen: sysfs: make kobj_type structure constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definition to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230216-kobj_type-xen-v1-1-742423de7d71@weissschuh.net Signed-off-by: Juergen Gross commit ed9a8ad7d8a1a0eb7d4e1414d0a04ece7c2265df Author: Miquel Raynal Date: Tue Feb 14 14:50:35 2023 +0100 ieee802154: Drop device trackers In order to prevent a device from disappearing when a background job was started, dev_hold() and dev_put() calls were made. During the stabilization phase of the scan/beacon features, it was later decided that removing the device while a background job was ongoing was a valid use case, and we should instead stop the background job and then remove the device, rather than prevent the device from being removed. This is what is currently done, which means manually reference counting the device during background jobs is no longer needed. Fixes: ed3557c947e1 ("ieee802154: Add support for user scanning requests") Fixes: 9bc114504b07 ("ieee802154: Add support for user beaconing requests") Reported-by: Jakub Kicinski Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230214135035.1202471-7-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit 61d7dddf46caa1c6dd869385a275e4d2931e7090 Author: Miquel Raynal Date: Tue Feb 14 14:50:34 2023 +0100 mac802154: Fix an always true condition At this stage we simply do not care about the delayed work value, because active scan is not yet supported, so we can blindly queue another work once a beacon has been sent. It fixes a smatch warning: mac802154_beacon_worker() warn: always true condition '(local->beacon_interval >= 0) => (0-u32max >= 0)' Fixes: 3accf4762734 ("mac802154: Handle basic beaconing") Reported-by: kernel test robot Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230214135035.1202471-6-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit 1375e3ba9d773f2dbac96ebddfdd0d160276ca40 Author: Miquel Raynal Date: Tue Feb 14 14:50:33 2023 +0100 mac802154: Send beacons using the MLME Tx path Using ieee802154_subif_start_xmit() to bypass the net queue when sending beacons is broken because it does not acquire the HARD_TX_LOCK(), hence not preventing datagram buffers to be smashed by beacons upon contention situation. Using the mlme_tx helper is not the best fit either but at least it is not buggy and has little-to-no performance hit. More details are given in the comment explaining this choice in the code. Fixes: 3accf4762734 ("mac802154: Handle basic beaconing") Reported-by: Alexander Aring Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230214135035.1202471-5-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit 1edecbd0bd45c9c899e0f82b123342f28423468c Author: Miquel Raynal Date: Tue Feb 14 14:50:32 2023 +0100 ieee802154: Change error code on monitor scan netlink request Returning EPERM gives the impression that "right now" it is not possible, but "later" it could be, while what we want to express is the fact that this is not currently supported at all (might change in the future). So let's return EOPNOTSUPP instead. Fixes: ed3557c947e1 ("ieee802154: Add support for user scanning requests") Suggested-by: Alexander Aring Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230214135035.1202471-4-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit a0b6106672b53158bf141d1a713aef2c891d74b1 Author: Miquel Raynal Date: Tue Feb 14 14:50:31 2023 +0100 ieee802154: Convert scan error messages to extack Instead of printing error messages in the kernel log, let's use extack. When there is a netlink error returned that could be further specified with a string, use extack as well. Apply this logic to the very recent scan/beacon infrastructure. Fixes: ed3557c947e1 ("ieee802154: Add support for user scanning requests") Fixes: 9bc114504b07 ("ieee802154: Add support for user beaconing requests") Suggested-by: Jakub Kicinski Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230214135035.1202471-3-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit 648324c9b690bcda0ac6f6499370effc0336ee27 Author: Miquel Raynal Date: Tue Feb 14 14:50:30 2023 +0100 ieee802154: Use netlink policies when relevant on scan parameters Instead of open-coding scan parameters (page, channels, duration, etc), let's use the existing NLA_POLICY* macros. This help greatly reducing the error handling and clarifying the overall logic. Fixes: ed3557c947e1 ("ieee802154: Add support for user scanning requests") Suggested-by: Jakub Kicinski Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230214135035.1202471-2-miquel.raynal@bootlin.com Signed-off-by: Stefan Schmidt commit bedd29d793da3312e1350a56245c4971a38d4453 Merge: ceaa837f96adb 9e6a1825aca85 2f599c3ff4e6f 1505e7215eb73 9e6132179a62f 257ec29074192 f451c7a5a3b81 2cc73c5712f97 Author: Joerg Roedel Date: Sat Feb 18 15:43:04 2023 +0100 Merge branches 'apple/dart', 'arm/exynos', 'arm/renesas', 'arm/smmu', 'x86/vt-d', 'x86/amd' and 'core' into next commit f451c7a5a3b818ecfeba2ba258570769998baf3a Author: Vasant Hegde Date: Wed Feb 15 05:26:41 2023 +0000 iommu/amd: Skip attach device domain is same as new domain If device->domain is same as new domain then we can skip the device attach process. Signed-off-by: Vasant Hegde Link: https://lore.kernel.org/r/20230215052642.6016-2-vasant.hegde@amd.com Signed-off-by: Joerg Roedel commit 2cc73c5712f97de98c38c2fafc1f288354a9f3c3 Author: Vasant Hegde Date: Wed Feb 15 05:26:40 2023 +0000 iommu: Attach device group to old domain in error path iommu_attach_group() attaches all devices in a group to domain and then sets group domain (group->domain). Current code (__iommu_attach_group()) does not handle error path. This creates problem as devices to domain attachment is in inconsistent state. Flow: - During boot iommu attach devices to default domain - Later some device driver (like amd/iommu_v2 or vfio) tries to attach device to new domain. - In iommu_attach_group() path we detach device from current domain. Then it tries to attach devices to new domain. - If it fails to attach device to new domain then device to domain link is broken. - iommu_attach_group() returns error. - At this stage iommu_attach_group() caller thinks, attaching device to new domain failed and devices are still attached to old domain. - But in reality device to old domain link is broken. It will result in all sort of failures (like IO page fault) later. To recover from this situation, we need to attach all devices back to the old domain. Also log warning if it fails attach device back to old domain. Suggested-by: Lu Baolu Reported-by: Matt Fagnani Signed-off-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Tested-by: Matt Fagnani Link: https://lore.kernel.org/r/20230215052642.6016-1-vasant.hegde@amd.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=216865 Link: https://lore.kernel.org/lkml/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@leemhuis.info/ Signed-off-by: Joerg Roedel commit a83bf176fed4ee88dad84d59f77dde153b9a442a Merge: 7135b35fc9596 13a157b38ca5b Author: Marc Zyngier Date: Sat Feb 18 14:25:09 2023 +0000 Merge branch irq/bcm-l2-fixes into irq/irqchip-next * irq/bcm-l2-fixes: : . : Broadcom L2 irqchip fixes for correct handling of level interrupts, : courtesy of Florian Fainelli. : . irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts Signed-off-by: Marc Zyngier commit 13a157b38ca5b4f9eed81442b8821db293755961 Author: Florian Fainelli Date: Fri Dec 16 15:09:34 2022 -0800 irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts When support for the interrupt controller was added with a5042de2688d, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that. Fixes: a5042de2688d ("irqchip: bcm7120-l2: Add Broadcom BCM7120-style Level 2 interrupt controller") Signed-off-by: Florian Fainelli Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20221216230934.2478345-3-f.fainelli@gmail.com commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 Author: Florian Fainelli Date: Fri Dec 16 15:09:33 2022 -0800 irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts When support for the level triggered interrupt controller flavor was added with c0ca7262088e, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that. Fixes: c0ca7262088e ("irqchip/brcmstb-l2: Add support for the BCM7271 L2 controller") Signed-off-by: Florian Fainelli Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20221216230934.2478345-2-f.fainelli@gmail.com commit 000987a38b53c172f435142a4026dd71378ca464 Author: George Cherian Date: Thu Feb 9 02:11:17 2023 +0000 watchdog: sbsa_wdog: Make sure the timeout programming is within the limits Make sure to honour the max_hw_heartbeat_ms while programming the timeout value to WOR. Clamp the timeout passed to sbsa_gwdt_set_timeout() to make sure the programmed value is within the permissible range. Fixes: abd3ac7902fb ("watchdog: sbsa: Support architecture version 1") Signed-off-by: George Cherian Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230209021117.1512097-1-george.cherian@marvell.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit c76675f4ef35504eb1df8f0f0f0c1e2675d75f67 Author: Bartosz Golaszewski Date: Wed Feb 1 16:20:36 2023 +0100 dt-bindings: watchdog: qcom-wdt: add qcom,apss-wdt-sa8775p compatible Add a compatible for the sa8775p platform's KPSS watchdog. Signed-off-by: Bartosz Golaszewski Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230201152038.203387-4-brgl@bgdev.pl Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ad8bc199b2e3197f53228fba05128069e31893c7 Author: Thomas Weißschuh Date: Mon Dec 19 21:30:40 2022 +0000 watchdog: report options in sysfs This synchronizes the information reported by ioctl and sysfs. The mismatch is confusing because "wdctl" from util-linux uses the ioctl when used with root privileges and sysfs without. Signed-off-by: Thomas Weißschuh Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221216-watchdog-sysfs-v2-2-6189311103a9@weissschuh.net [groeck: Fixed continuation line alignment] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b852e7a4a9ab6a1fb08c5aa36b1043672fd814dc Author: Thomas Weißschuh Date: Mon Dec 19 21:30:39 2022 +0000 watchdog: report fw_version in sysfs This synchronizes the information reported by ioctl and sysfs. The mismatch is confusing because "wdctl" from util-linux uses the ioctl when used with root privileges and sysfs without. The file is called "fw_version" instead of "firmware_version" as "firmware_version" is already used as custom attribute by single drivers. Signed-off-by: Thomas Weißschuh Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221216-watchdog-sysfs-v2-1-6189311103a9@weissschuh.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 12878a9fff5a2d45f4f5c71c83fee77f94aa1f8c Author: Andrej Picej Date: Fri Nov 4 08:03:57 2022 +0100 dt-bindings: watchdog: fsl-imx: document suspend in wait mode Property "fsl,suspend-in-wait" suspends watchdog in "WAIT" mode which corresponds to Linux's Suspend-to-Idle S0 mode. If this property is not set and the device is put into Suspend-to-Idle mode, the watchdog triggers a reset after 128 seconds. Signed-off-by: Andrej Picej Reviewed-by: Fabio Estevam Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221104070358.426657-3-andrej.picej@norik.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e42c73f1ef0da5970a71f98440193fa9b1e9fb86 Author: Andrej Picej Date: Fri Nov 4 08:03:56 2022 +0100 watchdog: imx2_wdg: suspend watchdog in WAIT mode Putting device into the "Suspend-To-Idle" mode causes watchdog to trigger and resets the board after set watchdog timeout period elapses. Introduce new device-tree property "fsl,suspend-in-wait" which suspends watchdog in WAIT mode. This is done by setting WDW bit in WCR (Watchdog Control Register). Watchdog operation is restored after exiting WAIT mode as expected. WAIT mode corresponds with Linux's "Suspend-To-Idle". Signed-off-by: Andrej Picej Reviewed-by: Fabio Estevam Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221104070358.426657-2-andrej.picej@norik.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7d06c07c67100fd0f8e6b3ab7145ce789f788117 Author: Li Hua Date: Wed Nov 16 10:07:06 2022 +0800 watchdog: pcwd_usb: Fix attempting to access uninitialized memory The stack variable msb and lsb may be used uninitialized in function usb_pcwd_get_temperature and usb_pcwd_get_timeleft when usb card no response. The build waring is: drivers/watchdog/pcwd_usb.c:336:22: error: ‘lsb’ is used uninitialized in this function [-Werror=uninitialized] *temperature = (lsb * 9 / 5) + 32; ~~~~^~~ drivers/watchdog/pcwd_usb.c:328:21: note: ‘lsb’ was declared here unsigned char msb, lsb; ^~~ cc1: all warnings being treated as errors scripts/Makefile.build:250: recipe for target 'drivers/watchdog/pcwd_usb.o' failed make[3]: *** [drivers/watchdog/pcwd_usb.o] Error 1 Fixes: b7e04f8c61a4 ("mv watchdog tree under drivers") Signed-off-by: Li Hua Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221116020706.70847-1-hucool.lihua@huawei.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 733318534849044089de8c818a2fb1c67fa39bd1 Author: Krzysztof Kozlowski Date: Fri Jan 13 11:33:45 2023 +0100 dt-bindings: watchdog: qcom-wdt: merge MSM timer Merge Qualcomm MSM timer bindings into watchdog, because the timer compatibles are already included here and the hardware is quite similar. While converting the MSM timer bindings, adjust clock-frequency property to take only one frequency, instead of two, because: 1. DT schema does not allow to frequencies, 2. The Linux timer driver reads only first frequency. Signed-off-by: Krzysztof Kozlowski Acked-by: Daniel Lezcano Reviewed-by: Guenter Roeck Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20221212163532.142533-6-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7c631cdff391dd8af4e56fc4cd162d6e6504aeec Author: Krzysztof Kozlowski Date: Fri Jan 13 11:33:44 2023 +0100 dt-bindings: watchdog: qcom-wdt: allow interrupts Both of type of watchdogs described in the binding (the KPSS watchdog and APSS WDT timer) have interrupts. Allow interrupts and describe them for KPSS watchdog to fix warnings like: watchdog@17c10000: Unevaluated properties are not allowed ('interrupts' was unexpected) Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221212163532.142533-5-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 2bb28d179891cb073ea96fb9238257f871e158c1 Author: Krzysztof Kozlowski Date: Fri Jan 13 11:33:43 2023 +0100 dt-bindings: watchdog: qcom-wdt: add qcom,kpss-wdt-mdm9615 Document new MDM9615 qcom,kpss-wdt-mdm9615 watchdog/timer compatible. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221212163532.142533-4-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit b8c8f8649ba1765cbd7e5c92f36c6553a9fadedf Author: Krzysztof Kozlowski Date: Fri Jan 13 11:33:42 2023 +0100 dt-bindings: watchdog: qcom-wdt: fix list of MSM timer compatibles The MSM timer ("qcom,msm-timer") is a bit different timer and watchdog device than KPSS watchdog. It has its own generic and specific compatibles, so fix the list to reflect this. Adjust the example to show the newer KPSS watchdog. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221212163532.142533-3-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f8e6b3d9e3cf60bb111ccc9294eb3fe7c7759193 Author: Krzysztof Kozlowski Date: Fri Jan 13 11:33:41 2023 +0100 dt-bindings: watchdog: qcom-wdt: do not allow fallback alone The compatible "qcom,kpss-wdt" is too generic and should not be used alone. Mark it as deprecated when not prepended by specific compatible. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221212163532.142533-2-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8e103beca676b871e06d282ed140bf5a3631e381 Author: Krzysztof Kozlowski Date: Fri Jan 13 11:33:40 2023 +0100 dt-bindings: watchdog: qcom-wdt: require fallback for IPQ4019 The device specific compatibles ("qcom,kpss-wdt-ipq4019") should be follwed by fallback "qcom,kpss-wdt", which is actually used by Linux driver for binding. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221212163532.142533-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 13721a2ac66b246f5802ba1b75ad8637e53eeecc Author: Chen Jun Date: Wed Nov 16 01:27:14 2022 +0000 watchdog: Fix kmemleak in watchdog_cdev_register kmemleak reports memory leaks in watchdog_dev_register, as follows: unreferenced object 0xffff888116233000 (size 2048): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 32 bytes): 80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff .........0#..... 08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00 .0#............. backtrace: [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<000000006a389304>] kmalloc_trace+0x21/0x110 [<000000008d640eea>] watchdog_dev_register+0x4e/0x780 [watchdog] [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ... unreferenced object 0xffff888105b9fa80 (size 16): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 16 bytes): 77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff watchdog1....... backtrace: [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<00000000486ab89b>] __kmalloc_node_track_caller+0x44/0x1b0 [<000000005a39aab0>] kvasprintf+0xb5/0x140 [<0000000024806f85>] kvasprintf_const+0x55/0x180 [<000000009276cb7f>] kobject_set_name_vargs+0x56/0x150 [<00000000a92e820b>] dev_set_name+0xab/0xe0 [<00000000cec812c6>] watchdog_dev_register+0x285/0x780 [watchdog] [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ... The reason is that put_device is not be called if cdev_device_add fails and wdd->id != 0. watchdog_cdev_register wd_data = kzalloc [1] err = dev_set_name [2] .. err = cdev_device_add if (err) { if (wdd->id == 0) { // wdd->id != 0 .. } return err; // [1],[2] would be leaked To fix it, call put_device in all wdd->id cases. Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev") Signed-off-by: Chen Jun Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221116012714.102066-1-chenjun102@huawei.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a243cb9357cc21a441c464e63b151e292a732d56 Author: Christophe JAILLET Date: Sat Nov 5 12:09:34 2022 +0100 watchdog: Include when appropriate The kstrto() functions have been moved from kernel.h to kstrtox.h. So, in order to eventually remove from , include the latter directly in the appropriate files. Signed-off-by: Christophe JAILLET Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/08fd5512e569558231247515c04c8596a1d11004.1667646547.git.christophe.jaillet@wanadoo.fr Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 07bec0e09c1afbab4c5674fd2341f4f52d594f30 Author: ruanjinjie Date: Wed Nov 16 17:49:50 2022 +0800 watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path free_irq() is missing in case of error in at91_wdt_init(), use devm_request_irq to fix that. Fixes: 5161b31dc39a ("watchdog: at91sam9_wdt: better watchdog support") Signed-off-by: ruanjinjie Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221116094950.3141943-1-ruanjinjie@huawei.com [groeck: Adjust multi-line alignment] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f769f97917c1e756e12ff042a93f6e3167254b5b Author: Fabrizio Castro Date: Thu Nov 17 11:49:07 2022 +0000 watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M As per section 48.4 of the HW User Manual, IPs in the RZ/V2M SoC need either a TYPE-A reset sequence or a TYPE-B reset sequence. More specifically, the watchdog IP needs a TYPE-B reset sequence. If the proper reset sequence isn't implemented, then resetting IPs may lead to undesired behaviour. In the restart callback of the watchdog driver the reset has basically no effect on the desired funcionality, as the register writes following the reset happen before the IP manages to come out of reset. Implement the TYPE-B reset sequence in the watchdog driver to address the issues with the restart callback on RZ/V2M. Fixes: ec122fd94eeb ("watchdog: rzg2l_wdt: Add rzv2m support") Signed-off-by: Fabrizio Castro Reviewed-by: Guenter Roeck Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20221117114907.138583-3-fabrizio.castro.jz@renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6ba6f0f5910d5916539268c0ad55657bb8940616 Author: Lad Prabhakar Date: Thu Nov 17 11:49:06 2022 +0000 watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks On RZ/Five SoC it was observed that setting timeout (to say 1 sec) wouldn't reset the system. The procedure described in the HW manual (Procedure for Activating Modules) for activating the target module states we need to start supply of the clock module before applying the reset signal. This patch makes sure we follow the same procedure to clear the registers of the WDT module, fixing the issues seen on RZ/Five SoC. While at it re-used rzg2l_wdt_stop() in rzg2l_wdt_set_timeout() as it has the same function calls. Fixes: 4055ee81009e ("watchdog: rzg2l_wdt: Add set_timeout callback") Signed-off-by: Lad Prabhakar Reviewed-by: Guenter Roeck Reviewed-by: Geert Uytterhoeven Reviewed-by: Biju Das Link: https://lore.kernel.org/r/20221117114907.138583-2-fabrizio.castro.jz@renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e9651838fe7727c1c8b193b0217307c4c2260777 Author: Konrad Dybcio Date: Thu Nov 17 11:58:45 2022 +0100 dt-bindings: watchdog: Add MSM8994 watchdog timer Document the MSM8994 watchdog timer which is already used in DT. Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221117105845.13644-2-konrad.dybcio@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit d237c8d06d5a08a2dacb07c0ab07af696a58516c Author: Lad Prabhakar Date: Fri Nov 18 13:38:29 2022 +0000 dt-bindings: watchdog: renesas,wdt: Document RZ/Five SoC The WDT block on the RZ/Five SoC is identical to one found on the RZ/G2UL SoC. "renesas,r9a07g043-wdt" compatible string will be used on the RZ/Five SoC so to make this clear, update the comment to include RZ/Five SoC. No driver changes are required as generic compatible string "renesas,rzg2l-wdt" will be used as a fallback on RZ/Five SoC. Signed-off-by: Lad Prabhakar Acked-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20221118133829.12855-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 69197b43d9e3b164e847beede62d576ee01ee081 Author: Neil Armstrong Date: Mon Jan 23 11:10:00 2023 +0100 dt-bindings: watchdog: convert meson-wdt.txt to dt-schema Convert the Amlogic Meson6 SoCs Watchdog timer bindings to dt-schema. Take in account the used interrupts property. The "amlogic,meson8-wdt" representation has been simplified since there's no users of this compatible used along the "amlogic,meson6-wdt". Reviewed-by: Krzysztof Kozlowski Reviewed-by: Martin Blumenstingl Signed-off-by: Neil Armstrong Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221117-b4-amlogic-bindings-convert-v3-3-e28dd31e3bed@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 71708daa6f1446248de107e04cf28ffd322c800f Author: Robert Marko Date: Fri Nov 25 12:29:04 2022 +0100 dt-bindings: watchdog: Convert GPIO binding to json-schema Convert the DT binding for GPIO WDT to JSON schema. Cc: luka.perkov@sartura.hr Signed-off-by: Robert Marko Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221125112904.48652-1-robert.marko@sartura.hr Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 7bfd2747d3ec2c400857084527448c172a720d2a Author: Cosmin Tanislav Date: Fri Nov 18 17:08:09 2022 +0200 watchdog: dw_wdt: stop on reboot HW running watchdogs are just watchdogs that are enabled before the Linux driver is probed, usually by the bootloader (eg. U-Boot). When the system is shutting down, the mechanism for keeping a HW running watchdog pinged is also stopped, but the watchdog itself is not stopped, causing a reset, and preventing the system from being shut down. Opt into stopping watchdogs on reboot. Signed-off-by: Cosmin Tanislav Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221118150809.102505-1-cosmin.tanislav@analog.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0d9e42e3c8ccde51a9ff7c49684ed7a3805ebd52 Author: Uwe Kleine-König Date: Fri Nov 18 23:45:30 2022 +0100 watchdog: ziirave_wdt: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221118224540.619276-597-uwe@kleine-koenig.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 4ea6b986dfaff19e014ea634bdca669eebe73def Author: Thomas Weißschuh Date: Fri Nov 25 23:12:40 2022 +0100 watchdog: iTCO_wdt: Report firmware_version Synchronize the reported information in dmesg and the watchdog APIs. Signed-off-by: Thomas Weißschuh Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221125221240.2818-1-linux@weissschuh.net Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e8b1cb537b8095e1bc528ce2aef56318195d8343 Author: Krzysztof Kozlowski Date: Fri Jan 13 11:33:46 2023 +0100 dt-bindings: watchdog: allow "timer" as node name On some SoCs the watchdog device is actually mixed with timer, e.g. the qcom,msm-timer on older Qualcomm SoCs where this is actually one hardware block responsible for both system timer and watchdog. Allow calling such device nodes as "timer". Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221212174933.208900-1-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f8ee39b44b75ac955bb54f46d5370481727c47e7 Author: Primoz Fiser Date: Fri Dec 16 09:36:45 2022 +0100 watchdog: da9062: da9063: use unlocked xfer function in restart Machine resets via da9062/da9063 PMICs are challenging since one needs to use special i2c atomic transfers due to the fact interrupts are disabled in such late system stages. This is the reason both PMICs don't use regmap and have instead opted for i2c_smbus_write_byte_data() in restart handlers. However extensive testing revealed that even using atomic safe function is not enough and occasional resets fail with error message "Failed to shutdown (err = -11)". This is due to the fact that function i2c_smbus_write_byte_data() in turn calls __i2c_lock_bus_helper() which might fail with -EAGAIN when bus lock is already taken and cannot be released anymore. Thus replace i2c_smbus_write_byte_data() with unlocked flavor of i2c_smbus_xfer() function to avoid above dead-lock scenario. At this system stage we don't care about proper locking anymore and only want proper machine reset to be carried out. Signed-off-by: Primoz Fiser Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20221216083645.2574077-1-primoz.fiser@norik.com [groeck: Fixed continuation line alignment] Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3da1814184582ed0faf039275a3f02e6f69944ee Author: Nuno Sá Date: Thu Feb 16 11:14:51 2023 +0100 iio: buffer: make sure O_NONBLOCK is respected For output buffers, there's no guarantee that the buffer won't be full in the first iteration of the loop in which case we would block independently of userspace passing O_NONBLOCK or not. Fix it by always checking the flag before going to sleep. While at it (and as it's a bit related), refactored the loop so that the stop condition is 'written != n', i.e, run the loop until all data has been copied into the IIO buffers. This makes the code a bit simpler. Fixes: 9eeee3b0bf190 ("iio: Add output buffer support") Signed-off-by: Nuno Sá Reviewed-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20230216101452.591805-3-nuno.sa@analog.com Cc: Signed-off-by: Jonathan Cameron commit b5184a26a28fac1d708b0bfeeb958a9260c2924c Author: Nuno Sá Date: Thu Feb 16 11:14:50 2023 +0100 iio: buffer: correctly return bytes written in output buffers If for some reason 'rb->access->write()' does not write the full requested data and the O_NONBLOCK is set, we would return 'n' to userspace which is not really truth. Hence, let's return the number of bytes we effectively wrote. Fixes: 9eeee3b0bf190 ("iio: Add output buffer support") Signed-off-by: Nuno Sá Reviewed-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20230216101452.591805-2-nuno.sa@analog.com Cc: Signed-off-by: Jonathan Cameron commit 96a4627dbbd48144a65af936b321701c70876026 Merge: 5dc4c995db9eb 0d3b2b4d23641 Author: Marc Zyngier Date: Sat Feb 18 14:06:10 2023 +0000 Merge tag ' https://github.com/oupton/linux tags/kvmarm-6.3' from into kvmarm-master/next Merge Oliver's kvmarm-6.3 tag: KVM/arm64 updates for 6.3 - Provide a virtual cache topology to the guest to avoid inconsistencies with migration on heterogenous systems. Non secure software has no practical need to traverse the caches by set/way in the first place. - Add support for taking stage-2 access faults in parallel. This was an accidental omission in the original parallel faults implementation, but should provide a marginal improvement to machines w/o FEAT_HAFDBS (such as hardware from the fruit company). - A preamble to adding support for nested virtualization to KVM, including vEL2 register state, rudimentary nested exception handling and masking unsupported features for nested guests. - Fixes to the PSCI relay that avoid an unexpected host SVE trap when resuming a CPU when running pKVM. - VGIC maintenance interrupt support for the AIC - Improvements to the arch timer emulation, primarily aimed at reducing the trap overhead of running nested. - Add CONFIG_USERFAULTFD to the KVM selftests config fragment in the interest of CI systems. - Avoid VM-wide stop-the-world operations when a vCPU accesses its own redistributor. - Serialize when toggling CPACR_EL1.SMEN to avoid unexpected exceptions in the host. - Aesthetic and comment/kerneldoc fixes - Drop the vestiges of the old Columbia mailing list and add myself as co-maintainer This also drags in a couple of branches to avoid conflicts: - The shared 'kvm-hw-enable-refactor' branch that reworks initialization, as it conflicted with the virtual cache topology changes. - arm64's 'for-next/sme2' branch, as the PSCI relay changes, as both touched the EL2 initialization code. Signed-off-by: Marc Zyngier commit 0d9bdd8a550170306c2021b8d6766c5343b870c2 Author: Hans de Goede Date: Fri Feb 17 15:42:08 2023 +0100 platform/x86: nvidia-wmi-ec-backlight: Add force module parameter On some Lenovo Legion models, the backlight might be driven by either one of nvidia_wmi_ec_backlight or amdgpu_bl0 at different times. When the Nvidia WMI EC backlight interface reports the backlight is controlled by the EC, the current backlight handling only registers nvidia_wmi_ec_backlight (and registers no other backlight interfaces). This hides (never registers) the amdgpu_bl0 interface, where as prior to 6.1.4 users would have both nvidia_wmi_ec_backlight and amdgpu_bl0 and could work around things in userspace. Add a force module parameter which can be used with acpi_backlight=native to restore the old behavior as a workound (for now) by passing: "acpi_backlight=native nvidia-wmi-ec-backlight.force=1" Fixes: 8d0ca287fd8c ("platform/x86: nvidia-wmi-ec-backlight: Use acpi_video_get_backlight_type()") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217026 Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Reviewed-by: Daniel Dadap Link: https://lore.kernel.org/r/20230217144208.5721-1-hdegoede@redhat.com commit 993fd9bd656a082c9b713171622c70f72f0af59f Author: Gal Pressman Date: Wed Feb 15 16:09:18 2023 -0800 net/mlx5e: RX, Remove doubtful unlikely call When building an skb in non-linear mode, it is not likely nor unlikely that the xdp buff has fragments, it depends on the size of the packet received. Signed-off-by: Gal Pressman Signed-off-by: Saeed Mahameed Reviewed-by: Maciej Fijalkowski commit afce9271facb4cd41ffdf063cc6dd3d67341e723 Author: Tariq Toukan Date: Wed Feb 15 16:09:17 2023 -0800 net/mlx5e: Fix outdated TLS comment Comment is outdated since commit 40379a0084c2 ("net/mlx5_fpga: Drop INNOVA TLS support"). Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed commit b5618a6b19c9dfead5133b72c40112f343b55d76 Author: Tariq Toukan Date: Wed Feb 15 16:09:16 2023 -0800 net/mlx5e: Remove unused function mlx5e_sq_xmit_simple The last usage was removed as part of commit 40379a0084c2 ("net/mlx5_fpga: Drop INNOVA TLS support"). Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed commit f869bcb0d28ec981dd5f6d1958c607c457c1bb26 Author: Vlad Buslov Date: Sun Nov 6 17:22:21 2022 +0100 net/mlx5e: Allow offloading of ct 'new' match Allow offloading filters that match on conntrack 'new' state in order to enable UDP NEW offload in the following patch. Unhardcode ct 'established' from ct modify header infrastructure code and determine correct ct state bit according to the metadata action 'cookie' field. Signed-off-by: Vlad Buslov Reviewed-by: Oz Shlomo Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 94ceffb48eac7692677d8093dcde6965b70c4b35 Author: Vlad Buslov Date: Thu Dec 1 16:56:10 2022 +0100 net/mlx5e: Implement CT entry update With support for UDP NEW offload the flow_table may now send updates for existing flows. Support properly replacing existing entries by updating flow restore_cookie and replacing the rule with new one with the same match but new mod_hdr action that sets updated ctinfo. Signed-off-by: Vlad Buslov Reviewed-by: Oz Shlomo Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 3ac0b6aa892a1961d3bc62c87e3e3c9646e9d309 Author: Parav Pandit Date: Wed Feb 15 16:09:13 2023 -0800 net/mlx5: Simplify eq list traversal EQ list is read only while finding the matching EQ. Hence, avoid *_safe() version. Signed-off-by: Parav Pandit Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed Reviewed-by: Maciej Fijalkowski commit 9da5294e2c6adc7169ccdfa5bef87f9e893d5a12 Author: Tariq Toukan Date: Wed Feb 15 16:09:12 2023 -0800 net/mlx5e: Remove redundant page argument in mlx5e_xdp_handle() Remove the page parameter, it can be derived from the xdp_buff member of mlx5e_xdp_buff. Signed-off-by: Tariq Toukan Reviewed-by: Dragos Tatulea Signed-off-by: Saeed Mahameed commit bfc63c9796900b4f72a0700ac68e4c6306017833 Author: Tariq Toukan Date: Wed Feb 15 16:09:11 2023 -0800 net/mlx5e: Remove redundant page argument in mlx5e_xmit_xdp_buff() Remove the page parameter, it can be derived from the xdp_buff. Signed-off-by: Tariq Toukan Reviewed-by: Dragos Tatulea Signed-off-by: Saeed Mahameed commit 53ee9142717714881fe0b4292b237e1707246f2c Author: Tariq Toukan Date: Wed Feb 15 16:09:10 2023 -0800 net/mlx5e: Switch to using napi_build_skb() Use napi_build_skb() which uses NAPI percpu caches to obtain skbuff_head instead of inplace allocation. napi_build_skb() calls napi_skb_cache_get(), which returns a cached skb, or allocates a bulk of NAPI_SKB_CACHE_BULK (16) if cache is empty. Performance test: TCP single stream, single ring, single core, default MTU (1500B). Before: 26.5 Gbits/sec After: 30.1 Gbits/sec (+13.6%) Signed-off-by: Tariq Toukan Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed Reviewed-by: Maciej Fijalkowski Reviewed-by: Alexander Lobakin commit 20e7da1bbba8474839157fb28fb538d2c058128d Author: Jan Beulich Date: Wed Feb 15 12:27:52 2023 +0100 x86/Xen: drop leftover VM-assist uses Both the 4Gb-segments and the PAE-extended-CR3 one are applicable to 32-bit guests only. The PAE-extended-CR3 use, furthermore, was redundant with the PAE_MODE ELF note anyway. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/215515af-cfb9-3237-03ba-3312e3fa0d34@suse.com Signed-off-by: Juergen Gross commit d065155ec876a65c26bdb414d34feebf3ffdb643 Author: Marek Vasut Date: Fri Dec 16 22:09:22 2022 +0100 clk: rs9: Drop unused pin_xin field The pin_xin field in struct rs9_driver_data is unused, drop it. Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20221216210922.592926-1-marex@denx.de Reviewed-by: Alexander Stein Signed-off-by: Stephen Boyd commit e45dbb81b3953089e048ab4aa2c89aedfb126053 Author: Abel Vesa Date: Mon Feb 13 10:10:38 2023 +0200 MAINTAINERS: clk: imx: Add Peng Fan as reviewer Peng Fan will step up to help with reviewing. Add his email to the i.MX clocks drivers entry. Cc: Peng Fan Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20230213081038.3958833-1-abel.vesa@linaro.org Thanks!! Acked-by: Peng Fan : Signed-off-by: Stephen Boyd commit e686c32590f40bffc45f105c04c836ffad3e531a Author: Dan Williams Date: Thu Feb 16 00:36:02 2023 -0800 dax/kmem: Fix leak of memory-hotplug resources While experimenting with CXL region removal the following corruption of /proc/iomem appeared. Before: f010000000-f04fffffff : CXL Window 0 f010000000-f02fffffff : region4 f010000000-f02fffffff : dax4.0 f010000000-f02fffffff : System RAM (kmem) After (modprobe -r cxl_test): f010000000-f02fffffff : **redacted binary garbage** f010000000-f02fffffff : System RAM (kmem) ...and testing further the same is visible with persistent memory assigned to kmem: Before: 480000000-243fffffff : Persistent Memory 480000000-57e1fffff : namespace3.0 580000000-243fffffff : dax3.0 580000000-243fffffff : System RAM (kmem) After (ndctl disable-region all): 480000000-243fffffff : Persistent Memory 580000000-243fffffff : ***redacted binary garbage*** 580000000-243fffffff : System RAM (kmem) The corrupted data is from a use-after-free of the "dax4.0" and "dax3.0" resources, and it also shows that the "System RAM (kmem)" resource is not being removed. The bug does not appear after "modprobe -r kmem", it requires the parent of "dax4.0" and "dax3.0" to be removed which re-parents the leaked "System RAM (kmem)" instances. Those in turn reference the freed resource as a parent. First up for the fix is release_mem_region_adjustable() needs to reliably delete the resource inserted by add_memory_driver_managed(). That is thwarted by a check for IORESOURCE_SYSRAM that predates the dax/kmem driver, from commit: 65c78784135f ("kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable") That appears to be working around the behavior of HMM's "MEMORY_DEVICE_PUBLIC" facility that has since been deleted. With that check removed the "System RAM (kmem)" resource gets removed, but corruption still occurs occasionally because the "dax" resource is not reliably removed. The dax range information is freed before the device is unregistered, so the driver can not reliably recall (another use after free) what it is meant to release. Lastly if that use after free got lucky, the driver was covering up the leak of "System RAM (kmem)" due to its use of release_resource() which detaches, but does not free, child resources. The switch to remove_resource() forces remove_memory() to be responsible for the deletion of the resource added by add_memory_driver_managed(). Fixes: c2f3011ee697 ("device-dax: add an allocation interface for device-dax instances") Cc: Cc: Oscar Salvador Cc: David Hildenbrand Cc: Pavel Tatashin Reviewed-by: Vishal Verma Reviewed-by: Pasha Tatashin Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/167653656244.3147810.5705900882794040229.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit e8444bb9fd77f153adcc263eab28e3c2bc1cf540 Author: Nick Hawkins Date: Fri Feb 17 09:50:54 2023 -0600 MAINTAINERS: Add HPE GXP I2C Support Add the I2C controller source and bindings. Signed-off-by: Nick Hawkins Signed-off-by: Wolfram Sang commit 4a55ed6f89f5a877a39b7d06620457f0c4913c42 Author: Nick Hawkins Date: Fri Feb 17 09:50:50 2023 -0600 i2c: Add GXP SoC I2C Controller The GXP SoC supports 10 I2C engines. Each I2C engine is completely independent and can function both as an I2C master and I2C slave. The I2C master can operate in a multi master environment. The engines support a scalable speed from 8kHZ to 1.5 Mhz. Signed-off-by: Nick Hawkins Reviewed-by: Joel Stanley Signed-off-by: Wolfram Sang commit 681f87ddf90964cbf7f2cfe094f82d0f9f6437a3 Author: Nick Hawkins Date: Fri Feb 17 09:50:51 2023 -0600 dt-bindings: i2c: Add hpe,gxp-i2c Document compatibility string to support I2C controller in GXP. Signed-off-by: Nick Hawkins Signed-off-by: Wolfram Sang commit de82c25dab9ac0fa01c95b8914bde8d9ce528e93 Merge: 574fbb95cd9d8 7234d746a8339 Author: Mark Brown Date: Fri Feb 17 22:05:55 2023 +0000 Merge remote-tracking branch 'spi/for-6.3' into spi-next commit f381b31a80bc47102f5a3f3001d8e45c328eb548 Author: Frank Rowand Date: Mon Feb 13 12:56:58 2023 -0600 of: update kconfig unittest help Add more information about the impact the of unittests have on the live devicetree and why the tests should only be enabled for developer kernels. Add information about processing the test output such that the results are more complete and comprehendable. Signed-off-by: Frank Rowand Link: https://lore.kernel.org/r/20230213185702.395776-4-frowand.list@gmail.com Signed-off-by: Rob Herring commit 568a10bfffe88daa42f1b7968352cc6abd948ca3 Author: Frank Rowand Date: Mon Feb 13 12:56:57 2023 -0600 of: add processing of EXPECT_NOT to of_unittest_expect scripts/dtc/of_unittest_expect processes EXPECT messages that document expected kernel messages triggered by unittest. Add processing of EXPECT_NOT messages that document kernel messages triggered by unittest that are not expected. This is commit 2 of 2, implementing the processing of EXPECT_NOT messages. Signed-off-by: Frank Rowand Link: https://lore.kernel.org/r/20230213185702.395776-3-frowand.list@gmail.com Signed-off-by: Rob Herring commit 511f3aa71029ef4d9408065f94110c0e8f9dccba Author: Frank Rowand Date: Mon Feb 13 12:56:56 2023 -0600 of: prepare to add processing of EXPECT_NOT to of_unittest_expect scripts/dtc/of_unittest_expect processes EXPECT messages that document expected kernel messages triggered by unittest. Add processing of EXPECT_NOT messages that document kernel messages triggered by unittest that are not expected. This is commit 1 of 2, renaming existing variables in anticipation of the changes needed to process EXPECT_NOT, so that commit 2 of 2 will be smaller and easier to read. This commit is not intended to make any functional changes. Signed-off-by: Frank Rowand Link: https://lore.kernel.org/r/20230213185702.395776-2-frowand.list@gmail.com Signed-off-by: Rob Herring commit 16b0c7cad99e96b002e26f016f28150cc7c52514 Author: Rob Herring Date: Wed Feb 8 17:13:23 2023 -0600 of: Use preferred of_property_read_* functions Replace instances of of_get_property/of_find_property() with appropriate typed of_property_read_*() functions. Link: https://lore.kernel.org/all/20230215215502.690716-1-robh@kernel.org/ Signed-off-by: Rob Herring commit 8c266d060894a1c979ccc7b233f34ef545e48b09 Author: Christophe JAILLET Date: Wed Feb 15 11:38:07 2023 +0100 i2c: xiic: Remove some dead code wait_for_completion_timeout() never returns negative value. Signed-off-by: Christophe JAILLET Reviewed-by: Michal Simek Signed-off-by: Wolfram Sang commit 6d8ffbe6618c47021c48cfff31f5d9d354ca44b9 Author: Raviteja Narayanam Date: Wed Feb 15 19:02:24 2023 +0530 i2c: xiic: Add SCL frequency configuration support From 'clock-frequency' device tree property, configure I2C SCL frequency by calculating the timing register values according to input clock. After soft reset in reinit function, the timing registers are set to default values (configured in design tool). So, setting SCL frequency is done inside reinit function after the soft reset. This allows configuration of SCL frequency exclusively through software via device tree property, overriding the design. If the clock-frequency parameter is not specified in DT, driver doesn't configure frequency, making it backward compatible. Signed-off-by: Raviteja Narayanam Signed-off-by: Manikanta Guntupalli Acked-by: Michal Simek Signed-off-by: Wolfram Sang commit 9b97cd61ee1ca7ba9a7005afd52f963a811b492c Author: Raviteja Narayanam Date: Wed Feb 15 19:02:23 2023 +0530 i2c: xiic: Update compatible with new IP version Xilinx AXI I2C IP is updated with a bug fix for dynamic mode reads. Older IPs are handled with a workaround in which they are using xiic standard mode for all these effected use cases. Add the new IP version to compatible. Signed-off-by: Raviteja Narayanam Signed-off-by: Manikanta Guntupalli Acked-by: Michal Simek Signed-off-by: Wolfram Sang commit deca7db82bdebfe4713de28574245276cd5e3023 Author: Raviteja Narayanam Date: Wed Feb 15 19:02:22 2023 +0530 dt-bindings: i2c: xiic: Add 'xlnx,axi-iic-2.1' to compatible Add xilinx I2C new version 'xlnx,axi-iic-2.1' string to compatible. Add clock-frequency as optional property. Signed-off-by: Raviteja Narayanam Signed-off-by: Manikanta Guntupalli Acked-by: Michal Simek Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit 2f0cb4753dd2b5fe71d04407213e2ef253dcdd32 Author: Rob Herring Date: Thu Feb 9 17:20:43 2023 -0600 of: Use of_property_present() helper Use of_property_present() instead of of_get_property/of_find_property() in places where we just need to test presence of a property. Reviewed-by: Frank Rowand Tested-by: Frank Rowand Link: https://lore.kernel.org/all/20230215215547.691573-2-robh@kernel.org/ Signed-off-by: Rob Herring commit 9cbad37ce8122de32a1529e394b468bc101c9e7f Author: Rob Herring Date: Thu Feb 9 15:35:01 2023 -0600 of: Add of_property_present() helper Add an of_property_present() function similar to fwnode_property_present(). of_property_read_bool() could be used directly, but it is cleaner to not use it on non-boolean properties. Reviewed-by: Frank Rowand Tested-by: Frank Rowand Link: https://lore.kernel.org/all/20230215215547.691573-1-robh@kernel.org/ Signed-off-by: Rob Herring commit 6ee7afbabcee4d54024c46f8fc74314c69a04613 Author: Geert Uytterhoeven Date: Thu Feb 16 09:37:25 2023 +0100 of: reserved_mem: Use proper binary prefix The printed reserved memory information uses the non-standard "K" prefix, while all other printed values use proper binary prefixes. Fix this by using "Ki" instead. While at it, drop the superfluous spaces inside the parentheses, to reduce printed line length. Fixes: aeb9267eb6b1df99 ("of: reserved-mem: print out reserved-mem details during boot") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230216083725.1244817-1-geert+renesas@glider.be Signed-off-by: Rob Herring commit 168de0233586fb06c5c5c56304aa9a928a09b0ba Author: Martin KaFai Lau Date: Fri Feb 17 12:55:15 2023 -0800 selftests/bpf: Add bpf_fib_lookup test This patch tests the bpf_fib_lookup helper when looking up a neigh in NUD_FAILED and NUD_STALE state. It also adds test for the new BPF_FIB_LOOKUP_SKIP_NEIGH flag. Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230217205515.3583372-2-martin.lau@linux.dev commit 31de4105f00d64570139bc5494a201b0bd57349f Author: Martin KaFai Lau Date: Fri Feb 17 12:55:14 2023 -0800 bpf: Add BPF_FIB_LOOKUP_SKIP_NEIGH for bpf_fib_lookup The bpf_fib_lookup() also looks up the neigh table. This was done before bpf_redirect_neigh() was added. In the use case that does not manage the neigh table and requires bpf_fib_lookup() to lookup a fib to decide if it needs to redirect or not, the bpf prog can depend only on using bpf_redirect_neigh() to lookup the neigh. It also keeps the neigh entries fresh and connected. This patch adds a bpf_fib_lookup flag, SKIP_NEIGH, to avoid the double neigh lookup when the bpf prog always call bpf_redirect_neigh() to do the neigh lookup. The params->smac output is skipped together when SKIP_NEIGH is set because bpf_redirect_neigh() will figure out the smac also. Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230217205515.3583372-1-martin.lau@linux.dev commit de461a2607c69c4075c5dc4be86f75c6417dda3a Author: Heiner Kallweit Date: Thu Feb 16 17:15:33 2023 +0100 i2c: i801: Call i801_check_post() from i801_access() Avoid code duplication by calling i801_check_post() from i801_access(). Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 1f760b87e54cf56a25ab68f8dc625e339f6e46d5 Author: Heiner Kallweit Date: Thu Feb 16 17:14:51 2023 +0100 i2c: i801: Call i801_check_pre() from i801_access() This avoids code duplication, in a next step we'll call i801_check_post() from i801_transaction() as well. Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit a3989dc0b059a513ad9e12bab8470edc1cec027f Author: Heiner Kallweit Date: Thu Feb 16 17:14:16 2023 +0100 i2c: i801: Centralize configuring block commands in i801_block_transaction Similar to what was done for non-block commands, centralize block command register settings in i801_block_transaction(). Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 24592482d2351071a05d782c9b2be20342e0d1d2 Author: Heiner Kallweit Date: Thu Feb 16 17:12:12 2023 +0100 i2c: i801: Centralize configuring non-block commands in i801_simple_transaction Currently configuring command register settings is distributed over multiple functions. At first centralize this for non-block commands in i801_simple_transaction(). Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 63fd342fd121c3eea5ff209ec5fc0128214bb017 Author: Heiner Kallweit Date: Thu Feb 16 17:11:17 2023 +0100 i2c: i801: Handle SMBAUXCTL_E32B in i801_block_transaction_by_block only Currently we touch SMBAUXCTL even if not needed. That's the case for block commands that don't use block buffer mode, either because block buffer mode isn't available or because it's not supported for the respective command (e.g. I2C block transfer). Improve this by setting/resetting SMBAUXCTL_E32B in i801_block_transaction_by_block() only. Small downside is that we now access SMBAUXCTL twice for transactions that use PEC and block buffer mode. But this should a rather rare case and the impact is negligible. Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit dd2d18b5c04099698dfe9ead149f9247a2d5c489 Author: Heiner Kallweit Date: Thu Feb 16 17:10:30 2023 +0100 i2c: i801: Add i801_simple_transaction(), complementing i801_block_transaction() Factor out non-block pre/post processing to a new function i801_simple_transaction(), complementing existing function i801_block_transaction(). This makes i801_access() better readable. Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang commit 49b5e77ae3e214acff4728595b4ac7bf776693ca Author: Pu Lehui Date: Wed Feb 15 21:52:05 2023 +0800 riscv, bpf: Add bpf trampoline support for RV64 BPF trampoline is the critical infrastructure of the BPF subsystem, acting as a mediator between kernel functions and BPF programs. Numerous important features, such as using BPF program for zero overhead kernel introspection, rely on this key component. We can't wait to support bpf trampoline on RV64. The related tests have passed, as well as the test_verifier with no new failure ceses. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20230215135205.1411105-5-pulehui@huaweicloud.com commit 596f2e6f9cf41436a5512a3f278c86da5c5598fb Author: Pu Lehui Date: Wed Feb 15 21:52:04 2023 +0800 riscv, bpf: Add bpf_arch_text_poke support for RV64 Implement bpf_arch_text_poke for RV64. For call scenario, to make BPF trampoline compatible with the kernel and BPF context, we follow the framework of RV64 ftrace to reserve 4 nops for BPF programs as function entry, and use auipc+jalr instructions for function call. However, since auipc+jalr call instruction is non-atomic operation, we need to use stop-machine to make sure instructions patching in atomic context. Also, we use auipc+jalr pair and need to patch in stop-machine context for jump scenario. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20230215135205.1411105-4-pulehui@huaweicloud.com commit 0fd1fd0104954380477353aea29c347e85dff16d Author: Pu Lehui Date: Wed Feb 15 21:52:03 2023 +0800 riscv, bpf: Factor out emit_call for kernel and bpf context The current emit_call function is not suitable for kernel function call as it store return value to bpf R0 register. We can separate it out for common use. Meanwhile, simplify judgment logic, that is, fixed function address can use jal or auipc+jalr, while the unfixed can use only auipc+jalr. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20230215135205.1411105-3-pulehui@huaweicloud.com commit 5e57fb7b0bd3ea7e994ef1c0ab3562d1fe0676b2 Author: Pu Lehui Date: Wed Feb 15 21:52:02 2023 +0800 riscv: Extend patch_text for multiple instructions Extend patch_text for multiple instructions. This is the preparaiton for multiple instructions text patching in riscv BPF trampoline, and may be useful for other scenario. Signed-off-by: Pu Lehui Signed-off-by: Daniel Borkmann Tested-by: Björn Töpel Reviewed-by: Conor Dooley Acked-by: Björn Töpel Link: https://lore.kernel.org/bpf/20230215135205.1411105-2-pulehui@huaweicloud.com commit fd8958efe8779d3db19c9124fce593ce681ac709 Author: Patrick Kelsey Date: Thu Feb 16 11:56:28 2023 -0500 IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors Fix three sources of error involving struct sdma_txreq.num_descs. When _extend_sdma_tx_descs() extends the descriptor array, it uses the value of tx->num_descs to determine how many existing entries from the tx's original, internal descriptor array to copy to the newly allocated one. As this value was incremented before the call, the copy loop will access one entry past the internal descriptor array, copying its contents into the corresponding slot in the new array. If the call to _extend_sdma_tx_descs() fails, _pad_smda_tx_descs() then invokes __sdma_tx_clean() which uses the value of tx->num_desc to drive a loop that unmaps all descriptor entries in use. As this value was incremented before the call, the unmap loop will invoke sdma_unmap_desc() on a descriptor entry whose contents consist of whatever random data was copied into it during (1), leading to cascading further calls into the kernel and driver using arbitrary data. _sdma_close_tx() was using tx->num_descs instead of tx->num_descs - 1. Fix all of the above by: - Only increment .num_descs after .descp is extended. - Use .num_descs - 1 instead of .num_descs for last .descp entry. Fixes: f4d26d81ad7f ("staging/rdma/hfi1: Add coalescing support for SDMA TX descriptors") Link: https://lore.kernel.org/r/167656658879.2223096.10026561343022570690.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Brendan Cunningham Signed-off-by: Patrick Kelsey Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit a0d198f79a8d033bd46605b779859193649f1f99 Author: Patrick Kelsey Date: Thu Feb 16 11:56:23 2023 -0500 IB/hfi1: Fix math bugs in hfi1_can_pin_pages() Fix arithmetic and logic errors in hfi1_can_pin_pages() that would allow hfi1 to attempt pinning pages in cases where it should not because of resource limits or lack of required capability. Fixes: 2c97ce4f3c29 ("IB/hfi1: Add pin query function") Link: https://lore.kernel.org/r/167656658362.2223096.10954762619837718026.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Brendan Cunningham Signed-off-by: Patrick Kelsey Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit d88cbbb39b4db057feb1552de31f22c02a21b36f Author: Christophe JAILLET Date: Fri Feb 17 10:29:10 2023 +0100 blk-mq: Reorder fields in 'struct blk_mq_tag_set' Group some variables based on their sizes to reduce hole and avoid padding. On x86_64, this shrinks the size of 'struct blk_mq_tag_set' from 304 to 296 bytes. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/6f249f9b02a3490283ef0278096556de41aa0cf0.1676626130.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jens Axboe commit d2225b838ccad126045e048471441693c7bca217 Author: Zhu Yanjun Date: Fri Feb 17 09:14:25 2023 +0800 RDMA/irdma: Add support for dmabuf pin memory regions This is a followup to the EFA dmabuf[1]. Irdma driver currently does not support on-demand-paging(ODP). So it uses habanalabs as the dmabuf exporter, and irdma as the importer to allow for peer2peer access through libibverbs. In this commit, the function ib_umem_dmabuf_get_pinned() is used. This function is introduced in EFA dmabuf[1] which allows the driver to get a dmabuf umem which is pinned and does not require move_notify callback implementation. The returned umem is pinned and DMA mapped like standard cpu umems, and is released through ib_umem_release(). [1]https://lore.kernel.org/lkml/20211007114018.GD2688930@ziepe.ca/t/ Link: https://lore.kernel.org/r/20230217011425.498847-1-yanjun.zhu@intel.com Reviewed-by: Shiraz Saleem Signed-off-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit 181127fb76e62d06ab17a75fd610129688612343 Author: Martin KaFai Lau Date: Fri Feb 17 12:13:09 2023 -0800 Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES" This reverts commit 6c20822fada1b8adb77fa450d03a0d449686a4a9. build bot failed on arch with different cache line size: https://lore.kernel.org/bpf/50c35055-afa9-d01e-9a05-ea5351280e4f@intel.com/ Signed-off-by: Martin KaFai Lau commit 5ef17179da7b779b3029d9a7d3871ba09279d56c Merge: a77a52385e9a7 594cac11ab6a1 Author: Jason Gunthorpe Date: Fri Feb 17 16:24:14 2023 -0400 Merge mlx5-next into rdma.git for-next Synchronize the shared mlx5 branch with net: - From Jiri: fixe a deadlock in mlx5_ib's netdev notifier unregister. - From Mark and Patrisious: add IPsec RoCEv2 support. - From Or: Rely on firmware to get special mkeys * branch mlx5-next: RDMA/mlx5: Use query_special_contexts for mkeys net/mlx5e: Use query_special_contexts for mkeys net/mlx5: Change define name for 0x100 lkey value net/mlx5: Expose bits for querying special mkeys net/mlx5: Configure IPsec steering for egress RoCEv2 traffic net/mlx5: Configure IPsec steering for ingress RoCEv2 traffic net/mlx5: Add IPSec priorities in RDMA namespaces net/mlx5: Implement new destination type TABLE_TYPE net/mlx5: Introduce new destination type TABLE_TYPE RDMA/mlx5: Track netdev to avoid deadlock during netdev notifier unregister net/mlx5e: Propagate an internal event in case uplink netdev changes net/mlx5e: Fix trap event handling Signed-off-by: Jason Gunthorpe commit f9fa0778ee7349a9aa3d2ea10e9f2ab843a0b44e Author: Kajol Jain Date: Wed Feb 15 15:08:27 2023 +0530 perf tests stat_all_metrics: Change true workload to sleep workload for system wide check Testcase stat_all_metrics.sh fails in powerpc: 98: perf all metrics test : FAILED! Logs with verbose: [command]# ./perf test 98 -vv 98: perf all metrics test : --- start --- test child forked, pid 13262 Testing BRU_STALL_CPI Testing COMPLETION_STALL_CPI ---- Testing TOTAL_LOCAL_NODE_PUMPS_P23 Metric 'TOTAL_LOCAL_NODE_PUMPS_P23' not printed in: Error: Invalid event (hv_24x7/PM_PB_LNS_PUMP23,chip=3/) in per-thread mode, enable system wide with '-a'. Testing TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01 Metric 'TOTAL_LOCAL_NODE_PUMPS_RETRIES_P01' not printed in: Error: Invalid event (hv_24x7/PM_PB_RTY_LNS_PUMP01,chip=3/) in per-thread mode, enable system wide with '-a'. ---- Based on above logs, we could see some of the hv-24x7 metric events fails, and logs suggest to run the metric event with -a option. This change happened after the commit a4b8cfcabb1d90ec ("perf stat: Delay metric parsing"), which delayed the metric parsing phase and now before metric parsing phase perf tool identifies, whether target is system-wide or not. With this change, perf_event_open will fails with workload monitoring for uncore events as expected. The perf all metric test case fails as some of the hv-24x7 metric events may need bigger workload with system wide monitoring to get the data. Fix this issue by changing current system wide check from true workload to sleep 0.01 workload. Result with the patch changes in powerpc: 98: perf all metrics test : Ok Fixes: a4b8cfcabb1d90ec ("perf stat: Delay metric parsing") Suggested-by: Ian Rogers Reviewed-by: Athira Rajeev Signed-off-by: Kajol Jain Tested-by: Disha Goel Tested-by: Ian Rogers Cc: Madhavan Srinivasan Cc: Nageswara R Sastry Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20230215093827.124921-1-kjain@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit 594cac11ab6a1be8022a3c96d181dde7cfb0b8cf Author: Or Har-Toov Date: Tue Jan 17 15:14:52 2023 +0200 RDMA/mlx5: Use query_special_contexts for mkeys Use query_sepcial_contexts to get the correct value of mkeys such as null_mkey, terminate_scatter_list_mkey and dump_fill_mkey, as FW will change them in certain configurations. Link: https://lore.kernel.org/r/000236f0a9487d48809f87bcc3620a3964b2d3d3.1673960981.git.leon@kernel.org Signed-off-by: Or Har-Toov Reviewed-by: Michael Guralnik Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 1b1e4868836a4b5b375be75fd4c9583d29500517 Author: Or Har-Toov Date: Tue Jan 17 15:14:51 2023 +0200 net/mlx5e: Use query_special_contexts for mkeys Use query_sepcial_contexts in order to get the correct value of terminate_scatter_list_mkey, as FW will change it for certain configurations. Link: https://lore.kernel.org/r/fff70d94258233effb0e34f3d62cb08a692f5af5.1673960981.git.leon@kernel.org Signed-off-by: Or Har-Toov Reviewed-by: Michael Guralnik Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit a419bfb7632095410adc3aecb1e863568f049add Author: Or Har-Toov Date: Tue Jan 17 15:14:50 2023 +0200 net/mlx5: Change define name for 0x100 lkey value Change define of 0x100 lkey value from MLX5_INVALID_LKEY to be MLX5_TERMINATE_SCATTER_LIST_LKEY as 0x100 is the value of terminate_scatter_list_mkey. Link: https://lore.kernel.org/r/3a116dc3fbae4cb6b76a63d27d418830b06ade0c.1673960981.git.leon@kernel.org Signed-off-by: Or Har-Toov Reviewed-by: Michael Guralnik Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit 4b7296aa6c6618d6a6840fbe857e4990f626bd90 Author: Or Har-Toov Date: Tue Jan 17 15:14:49 2023 +0200 net/mlx5: Expose bits for querying special mkeys Add needed HW bits to query the values of all special mkeys. Link: https://lore.kernel.org/r/080ebb563a9717c15b1ea75d669aede676df386b.1673960981.git.leon@kernel.org Signed-off-by: Or Har-Toov Reviewed-by: Michael Guralnik Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit e2b5cfc978f871996d1f8667515c0e06b33e620e Author: Andrii Nakryiko Date: Wed Feb 15 20:59:54 2023 -0800 selftests/bpf: Add global subprog context passing tests Add tests validating that it's possible to pass context arguments into global subprogs for various types of programs, including a particularly tricky KPROBE programs (which cover kprobes, uprobes, USDTs, a vast and important class of programs). Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20230216045954.3002473-4-andrii@kernel.org commit 95ebb376176c52382293e05e63f142114a5e40ef Author: Andrii Nakryiko Date: Wed Feb 15 20:59:53 2023 -0800 selftests/bpf: Convert test_global_funcs test to test_loader framework Convert 17 test_global_funcs subtests into test_loader framework for easier maintenance and more declarative way to define expected failures/successes. Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20230216045954.3002473-3-andrii@kernel.org commit d384dce281ed1b504fae2e279507827638d56fa3 Author: Andrii Nakryiko Date: Wed Feb 15 20:59:52 2023 -0800 bpf: Fix global subprog context argument resolution logic KPROBE program's user-facing context type is defined as typedef bpf_user_pt_regs_t. This leads to a problem when trying to passing kprobe/uprobe/usdt context argument into global subprog, as kernel always strip away mods and typedefs of user-supplied type, but takes expected type from bpf_ctx_convert as is, which causes mismatch. Current way to work around this is to define a fake struct with the same name as expected typedef: struct bpf_user_pt_regs_t {}; __noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... } This patch fixes the issue by resolving expected type, if it's not a struct. It still leaves the above work-around working for backwards compatibility. Fixes: 91cc1a99740e ("bpf: Annotate context types") Signed-off-by: Andrii Nakryiko Signed-off-by: Daniel Borkmann Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@kernel.org commit cf26e043c2a9213805d7ea9e8cf3e1d7166a62a4 Author: Athira Rajeev Date: Thu Feb 16 11:42:40 2023 +0530 perf vendor events power10: Add JSON metric events to present CPI stall cycles in powerpc Power10 Performance Monitoring Unit (PMU) provides events to understand stall cycles of different pipeline stages. These events along with completed instructions provides useful metrics for application tuning. Patch implements the JSON changes to collect counter statistics to present the high level CPI stall breakdown metrics. New metric group is named as "CPI_STALL_RATIO" and this new metric group presents these stall metrics: - DISPATCHED_CPI ( Dispatch stall cycles per insn ) - ISSUE_STALL_CPI ( Issue stall cycles per insn ) - EXECUTION_STALL_CPI ( Execution stall cycles per insn ) - COMPLETION_STALL_CPI ( Completition stall cycles per insn ) To avoid multipling of events, PM_RUN_INST_CMPL event has been modified to use PMC5(performance monitoring counter5) instead of PMC4. This change is needed, since completion stall event is using PMC4. Usage example: ./perf stat --metric-no-group -M CPI_STALL_RATIO Performance counter stats for 'workload': 63,056,817,982 PM_CMPL_STALL # 0.28 COMPLETION_STALL_CPI 1,743,988,038,896 PM_ISSUE_STALL # 7.73 ISSUE_STALL_CPI 225,597,495,030 PM_RUN_INST_CMPL # 6.18 DISPATCHED_CPI # 37.48 EXECUTION_STALL_CPI 1,393,916,546,654 PM_DISP_STALL_CYC 8,455,376,836,463 PM_EXEC_STALL "--metric-no-group" is used for forcing PM_RUN_INST_CMPL to be scheduled in all group for more accuracy. Signed-off-by: Athira Rajeev Acked-by: Ian Rogers Cc: Andi Kleen Cc: Disha Goel Cc: James Clark Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nageswara R Sastry Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20230216061240.18067-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit a2f998a78a425edde5a1a1973c1d4854fe9d019f Author: Hou Tao Date: Fri Dec 16 12:23:53 2022 +0800 dm ioctl: remove unnecessary check when using dm_get_mdptr() __hash_remove() removes hash_cell with _hash_lock locked, so acquiring _hash_lock can guarantee no-NULL hc returned from dm_get_mdptr() must have not been removed and hc->md must still be md. __hash_remove() also acquires dm_hash_cells_mutex before setting mdptr as NULL. So in dm_copy_name_and_uuid(), after acquiring dm_hash_cells_mutex and ensuring returned hc is not NULL, the returned hc must still be alive and hc->md must still be md. Remove the unnecessary hc->md != md checks when using dm_get_mdptr() with _hash_lock or dm_hash_cells_mutex acquired. Signed-off-by: Hou Tao Signed-off-by: Mike Snitzer commit 69868bebfe8e9a47b0d8a12f7473b8a3b7239ef3 Author: Mike Snitzer Date: Fri Feb 17 13:08:17 2023 -0500 dm ioctl: assert _hash_lock is held in __hash_remove Also update dm_early_create() to take _hash_lock when calling both __get_name_cell and __hash_remove -- given dm_early_create()'s early boot usecase this locking isn't about correctness but it allows lockdep_assert_held() to be added to __hash_remove. Signed-off-by: Mike Snitzer commit 76227f6dc805e9e960128bcc6276647361e0827c Author: Mike Snitzer Date: Thu Feb 16 15:31:08 2023 -0500 dm cache: add cond_resched() to various workqueue loops Otherwise on resource constrained systems these workqueues may be too greedy. Signed-off-by: Mike Snitzer commit e4f80303c2353952e6e980b23914e4214487f2a6 Author: Mike Snitzer Date: Thu Feb 16 15:29:44 2023 -0500 dm thin: add cond_resched() to various workqueue loops Otherwise on resource constrained systems these workqueues may be too greedy. Signed-off-by: Mike Snitzer commit 7234d746a8339066313518bfa024fa03f363a55e Author: Krzysztof Kozlowski Date: Fri Feb 17 16:58:02 2023 +0100 spi: dt-bindings: qcom,spi-qcom-qspi: document OPP and power-domains QSPI on Qualcomm SDM845, SC7180 and SC7280 SoCs uses OPP table (both in DTS and Linux driver) and is suuplied by CX power domain. Document missing properties to fix: sc7280-idp2.dtb: spi@88dc000: Unevaluated properties are not allowed ('operating-points-v2', 'power-domains' were unexpected) Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230217155802.848178-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 64f50f6575721ef03d001e907455cbe3baa2a5b1 Author: Hengqi Chen Date: Tue Feb 14 15:26:33 2023 +0000 LoongArch, bpf: Use 4 instructions for function address in JIT This patch fixes the following issue of function calls in JIT, like: [ 29.346981] multi-func JIT bug 105 != 103 The issus can be reproduced by running the "inline simple bpf_loop call" verifier test. This is because we are emiting 2-4 instructions for 64-bit immediate moves. During the first pass of JIT, the placeholder address is zero, emiting two instructions for it. In the extra pass, the function address is in XKVRANGE, emiting four instructions for it. This change the instruction index in JIT context. Let's always use 4 instructions for function address in JIT. So that the instruction sequences don't change between the first pass and the extra pass for function calls. Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Signed-off-by: Hengqi Chen Signed-off-by: Daniel Borkmann Tested-by: Tiezhu Yang Link: https://lore.kernel.org/bpf/20230214152633.2265699-1-hengqi.chen@gmail.com commit 38ae3192296924181537544e7cfc43ca78eadcda Author: Arnd Bergmann Date: Fri Feb 17 10:59:04 2023 +0100 wifi: rtl8xxxu: add LEDS_CLASS dependency rtl8xxxu now unconditionally uses LEDS_CLASS, so a Kconfig dependency is required to avoid link errors: aarch64-linux-ld: drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.o: in function `rtl8xxxu_disconnect': rtl8xxxu_core.c:(.text+0x730): undefined reference to `led_classdev_unregister' ERROR: modpost: "led_classdev_unregister" [drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko] undefined! ERROR: modpost: "led_classdev_register_ext" [drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.ko] undefined! Fixes: 3be01622995b ("wifi: rtl8xxxu: Register the LED and make it blink") Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230217095910.2480356-1-arnd@kernel.org commit 1fe4850b34ab512ff911e2c035c75fb6438f7307 Author: Martin KaFai Lau Date: Thu Feb 16 16:41:48 2023 -0800 bpf: bpf_fib_lookup should not return neigh in NUD_FAILED state The bpf_fib_lookup() helper does not only look up the fib (ie. route) but it also looks up the neigh. Before returning the neigh, the helper does not check for NUD_VALID. When a neigh state (neigh->nud_state) is in NUD_FAILED, its dmac (neigh->ha) could be all zeros. The helper still returns SUCCESS instead of NO_NEIGH in this case. Because of the SUCCESS return value, the bpf prog directly uses the returned dmac and ends up filling all zero in the eth header. This patch checks for NUD_VALID and returns NO_NEIGH if the neigh is not valid. Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230217004150.2980689-3-martin.lau@linux.dev commit af2d0d09eabe98b01bf02b236e381edae4209778 Author: Martin KaFai Lau Date: Thu Feb 16 16:41:47 2023 -0800 bpf: Disable bh in bpf_test_run for xdp and tc prog Some of the bpf helpers require bh disabled. eg. The bpf_fib_lookup helper that will be used in a latter selftest. In particular, it calls ___neigh_lookup_noref that expects the bh disabled. This patch disables bh before calling bpf_prog_run[_xdp], so the testing prog can also use those helpers. Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230217004150.2980689-2-martin.lau@linux.dev commit 0f03bf300833c05d914ab7f5ab3d8bc8564e9912 Author: Ben Dooks Date: Fri Dec 23 15:38:11 2022 +0000 dt-bindings: pwm: Document Synopsys DesignWare snps,pwm-dw-apb-timers-pwm2 Add documentation for the bindings for Synopsys' DesignWare PWM block as we will be adding DT/platform support to the Linux driver soon. Signed-off-by: Ben Dooks Reviewed-by: Krzysztof Kozlowski Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 1596dae2f17ec5c6e8c8f0e3fec78c5ae55c1e0b Author: Maciej Fijalkowski Date: Wed Feb 15 15:33:09 2023 +0100 xsk: check IFF_UP earlier in Tx path Xsk Tx can be triggered via either sendmsg() or poll() syscalls. These two paths share a call to common function xsk_xmit() which has two sanity checks within. A pseudo code example to show the two paths: __xsk_sendmsg() : xsk_poll(): if (unlikely(!xsk_is_bound(xs))) if (unlikely(!xsk_is_bound(xs))) return -ENXIO; return mask; if (unlikely(need_wait)) (...) return -EOPNOTSUPP; xsk_xmit() mark napi id (...) xsk_xmit() xsk_xmit(): if (unlikely(!(xs->dev->flags & IFF_UP))) return -ENETDOWN; if (unlikely(!xs->tx)) return -ENOBUFS; As it can be observed above, in sendmsg() napi id can be marked on interface that was not brought up and this causes a NULL ptr dereference: [31757.505631] BUG: kernel NULL pointer dereference, address: 0000000000000018 [31757.512710] #PF: supervisor read access in kernel mode [31757.517936] #PF: error_code(0x0000) - not-present page [31757.523149] PGD 0 P4D 0 [31757.525726] Oops: 0000 [#1] PREEMPT SMP NOPTI [31757.530154] CPU: 26 PID: 95641 Comm: xdpsock Not tainted 6.2.0-rc5+ #40 [31757.536871] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [31757.547457] RIP: 0010:xsk_sendmsg+0xde/0x180 [31757.551799] Code: 00 75 a2 48 8b 00 a8 04 75 9b 84 d2 74 69 8b 85 14 01 00 00 85 c0 75 1b 48 8b 85 28 03 00 00 48 8b 80 98 00 00 00 48 8b 40 20 <8b> 40 18 89 85 14 01 00 00 8b bd 14 01 00 00 81 ff 00 01 00 00 0f [31757.570840] RSP: 0018:ffffc90034f27dc0 EFLAGS: 00010246 [31757.576143] RAX: 0000000000000000 RBX: ffffc90034f27e18 RCX: 0000000000000000 [31757.583389] RDX: 0000000000000001 RSI: ffffc90034f27e18 RDI: ffff88984cf3c100 [31757.590631] RBP: ffff88984714a800 R08: ffff88984714a800 R09: 0000000000000000 [31757.597877] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffa [31757.605123] R13: 0000000000000000 R14: 0000000000000003 R15: 0000000000000000 [31757.612364] FS: 00007fb4c5931180(0000) GS:ffff88afdfa00000(0000) knlGS:0000000000000000 [31757.620571] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [31757.626406] CR2: 0000000000000018 CR3: 000000184b41c003 CR4: 00000000007706e0 [31757.633648] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [31757.640894] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [31757.648139] PKRU: 55555554 [31757.650894] Call Trace: [31757.653385] [31757.655524] sock_sendmsg+0x8f/0xa0 [31757.659077] ? sockfd_lookup_light+0x12/0x70 [31757.663416] __sys_sendto+0xfc/0x170 [31757.667051] ? do_sched_setscheduler+0xdb/0x1b0 [31757.671658] __x64_sys_sendto+0x20/0x30 [31757.675557] do_syscall_64+0x38/0x90 [31757.679197] entry_SYSCALL_64_after_hwframe+0x72/0xdc [31757.687969] Code: 8e f6 ff 44 8b 4c 24 2c 4c 8b 44 24 20 41 89 c4 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 3a 44 89 e7 48 89 44 24 08 e8 b5 8e f6 ff 48 [31757.707007] RSP: 002b:00007ffd49c73c70 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [31757.714694] RAX: ffffffffffffffda RBX: 000055a996565380 RCX: 00007fb4c5727c16 [31757.721939] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [31757.729184] RBP: 0000000000000040 R08: 0000000000000000 R09: 0000000000000000 [31757.736429] R10: 0000000000000040 R11: 0000000000000293 R12: 0000000000000000 [31757.743673] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [31757.754940] To fix this, let's make xsk_xmit a function that will be responsible for generic Tx, where RCU is handled accordingly and pull out sanity checks and xs->zc handling. Populate sanity checks to __xsk_sendmsg() and xsk_poll(). Fixes: ca2e1a627035 ("xsk: Mark napi_id on sendmsg()") Fixes: 18b1ab7aa76b ("xsk: Fix race at socket teardown") Signed-off-by: Maciej Fijalkowski Reviewed-by: Alexander Lobakin Link: https://lore.kernel.org/r/20230215143309.13145-1-maciej.fijalkowski@intel.com Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann commit 860793bbdcdfbeae684d552ce0121846cffc4803 Author: Jeff LaBundy Date: Sun Feb 5 20:56:22 2023 -0600 pwm: iqs620a: Replace one remaining instance of regmap_update_bits() The call to regmap_update_bits() which was responsible for clearing the PWM output enable register bit was recently dropped in favor of a call to regmap_clear_bits(), thereby simplifying the code. Similarly, the call to regmap_update_bits() which sets the same bit can be simplified with a call to regmap_set_bits(). Signed-off-by: Jeff LaBundy Reviewed-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 327437884e9a752ccbf759cbab641439ca708f5b Author: Uwe Kleine-König Date: Wed Jan 18 16:48:17 2023 +0100 pwm: ab8500: Implement .get_state() The registers are readable, so it's possible to implement the .get_state() callback for this PWM. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 486dd4e846814016443abfcbfee0b8b3f3b35330 Author: Uwe Kleine-König Date: Wed Jan 18 16:48:16 2023 +0100 pwm: ab8500: Fix calculation of duty and period After a check of the manual it becomes obvious that the calculations in .apply() are totally bogus: FreqPWMOutx was always written as zero, so the period was fixed at 3413333.33 ns. However state->period wasn't checked at all. The lower 10 bits of duty_cycle were just used as DutyPWMOutx. So if a duty cycle of 512 ns (or 1536 ns) was requested, it actually programmed 1710000 ns. Other values were wrong by the same factor. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit f98954b293d0a0f9646117af75c82c1b89191c53 Author: Nick Alcock Date: Thu Feb 16 15:24:04 2023 +0000 PCI: Remove MODULE_LICENSE so boolean drivers don't look like modules Since 8b41fc4454e3 ("kbuild: create modules.builtin without Makefile.modbuiltin or tristate.conf"), MODULE_LICENSE declarations are used to identify modules. As a consequence, MODULE_LICENSE in non-modules causes modprobe to misidentify the object file as a module when it is not, and modprobe might succeed rather than failing with a suitable error message. For tristate modules that can be either built-in or loaded at runtime, modprobe succeeds in both cases: # modprobe ext4 [exit status zero if CONFIG_EXT4_FS=y or =m] For boolean modules like the Standard Hot Plug Controller driver (shpchp) that cannot be loaded at runtime, modprobe should always fail like this: # modprobe shpchp modprobe: FATAL: Module shpchp not found in directory /lib/modules/... [exit status non-zero regardless of CONFIG_HOTPLUG_PCI_SHPC] but prior to this commit, shpchp_core.c contained MODULE_LICENSE, so "modprobe shpchp" silently succeeded when it should have failed. Remove MODULE_LICENSE in files that cannot be built as modules. [bhelgaas: commit log, squash] Suggested-by: Luis Chamberlain Link: https://lore.kernel.org/r/20230216152410.4312-1-nick.alcock@oracle.com/ Signed-off-by: Nick Alcock Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: Luis Chamberlain Cc: Hitomi Hasegawa Cc: Rob Herring Cc: Lorenzo Pieralisi commit 7e55b95651d88e60368087c243525a0d97d43d3d Author: Steinar H. Gunderson Date: Tue Mar 22 09:24:52 2022 +0100 perf intel-pt: Synthesize cycle events There is no good reason why we cannot synthesize "cycle" events from Intel PT just as we can synthesize "instruction" events, in particular when CYC packets are available. This enables using PT to getting much more accurate cycle profiles than regular sampling (record -e cycles) when the work last for very short periods (<10 ms). Thus, add support for this, based off of the existing IPC calculation framework. The new option to --itrace is "y" (for cYcles), as c was taken for calls. Cycle and instruction events can be synthesized together, and are by default. The only real caveat is that CYC packets are only emitted whenever some other packet is, which in practice is when a branch instruction is encountered (and not even all branches). Thus, even at no subsampling (e.g. --itrace=y0ns), it is impossible to get more accuracy than a single basic block, and all cycles spent executing that block will get attributed to the branch instruction that ends the packet. Thus, one cannot know whether the cycles came from e.g. a specific load, a mispredicted branch, or something else. When subsampling (which is the default), the cycle events will get smeared out even more, but will still be generally useful to attribute cycle counts to functions. Reviewed-by: Adrian Hunter Signed-off-by: Steinar H. Gunderson Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220322082452.1429091-1-sesse@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e5cfefa97bccf956ea0bb6464c1f6c84fd7a8d9f Author: Yu Kuai Date: Fri Feb 17 10:22:00 2023 +0800 block: fix scan partition for exclusively open device again As explained in commit 36369f46e917 ("block: Do not reread partition table on exclusively open device"), reread partition on the device that is exclusively opened by someone else is problematic. This patch will make sure partition scan will only be proceed if current thread open the device exclusively, or the device is not opened exclusively, and in the later case, other scanners and exclusive openers will be blocked temporarily until partition scan is done. Fixes: 10c70d95c0f2 ("block: remove the bd_openers checks in blk_drop_partitions") Cc: Suggested-by: Jan Kara Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230217022200.3092987-3-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 0f77b29ad14e34a89961f32edc87b92db623bb37 Author: Yu Kuai Date: Fri Feb 17 10:21:59 2023 +0800 block: Revert "block: Do not reread partition table on exclusively open device" This reverts commit 36369f46e91785688a5f39d7a5590e3f07981316. This patch can't fix the problem in a corner case that device can be opened exclusively after the checking and before blkdev_get_by_dev(). We'll use a new solution to fix the problem in the next patch, and the new solution doesn't need to change apis. Signed-off-by: Yu Kuai Acked-by: Jan Kara Link: https://lore.kernel.org/r/20230217022200.3092987-2-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 0aa2988e4fd23c0c8b33999d7b47dfbc5e6bf24b Author: Pankaj Raghav Date: Fri Feb 17 17:44:44 2023 +0530 brd: use radix_tree_maybe_preload instead of radix_tree_preload Unconditionally calling radix_tree_preload_end() results in a OOPS message as the preload is only conditionally called for gfpflags_allow_blocking(). [ 20.267323] BUG: using smp_processor_id() in preemptible [00000000] code: fio/416 [ 20.267837] caller is brd_insert_page.part.0+0xbe/0x190 [brd] [ 20.269436] Call Trace: [ 20.269598] [ 20.269742] dump_stack_lvl+0x32/0x50 [ 20.269982] check_preemption_disabled+0xd1/0xe0 [ 20.270289] brd_insert_page.part.0+0xbe/0x190 [brd] [ 20.270664] brd_submit_bio+0x33f/0xf40 [brd] Use radix_tree_maybe_preload() which does preload only if gfpflags_allow_blocking() is true but also takes the lock. Therefore, unconditionally calling radix_tree_preload_end() should not create any issues and the message disappears. Fixes: 6ded703c56c2 ("brd: check for REQ_NOWAIT and set correct page allocation mask") Signed-off-by: Pankaj Raghav Link: https://lore.kernel.org/r/20230217121442.33914-1-p.raghav@samsung.com Signed-off-by: Jens Axboe commit 9ec041ea40dbc6425c0ee6ae15786e5ab1d6aad6 Author: Luca Boccassi Date: Fri Feb 10 01:06:12 2023 +0000 sed-opal: add support flag for SUM in status ioctl Not every OPAL drive supports SUM (Single User Mode), so report this information to userspace via the get-status ioctl so that we can adjust the formatting options accordingly. Tested on a kingston drive (which supports it) and a samsung one (which does not). Signed-off-by: Luca Boccassi Link: https://lore.kernel.org/r/20230210010612.28729-1-luca.boccassi@gmail.com Signed-off-by: Jens Axboe commit 2954fe60e33da0f4de4d81a4c95c7dddb517d00c Author: Florian Westphal Date: Wed Feb 1 14:45:22 2023 +0100 netfilter: let reset rules clean out conntrack entries iptables/nftables support responding to tcp packets with tcp resets. The generated tcp reset packet passes through both output and postrouting netfilter hooks, but conntrack will never see them because the generated skb has its ->nfct pointer copied over from the packet that triggered the reset rule. If the reset rule is used for established connections, this may result in the conntrack entry to be around for a very long time (default timeout is 5 days). One way to avoid this would be to not copy the nf_conn pointer so that the rest packet passes through conntrack too. Problem is that output rules might not have the same conntrack zone setup as the prerouting ones, so its possible that the reset skb won't find the correct entry. Generating a template entry for the skb seems error prone as well. Add an explicit "closing" function that switches a confirmed conntrack entry to closed state and wire this up for tcp. If the entry isn't confirmed, no action is needed because the conntrack entry will never be committed to the table. Reported-by: Russel King Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 38d73b671a817328334f2a70a23fed4d1f4a952c Author: Sathvika Vasireddy Date: Fri Feb 17 10:02:26 2023 +0530 powerpc/64: Fix unannotated intra-function call warning objtool throws the following warning: arch/powerpc/kernel/head_64.o: warning: objtool: .text+0x6128: unannotated intra-function call Fix the warning by annotating start_initialization_book3s symbol with the SYM_FUNC_START_LOCAL and SYM_FUNC_END macros. Reported-by: Stephen Rothwell Signed-off-by: Sathvika Vasireddy Fixes: 58f24eea5278 ("powerpc/64s: Refactor initialisation after prom") Suggested-by: Josh Poimboeuf Tested-by: Stephen Rothwell Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230217043226.1020041-1-sv@linux.ibm.com commit 3c2ce4912a6f44dfb11bc5d241b13e9f5d79078b Author: Christophe Leroy Date: Mon Dec 19 19:46:00 2022 +0100 powerpc/epapr: Don't use wrteei on non booke wrteei is only for booke. Use the standard mfmsr/ori/mtmsr when non booke. Reported-by: Jan-Benedict Glaw Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/b29c7f1727433b003eae050e44072741c8ac223b.1671475543.git.christophe.leroy@csgroup.eu commit 675f176b4dcc2b75adbcea7ba0e9a649527f53bd Merge: 84cb1b53cdbad ec35307e18ba8 Author: David S. Miller Date: Fri Feb 17 11:06:39 2023 +0000 Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net Some of the devlink bits were tricky, but I think I got it right. Signed-off-by: David S. Miller commit bfb03af71a3798b5a88a945a9c19ad67e1c4986d Author: Christophe Leroy Date: Mon Dec 19 19:45:57 2022 +0100 powerpc: Pass correct CPU reference to assembler Jan-Benedict reported issue with building ppc64e_defconfig with mainline GCC work: powerpc64-linux-gcc -Wp,-MMD,arch/powerpc/kernel/vdso/.gettimeofday-64.o.d -nostdinc -I./arch/powerpc/include -I./arch/powerpc/include/generated -I./include -I./arch/powerpc/include/uapi -I./arch/powerpc/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h -D__KERNEL__ -I ./arch/powerpc -DHAVE_AS_ATHIGH=1 -fmacro-prefix-map=./= -D__ASSEMBLY__ -fno-PIE -m64 -Wl,-a64 -mabi=elfv1 -Wa,-me500 -Wa,-me500mc -mabi=elfv1 -mbig-endian -Wl,-soname=linux-vdso64.so.1 -D__VDSO64__ -s -c -o arch/powerpc/kernel/vdso/gettimeofday-64.o arch/powerpc/kernel/vdso/gettimeofday.S arch/powerpc/kernel/vdso/gettimeofday.S: Assembler messages: arch/powerpc/kernel/vdso/gettimeofday.S:72: Error: unrecognized opcode: `stdu' arch/powerpc/kernel/vdso/gettimeofday.S:72: Error: unrecognized opcode: `stdu' arch/powerpc/kernel/vdso/gettimeofday.S:72: Error: unrecognized opcode: `std' arch/powerpc/kernel/vdso/gettimeofday.S:72: Error: unrecognized opcode: `std' arch/powerpc/kernel/vdso/gettimeofday.S:72: Error: unrecognized opcode: `ld' arch/powerpc/kernel/vdso/gettimeofday.S:72: Error: unrecognized opcode: `ld' ... make[1]: *** [arch/powerpc/kernel/vdso/Makefile:76: arch/powerpc/kernel/vdso/gettimeofday-64.o] Error 1 make: *** [arch/powerpc/Makefile:387: vdso_prepare] Error 2 This is due to assembler being called with -me500mc which is a 32 bits target. The problem comes from the fact that CONFIG_PPC_E500MC is selected for both the e500mc (32 bits) and the e5500 (64 bits), and therefore the following makefile rule is wrong: cpu-as-$(CONFIG_PPC_E500MC) += $(call as-option,-Wa$(comma)-me500mc) Today we have CONFIG_TARGET_CPU which provides the identification of the expected CPU, it is used for GCC. Once GCC knows the target CPU, it adds the correct CPU option to assembler, no need to add it explicitly. With that change (And also commit 45f7091aac35 ("powerpc/64: Set default CPU in Kconfig")), it now is: powerpc64-linux-gcc -Wp,-MMD,arch/powerpc/kernel/vdso/.gettimeofday-64.o.d -nostdinc -I./arch/powerpc/include -I./arch/powerpc/include/generated -I./include -I./arch/powerpc/include/uapi -I./arch/powerpc/include/generated/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/compiler-version.h -include ./include/linux/kconfig.h -D__KERNEL__ -I ./arch/powerpc -DHAVE_AS_ATHIGH=1 -fmacro-prefix-map=./= -D__ASSEMBLY__ -fno-PIE -m64 -Wl,-a64 -mabi=elfv1 -mcpu=e500mc64 -mabi=elfv1 -mbig-endian -Wl,-soname=linux-vdso64.so.1 -D__VDSO64__ -s -c -o arch/powerpc/kernel/vdso/gettimeofday-64.o arch/powerpc/kernel/vdso/gettimeofday.S Reported-by: Jan-Benedict Glaw Signed-off-by: Christophe Leroy Acked-by: Pali Rohár [mpe: Retain -Wa,-mpower4 -Wa,-many for Book3S 64 builds for now] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/758ad54128fa9dd2fdedc4c511592111cbded900.1671475543.git.christophe.leroy@csgroup.eu commit 097fc054b0244ddc87c94097b490e534f6e4cbdd Author: Genjian Zhang Date: Mon Feb 13 14:24:51 2023 +0800 MIPS: dts: Boston: Fix dtc 'pci_device_reg' warning dtbs_check currently complains that: arch/mips/boot/dts/img/boston.dts:128.19-178.5: Warning (pci_device_reg): /pci@14000000/pci2_root@0,0,0: PCI unit address format error, expected "0,0" The unit-address format should be ','. Fix the unit-address accordingly. Reported-by: k2ci Signed-off-by: Genjian Zhang Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Bogendoerfer commit bae833414bfe6a33f6d55d5e0eb38e5989c6fe7b Author: Arınç ÜNAL Date: Sat Feb 11 13:49:15 2023 +0300 mips: dts: ralink: mt7621: add port@5 as CPU port On MT7621AT, MT7621DAT, and MT7621ST SoCs, port 5 of the MT7530 switch is connected to the second MAC of the SoC as a CPU port. Add the port and set up the second MAC on the bindings. Revert PHY muxing on GB-PC1. There's an external PHY connected to the second MAC of the SoC on GB-PC2, therefore, disable port@5 for this device. Signed-off-by: Arınç ÜNAL Acked-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 09e61efd884ca68a768717d60858f138685b161b Author: Arınç ÜNAL Date: Sat Feb 11 13:49:14 2023 +0300 mips: dts: align LED node names with dtschema The node names should be generic and DT schema expects certain pattern: mt7621-gnubee-gb-pc1.dtb: gpio-leds: 'power', 'system' do not match any of the regexes: '(^led-[0-9a-f]$|led)', 'pinctrl-[0-9]+' Signed-off-by: Arınç ÜNAL Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 571f235163ac83407e212b78719175236962aede Author: Yang Li Date: Fri Feb 17 16:30:05 2023 +0800 mmc: meson-gx: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20230217083005.128668-1-yang.lee@linux.alibaba.com Signed-off-by: Ulf Hansson commit c5a66dd8926baa60235bc8844925c36a1b83f488 Author: Heiner Kallweit Date: Wed Feb 15 21:01:43 2023 +0100 mmc: meson-gx: constify member data of struct meson_host Constify member data of struct meson_host. This also allows to remove the cast as of_device_get_match_data() returns a const void *. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/70e5520f-e327-111d-9ea4-824460e41561@gmail.com Signed-off-by: Ulf Hansson commit 4c4fe4f0bb02a46f226db88cb1c7e7586e16fc37 Author: Heiner Kallweit Date: Wed Feb 15 20:58:29 2023 +0100 mmc: meson-gx: use devm_clk_get_enabled() for core clock Use devm_clk_get_enabled() to simplify the code. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/b316c6ba-a373-f1d2-27d2-9add5e25a9d2@gmail.com Signed-off-by: Ulf Hansson commit 7245e629dcaaf308f1868aeffa218e9849c77893 Author: Alexandr Sapozhnikov Date: Wed Feb 15 20:15:49 2023 +0300 drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() After having been compared to NULL value at cirrus.c:455, pointer 'pipe->plane.state->fb' is passed as 1st parameter in call to function 'cirrus_fb_blit_rect' at cirrus.c:461, where it is dereferenced at cirrus.c:316. Found by Linux Verification Center (linuxtesting.org) with SVACE. v2: * aligned commit message to line-length limits Signed-off-by: Alexandr Sapozhnikov Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230215171549.16305-1-alsp705@gmail.com commit 71d04535e853305a76853b28a01512a62006351d Author: Yang Yingliang Date: Fri Feb 17 10:43:33 2023 +0800 mmc: core: fix return value check in devm_mmc_alloc_host() mmc_alloc_host() returns NULL pointer not PTR_ERR(), if it fails, so replace the IS_ERR() check with NULL pointer check. In commit 418f7c2de133 ("mmc: meson-gx: use devm_mmc_alloc_host"), it checks NULL pointer not PTR_ERR, if devm_mmc_alloc_host() fails, so make it to return NULL pointer to keep same with mmc_alloc_host(), the drivers don't need to change the error handle when switch to use devm_mmc_alloc_host(). Fixes: 80df83c2c57e ("mmc: core: add devm_mmc_alloc_host") Signed-off-by: Yang Yingliang Reviewed-by: Heiner Kallweit Link: https://lore.kernel.org/r/20230217024333.4018279-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit f0c5b325dd80b295bd3959fff9166e1152e558bf Author: Heiner Kallweit Date: Thu Feb 16 20:50:22 2023 +0100 dt-bindings: mmc: meson-gx: fix interrupt binding Reflect in the binding that the cd interrupt is optional, and add a description of the interrupts. Fixes: 09b31a610328 ("dt-bindings: mmc: meson-gx: support specifying cd interrupt") Signed-off-by: Heiner Kallweit Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/c1437eb6-0c01-809f-422b-cb1109489355@gmail.com Signed-off-by: Ulf Hansson commit 3a156b52c73c9491441799bbbac18075bf96480e Author: Johannes Berg Date: Thu Feb 16 21:34:44 2023 +0100 wifi: iwlegacy: avoid fortify warning There are two different alive messages, the "init" one is bigger than the other one, so we have a fortify read warn here. Avoid it by copying from the variable-sized 'raw' instead. Signed-off-by: Johannes Berg Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230216203444.134310-1-johannes@sipsolutions.net commit d9fcf94b8f68f4a0b440d26a1143932525c2f3dd Author: Johannes Berg Date: Thu Feb 16 20:57:54 2023 +0100 wifi: iwlwifi: mvm: remove unused iwl_dbgfs_is_match() This inline function is unused, remove it. Signed-off-by: Johannes Berg Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230216205754.d500dcc2e90c.Id87df297263f86b5bba002f7cbb387abc13adf53@changeid commit 0731d0b664f26f54b6293421af54da15b9eb1c8c Author: Po-Hao Huang Date: Thu Feb 16 16:28:07 2023 +0800 wifi: rtw89: fix AP mode authentication transmission failed For some ICs, packets can't be sent correctly without initializing CMAC table first. Previous flow do this initialization after associated, results in authentication response fails to transmit. Move the initialization up front to a proper place to solve this. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230216082807.22285-1-pkshih@realtek.com commit 4a267bc5ea8f159b614d0549030216d0434eccca Author: Ping-Ke Shih Date: Thu Feb 16 13:36:33 2023 +0800 wifi: rtw88: use RTW_FLAG_POWERON flag to prevent to power on/off twice Use power state to decide whether we can enter or leave IPS accurately, and then prevent to power on/off twice. The commit 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS") would like to prevent this as well, but it still can't entirely handle all cases. The exception is that WiFi gets connected and does suspend/resume, it will power on twice and cause it failed to power on after resuming, like: rtw_8723de 0000:03:00.0: failed to poll offset=0x6 mask=0x2 value=0x2 rtw_8723de 0000:03:00.0: mac power on failed rtw_8723de 0000:03:00.0: failed to power on mac rtw_8723de 0000:03:00.0: leave idle state failed rtw_8723de 0000:03:00.0: failed to leave ips state rtw_8723de 0000:03:00.0: failed to leave idle state rtw_8723de 0000:03:00.0: failed to send h2c command To fix this, introduce new flag RTW_FLAG_POWERON to reflect power state, and call rtw_mac_pre_system_cfg() to configure registers properly between power-off/-on. Reported-by: Paul Gover Link: https://bugzilla.kernel.org/show_bug.cgi?id=217016 Fixes: 6bf3a083407b ("wifi: rtw88: add flag check before enter or leave IPS") Cc: Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230216053633.20366-1-pkshih@realtek.com commit a3583e92d188ec6c58c7f603ac5e72dd8a11c21a Author: Krzysztof Kozlowski Date: Thu Feb 9 11:58:41 2023 +0100 ARM: dts: exynos: correct TMU phandle in Odroid XU3 family TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. This was not critical before, but since rework of thermal Devicetree initialization in the commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization"), this leads to errors registering thermal zones other than first one: thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 thermal_sys: Failed to find thermal zone for tmu id=0 exynos-tmu 10064000.tmu: Failed to register sensor: -2 exynos-tmu: probe of 10064000.tmu failed with error -2 Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422") Cc: Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 Author: Krzysztof Kozlowski Date: Thu Feb 9 11:58:40 2023 +0100 ARM: dts: exynos: correct TMU phandle in Odroid HC1 TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. This was not critical before, but since rework of thermal Devicetree initialization in the commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization"), this leads to errors registering thermal zones other than first one: thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 thermal_sys: Failed to find thermal zone for tmu id=0 exynos-tmu 10064000.tmu: Failed to register sensor: -2 exynos-tmu: probe of 10064000.tmu failed with error -2 Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board") Cc: Link: https://lore.kernel.org/r/20230209105841.779596-5-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 9372eca505e7a19934d750b4b4c89a3652738e66 Author: Krzysztof Kozlowski Date: Thu Feb 9 11:58:39 2023 +0100 ARM: dts: exynos: correct TMU phandle in Odroid XU TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. Since thermal-sensors property is already defined in included exynosi5410.dtsi, drop it from exynos5410-odroidxu.dts to fix the error and remoev redundancy. Fixes: 88644b4c750b ("ARM: dts: exynos: Configure PWM, usb3503, PMIC and thermal on Odroid XU board") Cc: Link: https://lore.kernel.org/r/20230209105841.779596-4-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 33e2c595e2e4016991ead44933a29d1ef93d5f26 Author: Krzysztof Kozlowski Date: Thu Feb 9 11:58:38 2023 +0100 ARM: dts: exynos: correct TMU phandle in Exynos5250 TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. Cc: Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") Link: https://lore.kernel.org/r/20230209105841.779596-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 408ab6786dbf6dd696488054c9559681112ef994 Author: Krzysztof Kozlowski Date: Thu Feb 9 11:58:37 2023 +0100 ARM: dts: exynos: correct TMU phandle in Exynos4210 TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. Since thermal-sensors property is already defined in included exynos4-cpu-thermal.dtsi, drop it from exynos4210.dtsi to fix the error and remoev redundancy. Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU") Cc: Link: https://lore.kernel.org/r/20230209105841.779596-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 8e4505e617a80f601e2f53a917611777f128f925 Author: Krzysztof Kozlowski Date: Thu Feb 9 11:58:36 2023 +0100 ARM: dts: exynos: correct TMU phandle in Exynos4 TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. Fixes: 328829a6ad70 ("ARM: dts: define default thermal-zones for exynos4") Cc: Link: https://lore.kernel.org/r/20230209105841.779596-1-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit fb073aa27a7e1b8c968c05c5447a77d49e832ec5 Author: Thomas Weißschuh Date: Fri Feb 17 03:13:22 2023 +0000 dma-buf: make kobj_type structure constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definition to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20230217-kobj_type-dma-buf-v1-1-b84a3616522c@weissschuh.net commit f7a449f779608efe1941a0e0c4bd7b5f57000be7 Author: Roman Gushchin Date: Mon Feb 13 11:29:22 2023 -0800 mm: memcontrol: rename memcg_kmem_enabled() Currently there are two kmem-related helper functions with a confusing semantics: memcg_kmem_enabled() and mem_cgroup_kmem_disabled(). The problem is that an obvious expectation memcg_kmem_enabled() == !mem_cgroup_kmem_disabled(), can be false. mem_cgroup_kmem_disabled() is similar to mem_cgroup_disabled(): it returns true only if CONFIG_MEMCG_KMEM is not set or the kmem accounting is disabled using a boot time kernel option "cgroup.memory=nokmem". It never changes the value dynamically. memcg_kmem_enabled() is different: it always returns false until the first non-root memory cgroup will get online (assuming the kernel memory accounting is enabled). It's goal is to improve the performance on systems without the cgroupfs mounted/memory controller enabled or on the systems with only the root memory cgroup. To make things more obvious and avoid potential bugs, let's rename memcg_kmem_enabled() to memcg_kmem_online(). Link: https://lkml.kernel.org/r/20230213192922.1146370-1-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin Acked-by: Muchun Song Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Shakeel Butt Cc: Dennis Zhou Signed-off-by: Andrew Morton commit b4fb12e6c74791ac4c5c98b845628c576366b889 Author: Mike Rapoport (IBM) Date: Tue Feb 14 16:07:29 2023 +0200 sh: initialize max_mapnr sh never initializes max_mapnr which is used by the generic implementation of pfn_valid(). Initialize max_mapnr with set_max_mapnr() in sh::paging_init(). Link: https://lkml.kernel.org/r/20230214140729.1649961-3-rppt@kernel.org Fixes: e5080a967785 ("mm, arch: add generic implementation of pfn_valid() for FLATMEM") Reported-by: Guenter Roeck Signed-off-by: Mike Rapoport (IBM) Acked-by: John Paul Adrian Glaubitz Reviewed-by: David Hildenbrand Cc: Arnd Bergmann Cc: Geert Uytterhoeven Cc: Greg Ungerer Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton commit 9325ddf90ec3a801c09da374b74532d4589a7346 Author: Mike Rapoport (IBM) Date: Tue Feb 14 16:07:28 2023 +0200 m68k/nommu: add missing definition of ARCH_PFN_OFFSET Patch series "fixups for generic implementation of pfn_valid()". Guenter reported boot failures on m68k-nommu and sh caused by the switch to the generic implementation of pfn_valid(): https://lore.kernel.org/all/20230212173513.GA4052259@roeck-us.net https://lore.kernel.org/all/20230212161320.GA3784076@roeck-us.net These are small fixups that address the issues. This patch (of 2): On m68k/nommu RAM does not necessarily start at 0x0 and when it does not pfn_valid() uses a wrong offset into the memory map which causes silent boot failures. Define ARCH_PFN_OFFSET to make pfn_valid() use the correct offset. Link: https://lkml.kernel.org/r/20230214140729.1649961-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20230214140729.1649961-2-rppt@kernel.org Fixes: d82f07f06cf8 ("m68k: use asm-generic/memory_model.h for both MMU and !MMU") Reported-by: Guenter Roeck Signed-off-by: Mike Rapoport (IBM) Acked-by: Greg Ungerer Reviewed-by: David Hildenbrand Cc: Arnd Bergmann Cc: Geert Uytterhoeven Cc: Rich Felker Cc: Yoshinori Sato Cc: John Paul Adrian Glaubitz Signed-off-by: Andrew Morton commit 2ef8ed7ddd2e6e69da7802be51af8ad71326a74f Author: Yafang Shao Date: Tue Feb 14 15:35:49 2023 +0000 mm: percpu: fix incorrect size in pcpu_obj_full_size() The extra space which is used to store the obj_cgroup membership is only valid when kmemcg is enabled. The kmemcg can be disabled via the kernel parameter "cgroup.memory=nokmem" at boot time. This helper is also used in non-memcg code, for example the tracepoint, so we should fix it. It was found by code review when I was implementing bpf memory usage[1]. No real issue happens in production environment. [1]. https://lwn.net/Articles/921991/ Link: https://lkml.kernel.org/r/20230214153549.12291-1-laoar.shao@gmail.com Signed-off-by: Yafang Shao Reviewed-by: Roman Gushchin Acked-by: Dennis Zhou Cc: Tejun Heo Cc: Christoph Lameter Cc: Vasily Averin Signed-off-by: Andrew Morton commit 44081c77e8a4aac9c5a010ed0d9ccdcf684041e1 Author: Arnd Bergmann Date: Tue Feb 14 11:30:24 2023 +0100 maple_tree: reduce stack usage with gcc-9 and earlier gcc-10 changed the way inlining works to be less aggressive, but older versions run into an oversized stack frame warning whenever CONFIG_KASAN_STACK is enabled, as that forces variables from inlined callees to be non-overlapping: lib/maple_tree.c: In function 'mas_wr_bnode': lib/maple_tree.c:4320:1: error: the frame size of 1424 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Change the annotations on mas_store_b_node() and mas_commit_b_node() to explicitly forbid inlining in this configuration, which is the same behavior that newer versions already have. Link: https://lkml.kernel.org/r/20230214103030.1051950-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Reviewed-by: David Hildenbrand Reviewed-by: Liam R. Howlett Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: Vernon Yang Signed-off-by: Andrew Morton commit 1bc67ca65b31bcb669c4eaca79b3c8d205bb212a Author: Qi Zheng Date: Sun Feb 12 19:10:27 2023 +0800 mm: page_alloc: call panic() when memoryless node allocation fails In free_area_init(), we will continue to run after allocation of memoryless node pgdat fails. However, in the subsequent process (such as when initializing zonelist), the case that NODE_DATA(nid) is NULL is not handled, which will cause panic. Instead of this, it's better to call panic() directly when the memory allocation fails during system boot. Link: https://lkml.kernel.org/r/20230212111027.95520-1-zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng Signed-off-by: Andrew Morton commit 9f550d78b40da21b4da515db4c37d8d7b12aa1a6 Author: Yu Zhao Date: Mon Feb 13 00:53:22 2023 -0700 mm: multi-gen LRU: avoid futile retries Recall that the per-node memcg LRU has two generations and they alternate when the last memcg (of a given node) is moved from one to the other. Each generation is also sharded into multiple bins to improve scalability. A reclaimer starts with a random bin (in the old generation) and, if it fails, it will retry, i.e., to try the rest of the bins. If a reclaimer fails with the last memcg, it should move this memcg to the young generation first, which causes the generations to alternate, and then retry. Otherwise, the retries will be futile because all other bins are empty. Link: https://lkml.kernel.org/r/20230213075322.1416966-1-yuzhao@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: Yu Zhao Reported-by: T.J. Mercier Signed-off-by: Andrew Morton commit 6f7d760e86fa84862d749e36ebd29abf31f4f883 Author: Huang Ying Date: Mon Feb 13 20:34:44 2023 +0800 migrate_pages: move THP/hugetlb migration support check to simplify code This is a code cleanup patch, no functionality change is expected. After the change, the line number reduces especially in the long migrate_pages_batch(). Link: https://lkml.kernel.org/r/20230213123444.155149-10-ying.huang@intel.com Signed-off-by: "Huang, Ying" Suggested-by: Alistair Popple Reviewed-by: Zi Yan Cc: Yang Shi Cc: Baolin Wang Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Xin Hao Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit 7e12beb8ca2ac98b2ec42e0ea4b76cdc93b58654 Author: Huang Ying Date: Mon Feb 13 20:34:43 2023 +0800 migrate_pages: batch flushing TLB The TLB flushing will cost quite some CPU cycles during the folio migration in some situations. For example, when migrate a folio of a process with multiple active threads that run on multiple CPUs. After batching the _unmap and _move in migrate_pages(), the TLB flushing can be batched easily with the existing TLB flush batching mechanism. This patch implements that. We use the following test case to test the patch. On a 2-socket Intel server, - Run pmbench memory accessing benchmark - Run `migratepages` to migrate pages of pmbench between node 0 and node 1 back and forth. With the patch, the TLB flushing IPI reduces 99.1% during the test and the number of pages migrated successfully per second increases 291.7%. Haoxin helped to test the patchset on an ARM64 server with 128 cores, 2 NUMA nodes. Test results show that the page migration performance increases up to 78%. NOTE: TLB flushing is batched only for normal folios, not for THP folios. Because the overhead of TLB flushing for THP folios is much lower than that for normal folios (about 1/512 on x86 platform). Link: https://lkml.kernel.org/r/20230213123444.155149-9-ying.huang@intel.com Signed-off-by: "Huang, Ying" Tested-by: Xin Hao Reviewed-by: Zi Yan Reviewed-by: Xin Hao Cc: Yang Shi Cc: Baolin Wang Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Alistair Popple Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit ebe75e4751063dce6f61b579b43de86dcf7b7462 Author: Huang Ying Date: Mon Feb 13 20:34:42 2023 +0800 migrate_pages: share more code between _unmap and _move This is a code cleanup patch to reduce the duplicated code between the _unmap and _move stages of migrate_pages(). No functionality change is expected. Link: https://lkml.kernel.org/r/20230213123444.155149-8-ying.huang@intel.com Signed-off-by: "Huang, Ying" Cc: Zi Yan Cc: Yang Shi Cc: Baolin Wang Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Alistair Popple Cc: Xin Hao Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit 80562ba0d8378e89fe5836c28ea56c2aab3014e8 Author: Huang Ying Date: Mon Feb 13 20:34:41 2023 +0800 migrate_pages: move migrate_folio_unmap() Just move the position of the functions. There's no any functionality change. This is to make it easier to review the next patch via putting code near its position in the next patch. Link: https://lkml.kernel.org/r/20230213123444.155149-7-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Zi Yan Cc: Yang Shi Cc: Baolin Wang Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Alistair Popple Cc: Xin Hao Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit 5dfab109d5193e6c224d96cabf90e9cc2c039884 Author: Huang Ying Date: Mon Feb 13 20:34:40 2023 +0800 migrate_pages: batch _unmap and _move In this patch the _unmap and _move stage of the folio migration is batched. That for, previously, it is, for each folio _unmap() _move() Now, it is, for each folio _unmap() for each folio _move() Based on this, we can batch the TLB flushing and use some hardware accelerator to copy folios between batched _unmap and batched _move stages. Link: https://lkml.kernel.org/r/20230213123444.155149-6-ying.huang@intel.com Signed-off-by: "Huang, Ying" Tested-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Zi Yan Cc: Yang Shi Cc: Baolin Wang Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Alistair Popple Cc: Xin Hao Cc: Minchan Kim Cc: Mike Kravetz Signed-off-by: Andrew Morton commit 64c8902ed4418317cd416c566f896bd4a92b2efc Author: Huang Ying Date: Mon Feb 13 20:34:39 2023 +0800 migrate_pages: split unmap_and_move() to _unmap() and _move() This is a preparation patch to batch the folio unmapping and moving. In this patch, unmap_and_move() is split to migrate_folio_unmap() and migrate_folio_move(). So, we can batch _unmap() and _move() in different loops later. To pass some information between unmap and move, the original unused dst->mapping and dst->private are used. Link: https://lkml.kernel.org/r/20230213123444.155149-5-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Baolin Wang Reviewed-by: Xin Hao Cc: Zi Yan Cc: Yang Shi Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Alistair Popple Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit 42012e0436d44aeb2e68f11a28ddd0ad3f38b61f Author: Huang Ying Date: Mon Feb 13 20:34:38 2023 +0800 migrate_pages: restrict number of pages to migrate in batch This is a preparation patch to batch the folio unmapping and moving for non-hugetlb folios. If we had batched the folio unmapping, all folios to be migrated would be unmapped before copying the contents and flags of the folios. If the folios that were passed to migrate_pages() were too many in unit of pages, the execution of the processes would be stopped for too long time, thus too long latency. For example, migrate_pages() syscall will call migrate_pages() with all folios of a process. To avoid this possible issue, in this patch, we restrict the number of pages to be migrated to be no more than HPAGE_PMD_NR. That is, the influence is at the same level of THP migration. Link: https://lkml.kernel.org/r/20230213123444.155149-4-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Baolin Wang Cc: Zi Yan Cc: Yang Shi Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Alistair Popple Cc: Xin Hao Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit e5bfff8b10e496378da4b7863479dd6fb907d4ea Author: Huang Ying Date: Mon Feb 13 20:34:37 2023 +0800 migrate_pages: separate hugetlb folios migration This is a preparation patch to batch the folio unmapping and moving for the non-hugetlb folios. Based on that we can batch the TLB shootdown during the folio migration and make it possible to use some hardware accelerator for the folio copying. In this patch the hugetlb folios and non-hugetlb folios migration is separated in migrate_pages() to make it easy to change the non-hugetlb folios migration implementation. Link: https://lkml.kernel.org/r/20230213123444.155149-3-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Baolin Wang Reviewed-by: Xin Hao Cc: Zi Yan Cc: Yang Shi Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Alistair Popple Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit 5b855937096aea7f81e73ad6d40d433c9dd49577 Author: Huang Ying Date: Mon Feb 13 20:34:36 2023 +0800 migrate_pages: organize stats with struct migrate_pages_stats Patch series "migrate_pages(): batch TLB flushing", v5. Now, migrate_pages() migrates folios one by one, like the fake code as follows, for each folio unmap flush TLB copy restore map If multiple folios are passed to migrate_pages(), there are opportunities to batch the TLB flushing and copying. That is, we can change the code to something as follows, for each folio unmap for each folio flush TLB for each folio copy for each folio restore map The total number of TLB flushing IPI can be reduced considerably. And we may use some hardware accelerator such as DSA to accelerate the folio copying. So in this patch, we refactor the migrate_pages() implementation and implement the TLB flushing batching. Base on this, hardware accelerated folio copying can be implemented. If too many folios are passed to migrate_pages(), in the naive batched implementation, we may unmap too many folios at the same time. The possibility for a task to wait for the migrated folios to be mapped again increases. So the latency may be hurt. To deal with this issue, the max number of folios be unmapped in batch is restricted to no more than HPAGE_PMD_NR in the unit of page. That is, the influence is at the same level of THP migration. We use the following test to measure the performance impact of the patchset, On a 2-socket Intel server, - Run pmbench memory accessing benchmark - Run `migratepages` to migrate pages of pmbench between node 0 and node 1 back and forth. With the patch, the TLB flushing IPI reduces 99.1% during the test and the number of pages migrated successfully per second increases 291.7%. Xin Hao helped to test the patchset on an ARM64 server with 128 cores, 2 NUMA nodes. Test results show that the page migration performance increases up to 78%. This patch (of 9): Define struct migrate_pages_stats to organize the various statistics in migrate_pages(). This makes it easier to collect and consume the statistics in multiple functions. This will be needed in the following patches in the series. Link: https://lkml.kernel.org/r/20230213123444.155149-1-ying.huang@intel.com Link: https://lkml.kernel.org/r/20230213123444.155149-2-ying.huang@intel.com Signed-off-by: "Huang, Ying" Reviewed-by: Alistair Popple Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Xin Hao Cc: Yang Shi Cc: Oscar Salvador Cc: Matthew Wilcox Cc: Bharata B Rao Cc: Minchan Kim Cc: Mike Kravetz Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit 0621d160f1003a8aedd3628133568ecffdd724f7 Author: Andrey Konovalov Date: Fri Feb 10 22:16:06 2023 +0100 lib/stackdepot: move documentation comments to stackdepot.h Move all interface- and usage-related documentation comments to include/linux/stackdepot.h. It makes sense to have them in the header where they are available to the interface users. [akpm@linux-foundation.org: grammar fix, per Alexander] Link: https://lkml.kernel.org/r/fbfee41495b306dd8881f9b1c1b80999c885e82f.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit b232b9995a6dbaafe19d07d81acc039bc84bd569 Author: Andrey Konovalov Date: Fri Feb 10 22:16:05 2023 +0100 lib/stackdepot: various comments clean-ups Clean up comments in include/linux/stackdepot.h and lib/stackdepot.c: 1. Rework the initialization comment in stackdepot.h. 2. Rework the header comment in stackdepot.c. 3. Various clean-ups for other comments. Also adjust whitespaces for find_stack and depot_alloc_stack call sites. No functional changes. Link: https://lkml.kernel.org/r/5836231b7954355e2311fc9b5870f697ea8e1f7d.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit beb3c23c69a91a10f247e93ffef1fcd0209d93e4 Author: Andrey Konovalov Date: Fri Feb 10 22:16:04 2023 +0100 lib/stackdepot: annotate racy pool_index accesses Accesses to pool_index are protected by pool_lock everywhere except in a sanity check in stack_depot_fetch. The read access there can race with the write access in depot_alloc_stack. Use WRITE/READ_ONCE() to annotate the racy accesses. As the sanity check is only used to print a warning in case of a violation of the stack depot interface usage, it does not make a lot of sense to use proper synchronization. [andreyknvl@google.com: s/pool_index/pool_index_cached/ in stack_depot_fetch()] Link: https://lkml.kernel.org/r/95cf53f0da2c112aa2cc54456cbcd6975c3ff343.1676129911.git.andreyknvl@google.com Link: https://lkml.kernel.org/r/359ac9c13cd0869c56740fb2029f505e41593830.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 36aa1e6779c3c6f8e0d4552544214f5cffe3c287 Author: Andrey Konovalov Date: Fri Feb 10 22:16:03 2023 +0100 lib/stacktrace, kasan, kmsan: rework extra_bits interface The current implementation of the extra_bits interface is confusing: passing extra_bits to __stack_depot_save makes it seem that the extra bits are somehow stored in stack depot. In reality, they are only embedded into a stack depot handle and are not used within stack depot. Drop the extra_bits argument from __stack_depot_save and instead provide a new stack_depot_set_extra_bits function (similar to the exsiting stack_depot_get_extra_bits) that saves extra bits into a stack depot handle. Update the callers of __stack_depot_save to use the new interace. This change also fixes a minor issue in the old code: __stack_depot_save does not return NULL if saving stack trace fails and extra_bits is used. Link: https://lkml.kernel.org/r/317123b5c05e2f82854fc55d8b285e0869d3cb77.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit d11a5621f3252120dfc7cef7600a90bd8e605caf Author: Andrey Konovalov Date: Fri Feb 10 22:16:02 2023 +0100 lib/stackdepot: rename next_pool_inited to next_pool_required Stack depot uses next_pool_inited to mark that either the next pool is initialized or the limit on the number of pools is reached. However, the flag name only reflects the former part of its purpose, which is confusing. Rename next_pool_inited to next_pool_required and invert its value. Also annotate usages of next_pool_required with comments. Link: https://lkml.kernel.org/r/484fd2695dff7a9bdc437a32f8a6ee228535aa02.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit cd0fc64e76844758b78d0fd376ae3ca4fd802049 Author: Andrey Konovalov Date: Fri Feb 10 22:16:01 2023 +0100 lib/stackdepot: annotate depot_init_pool and depot_alloc_stack Clean up the exisiting comments and add new ones to depot_init_pool and depot_alloc_stack. As a part of the clean-up, remove mentions of which variable is accessed by smp_store_release and smp_load_acquire: it is clear as is from the code. Link: https://lkml.kernel.org/r/f80b02951364e6b40deda965b4003de0cd1a532d.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 514d5c557b8b590a80f0569af5ae5f4d455ecef2 Author: Andrey Konovalov Date: Fri Feb 10 22:16:00 2023 +0100 lib/stacktrace: drop impossible WARN_ON for depot_init_pool depot_init_pool has two call sites: 1. In depot_alloc_stack with a potentially NULL prealloc. 2. In __stack_depot_save with a non-NULL prealloc. At the same time depot_init_pool can only return false when prealloc is NULL. As the second call site makes sure that prealloc is not NULL, the WARN_ON there can never trigger. Thus, drop the WARN_ON and also move the prealloc check from depot_init_pool to its first call site. Also change the return type of depot_init_pool to void as it now always returns true. Link: https://lkml.kernel.org/r/ce149f9bdcbc80a92549b54da67eafb27f846b7b.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit cb788e84a4cfe47941cded45b5ca81a917fbb1a6 Author: Andrey Konovalov Date: Fri Feb 10 22:15:59 2023 +0100 lib/stackdepot: rename init_stack_pool Rename init_stack_pool to depot_init_pool to align the name with depot_alloc_stack. No functional changes. Link: https://lkml.kernel.org/r/23106a3e291d8df0aba33c0e2fe86dc596286479.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 424cafee4a9c66435d8b86e7edbc794c116b52a5 Author: Andrey Konovalov Date: Fri Feb 10 22:15:58 2023 +0100 lib/stackdepot: rename handle and pool constants Change the "STACK_ALLOC_" prefix to "DEPOT_" for the constants that define the number of bits in stack depot handles and the maximum number of pools. The old prefix is unclear and makes wonder about how these constants are related to stack allocations. The new prefix is also shorter. Also simplify the comment for DEPOT_POOL_ORDER. No functional changes. Link: https://lkml.kernel.org/r/84fcceb0acc261a356a0ad4bdfab9ff04bea2445.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 961c949b012f009c51ce209ded801e34d0a75306 Author: Andrey Konovalov Date: Fri Feb 10 22:15:57 2023 +0100 lib/stackdepot: rename slab to pool Use "pool" instead of "slab" for naming memory regions stack depot uses to store stack traces. Using "slab" is confusing, as stack depot pools have nothing to do with the slab allocator. Also give better names to pool-related global variables: change "depot_" prefix to "pool_" to point out that these variables are related to stack depot pools. Also rename the slabindex (poolindex) field in handle_parts to pool_index to align its name with the pool_index global variable. No functional changes. Link: https://lkml.kernel.org/r/923c507edb350c3b6ef85860f36be489dfc0ad21.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Vlastimil Babka Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 4c2e9a679468a5bef2100504914481c6ddf0d9bd Author: Andrey Konovalov Date: Fri Feb 10 22:15:56 2023 +0100 lib/stackdepot: rename hash table constants and variables Give more meaningful names to hash table-related constants and variables: 1. Rename STACK_HASH_SCALE to STACK_HASH_TABLE_SCALE to point out that it is related to scaling the hash table. 2. Rename STACK_HASH_ORDER_MIN/MAX to STACK_BUCKET_NUMBER_ORDER_MIN/MAX to point out that it is related to the number of hash table buckets. 3. Rename stack_hash_order to stack_bucket_number_order for the same reason as #2. No functional changes. Link: https://lkml.kernel.org/r/f166dd6f3cb2378aea78600714393dd568c33ee9.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 0d249ac0e07680960929a2d4f7b32be505c8c7a1 Author: Andrey Konovalov Date: Fri Feb 10 22:15:55 2023 +0100 lib/stackdepot: reorder and annotate global variables Group stack depot global variables by their purpose: 1. Hash table-related variables, 2. Slab-related variables, and add comments. Also clean up comments for hash table-related constants. Link: https://lkml.kernel.org/r/5606a6c70659065a25bee59cd10e57fc60bb4110.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit c60324fbf05d9b1dd3231f5373d4bf31cc23db07 Author: Andrey Konovalov Date: Fri Feb 10 22:15:54 2023 +0100 lib/stackdepot: lower the indentation in stack_depot_init stack_depot_init does most things inside an if check. Move them out and use a goto statement instead. No functional changes. Link: https://lkml.kernel.org/r/8e382f1f0c352e4b2ad47326fec7782af961fe8e.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit df225c877d898992740d26250727a16db65c370d Author: Andrey Konovalov Date: Fri Feb 10 22:15:53 2023 +0100 lib/stackdepot: annotate init and early init functions Add comments to stack_depot_early_init and stack_depot_init to explain certain parts of their implementation. Also add a pr_info message to stack_depot_early_init similar to the one in stack_depot_init. Also move the scale variable in stack_depot_init to the scope where it is being used. Link: https://lkml.kernel.org/r/d17fbfbd4d73f38686c5e3d4824a6d62047213a1.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 735df3c3a3493cbedfa86739eec6e2ee37fe95f8 Author: Andrey Konovalov Date: Fri Feb 10 22:15:52 2023 +0100 lib/stackdepot: rename stack_depot_disable Rename stack_depot_disable to stack_depot_disabled to make its name look similar to the names of other stack depot flags. Also put stack_depot_disabled's definition together with the other flags. Also rename is_stack_depot_disabled to disable_stack_depot: this name looks more conventional for a function that processes a boot parameter. No functional changes. Link: https://lkml.kernel.org/r/d78a07d222e689926e5ead229e4a2e3d87dc9aa7.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 1c0310add78e7e47e3357c24369b61453a5a72eb Author: Andrey Konovalov Date: Fri Feb 10 22:15:51 2023 +0100 lib/stackdepot, mm: rename stack_depot_want_early_init Rename stack_depot_want_early_init to stack_depot_request_early_init. The old name is confusing, as it hints at returning some kind of intention of stack depot. The new name reflects that this function requests an action from stack depot instead. No functional changes. [akpm@linux-foundation.org: update mm/kmemleak.c] Link: https://lkml.kernel.org/r/359f31bf67429a06e630b4395816a967214ef753.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton commit 4a6b5314d6bd9093dcc3c0c8e185af7df9a0fe34 Author: Andrey Konovalov Date: Fri Feb 10 22:15:50 2023 +0100 lib/stackdepot: use pr_fmt to define message format Use pr_fmt to define the format for printing stack depot messages instead of duplicating the "Stack Depot" prefix in each message. Link: https://lkml.kernel.org/r/3d09db0171a0e92ff3eb0ee74de74558bc9b56c4.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Signed-off-by: Andrew Morton commit 15ef6a982f40a2b53b057dad24f00c3fb43e7e70 Author: Andrey Konovalov Date: Fri Feb 10 22:15:49 2023 +0100 lib/stackdepot: put functions in logical order Patch series "lib/stackdepot: fixes and clean-ups", v2. A set of fixes, comments, and clean-ups I came up with while reading the stack depot code. This patch (of 18): Put stack depot functions' declarations and definitions in a more logical order: 1. Functions that save stack traces into stack depot. 2. Functions that fetch and print stack traces. 3. stack_depot_get_extra_bits that operates on stack depot handles and does not interact with the stack depot storage. No functional changes. Link: https://lkml.kernel.org/r/cover.1676063693.git.andreyknvl@google.com Link: https://lkml.kernel.org/r/daca1319b665d826b94c596b992a8d8117846147.1676063693.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Alexander Potapenko Cc: Evgenii Stepanov Cc: Marco Elver Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f3ca73862453ac1e64fc6968a14bf66d839cd2d8 Author: Jens Axboe Date: Thu Feb 16 19:39:15 2023 -0700 block: use proper return value from bio_failfast() kernel test robot complains about a type mismatch: block/blk-merge.c:984:42: sparse: expected restricted blk_opf_t const [usertype] ff block/blk-merge.c:984:42: sparse: got unsigned int block/blk-merge.c:1010:42: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted blk_opf_t const [usertype] ff @@ got unsigned int @@ block/blk-merge.c:1010:42: sparse: expected restricted blk_opf_t const [usertype] ff block/blk-merge.c:1010:42: sparse: got unsigned int because bio_failfast() is return an unsigned int rather than the appropriate blk_opt_f type. Fix it up. Fixes: 3ce6a115980c ("block: sync mixed merged request's failfast with 1st bio's") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302170743.GXypM9Rt-lkp@intel.com/ Signed-off-by: Jens Axboe commit 40f4b05868101e047a8502ebb94f05312186421b Merge: 697c3892d825f c74e7af1245b2 Author: Mark Brown Date: Fri Feb 17 02:14:50 2023 +0000 Merge remote-tracking branch 'regmap/for-6.3' into regmap-next commit df71a42cc37a44cdc7682f57aecf14ff44391eed Author: Taichi Nishimura Date: Thu Feb 16 17:55:37 2023 +0900 Fix typos in selftest/bpf files Run spell checker on files in selftest/bpf and fixed typos. Signed-off-by: Taichi Nishimura Signed-off-by: Andrii Nakryiko Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/bpf/20230216085537.519062-1-awkrail01@gmail.com commit cc29eadef921fe52aa58f32536a93d9ea0ca3eb7 Author: Jerry Hoemann Date: Fri Feb 10 11:42:47 2023 -0700 Documentation/watchdog/hpwdt: Fix Format Add list format so that compiled documentation looks like it was intended to. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230210184247.221134-3-jerry.hoemann@hpe.com Signed-off-by: Jonathan Corbet commit 5e3be09f3fb2ac3bc1e86680683f2151836e669e Author: Jerry Hoemann Date: Fri Feb 10 11:42:46 2023 -0700 Documentation/watchdog/hpwdt: Fix Reference The IPMI documentation moved to Documentation/driver-api/ipmi.rst. Update reference to reflect new location. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230210184247.221134-2-jerry.hoemann@hpe.com Signed-off-by: Jonathan Corbet commit c74e7af1245b2073930afc9a2a340d91e08f0f14 Author: Aidan MacDonald Date: Thu Feb 16 22:32:00 2023 +0000 regmap-irq: Remove unused mask_invert flag mask_invert is deprecated and no longer used; it can now be removed. Signed-off-by: Aidan MacDonald Link: https://lore.kernel.org/r/20230216223200.150679-2-aidanmacdonald.0x0@gmail.com Signed-off-by: Mark Brown commit 483e6ea1b35aaeffd9b6e6e660d756be49c2a9f5 Author: Aidan MacDonald Date: Thu Feb 16 22:31:59 2023 +0000 regmap-irq: Remove unused type_invert flag type_invert is deprecated and no longer used; it can now be removed. Signed-off-by: Aidan MacDonald Link: https://lore.kernel.org/r/20230216223200.150679-1-aidanmacdonald.0x0@gmail.com Signed-off-by: Mark Brown commit d2fb903f7d11e47366a2f6ff4ec530978fb73bfd Author: Randy Dunlap Date: Tue Feb 14 21:37:44 2023 -0800 Documentation: core-api: padata: correct spelling Correct spelling problems for Documentation/core-api/padata.rst as reported by codespell. Signed-off-by: Randy Dunlap Cc: netdev@vger.kernel.org Cc: Steffen Klassert Cc: Daniel Jordan Cc: linux-crypto@vger.kernel.org Cc: Herbert Xu Cc: "David S. Miller" Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Cc: Jakub Kicinski Reviewed-by: Mukesh Ojha Acked-by: Daniel Jordan Link: https://lore.kernel.org/r/20230215053744.11716-1-rdunlap@infradead.org Signed-off-by: Jonathan Corbet commit 5ea8937ee6b131aec59de890b72994b51a18bb82 Author: Lukas Bulwahn Date: Wed Feb 15 11:08:08 2023 +0100 docs/mm: Physical Memory: correct spelling in reference to CONFIG_PAGE_EXTENSION Commit 5d8c5e430a63 ("docs/mm: Physical Memory: add structure, introduction and nodes description") slips in a minor spelling mistake for the config PAGE_EXTENSION. Correct the config name in the physical-memory documentation. Signed-off-by: Lukas Bulwahn Acked-by: Mike Rapoport (IBM) Link: https://lore.kernel.org/r/20230215100808.9613-1-lukas.bulwahn@gmail.com Signed-off-by: Jonathan Corbet commit c5a237a4db21ca7a28518c994def39d7bd62a0d1 Author: Ilya Leoshkevich Date: Wed Feb 15 00:12:18 2023 +0100 selftests/bpf: Use bpf_{btf,link,map,prog}_get_info_by_fd() Use the new type-safe wrappers around bpf_obj_get_info_by_fd(). Fix a prog/map mixup in prog_holds_map(). Signed-off-by: Ilya Leoshkevich Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230214231221.249277-6-iii@linux.ibm.com commit c0ca277bb8bc43152d2b2fa60b47a1e1d609da45 Author: Ilya Leoshkevich Date: Wed Feb 15 00:12:17 2023 +0100 samples/bpf: Use bpf_{btf,link,map,prog}_get_info_by_fd() Use the new type-safe wrappers around bpf_obj_get_info_by_fd(). Signed-off-by: Ilya Leoshkevich Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230214231221.249277-5-iii@linux.ibm.com commit 38f0408ef756e738387f7d8f62b8d58ca5938da4 Author: Ilya Leoshkevich Date: Wed Feb 15 00:12:16 2023 +0100 bpftool: Use bpf_{btf,link,map,prog}_get_info_by_fd() Use the new type-safe wrappers around bpf_obj_get_info_by_fd(). Split the bpf_obj_get_info_by_fd() call in build_btf_type_table() in two, since knowing the type helps with the Memory Sanitizer. Improve map_parse_fd_and_info() type safety by using struct bpf_map_info * instead of void * for info. Signed-off-by: Ilya Leoshkevich Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20230214231221.249277-4-iii@linux.ibm.com commit 629dfc660cae86a6a48d19f5295226d03caae673 Author: Ilya Leoshkevich Date: Wed Feb 15 00:12:15 2023 +0100 libbpf: Use bpf_{btf,link,map,prog}_get_info_by_fd() Use the new type-safe wrappers around bpf_obj_get_info_by_fd(). Signed-off-by: Ilya Leoshkevich Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230214231221.249277-3-iii@linux.ibm.com commit 55a9ed0e16baf4d025c160d46bc1e3fac0d4cdc4 Author: Ilya Leoshkevich Date: Wed Feb 15 00:12:14 2023 +0100 libbpf: Introduce bpf_{btf,link,map,prog}_get_info_by_fd() These are type-safe wrappers around bpf_obj_get_info_by_fd(). They found one problem in selftests, and are also useful for adding Memory Sanitizer annotations. Signed-off-by: Ilya Leoshkevich Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230214231221.249277-2-iii@linux.ibm.com commit 23c198e3dfaabbc891681aecb0855b9e0ac791e1 Merge: a5fcd228ca1db 1bb31131231dd Author: Dan Williams Date: Thu Feb 16 15:27:12 2023 -0800 Merge branch 'for-6.3/cxl-events' into cxl/next Include some additional fixups for event support for v6.3, namely, rationalize the identifiers in the trace output and fixup a kdoc comment. commit 9574d57f2d43361e2e796ace8b055f4359261ba1 Author: Lukas Bulwahn Date: Thu Dec 15 11:13:10 2022 +0100 PCI: hv: Drop duplicate PCI_MSI dependency Commit a474d3fbe287 ("PCI/MSI: Get rid of PCI_MSI_IRQ_DOMAIN") removed PCI_MSI_IRQ_DOMAIN and made all previous references to it refer to PCI_MSI instead. PCI_HYPERV_INTERFACE already depended on PCI_MSI && PCI_MSI_IRQ_DOMAIN, so we ended up with a redundant dependency on PCI_MSI && PCI_MSI. Drop the duplicate. No functional change. Just a stylistic clean-up. Link: https://lore.kernel.org/r/20221215101310.9135-1-lukas.bulwahn@gmail.com Signed-off-by: Lukas Bulwahn Signed-off-by: Bjorn Helgaas commit 4e98799a7021b51d1e641a8150ef71ef90c756ab Author: Jonathan Corbet Date: Thu Feb 16 16:06:44 2023 -0700 docs: Use HTML comments for the kernel-toc SPDX line This line was initially placed in {# jinja2 comments #}, but that led to an "invalid token" complaint from spdxcheck.py. Rather than fix the script for a usage we'll likely never see anywhere else, just switch to an HTML comment, which spdxcheck.py thinks is fine. Signed-off-by: Jonathan Corbet commit 1bb31131231ddef851bd01299f19603d38a111de Author: Alison Schofield Date: Thu Feb 16 11:24:26 2023 -0800 cxl/mem: Add kdoc param for event log driver state This makes the kernel-doc for cxl_dev_state complete. Signed-off-by: Alison Schofield Link: https://lore.kernel.org/r/20230216192426.1184606-1-alison.schofield@intel.com Signed-off-by: Dan Williams commit 6606f4c3c48c7a75b13816266d3ea562eeec0b44 Author: Logan Gunthorpe Date: Thu Feb 9 10:29:53 2023 -0700 PCI/P2PDMA: Annotate RCU dereference A dereference of the __rcu pointer was noticed by sparse: drivers/pci/p2pdma.c:199:44: sparse: sparse: dereference of noderef expression Dereference the __rcu pointer using rcu_dereference_protected() instead of accessing it directly. It's safe to use rcu_dereference_protected() because a reference is held on the pgmap's percpu reference counter and thus it cannot disappear. Link: https://lore.kernel.org/r/20230209172953.4597-1-logang@deltatee.com Reported-by: kernel test robot Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Chaitanya Kulkarni commit 279676c9aa5e5f11377dddfdecfd22df526ee9b8 Author: Ira Weiny Date: Tue Feb 14 20:12:45 2023 -0800 cxl/trace: Add serial number to trace points Device serial numbers are useful information for the user. Add device serial numbers to all the trace points. Cc: Steven Rostedt Cc: Dave Jiang Signed-off-by: Ira Weiny Link: https://lore.kernel.org/r/20230208-cxl-event-names-v2-3-fca130c2c68b@intel.com Signed-off-by: Dan Williams commit cd0570172dd8427e0bf36b4d70f0b595616da55d Author: Ira Weiny Date: Tue Feb 14 20:12:44 2023 -0800 cxl/trace: Add host output to trace points The host parameter of where the memdev is connected is useful information. Report host consistently in all trace points. Cc: Steven Rostedt Cc: Dave Jiang Signed-off-by: Ira Weiny Link: https://lore.kernel.org/r/20230208-cxl-event-names-v2-2-fca130c2c68b@intel.com Signed-off-by: Dan Williams commit 0c8393dcdb1ef4dc358d95a2523297175135874b Author: Ira Weiny Date: Tue Feb 14 20:12:43 2023 -0800 cxl/trace: Standardize device information output The trace points were written to take a struct device input for the trace. In CXL multiple device objects are associated with each CXL hardware device. Using different device objects in the trace point can lead to confusion for users. The PCIe device is nice to have, but the user space tooling relies on the memory device naming. It is better to have those device names reported. Change all trace points to take struct cxl_memdev as a standard and report that name. Furthermore, standardize on the name 'memdev' in both /sys/kernel/tracing/trace and cxl-cli monitor output. Cc: Steven Rostedt Cc: Dave Jiang Signed-off-by: Ira Weiny Link: https://lore.kernel.org/r/20230208-cxl-event-names-v2-1-fca130c2c68b@intel.com Signed-off-by: Dan Williams commit afeff81765c62da857ff709309f7351a56113795 Merge: ceaa837f96adb 88941ddefc2a2 Author: Arnd Bergmann Date: Thu Feb 16 22:09:53 2023 +0100 Merge tag 'davinci-fixes-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into arm/fixes DaVinci fixes for v6.2 - add myself as maintainer * tag 'davinci-fixes-for-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: make me the maintainer of DaVinci platforms commit e43efb6d713bca3855909a2f9caec280a2b0a503 Author: Conor Dooley Date: Thu Feb 16 13:15:12 2023 +0000 dt-bindings: riscv: correct starfive visionfive 2 compatibles Using "va" and "vb" doesn't match what's written on the board, or the communications from StarFive. Switching to using the silkscreened version number will ease confusion & the risk of another spin of the board containing a "conflicting" version identifier. As the binding has not made it into mainline yet, take the opportunity to "correct" things. Suggested-by: Emil Renner Berthing Link: https://lore.kernel.org/linux-riscv/Y+4AxDSDLyL1WAqh@wendy/ Fixes: 97b7ed072784 ("dt-bindings: riscv: Add StarFive JH7110 SoC and VisionFive 2 board") Signed-off-by: Conor Dooley Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230216131511.3327943-1-conor.dooley@microchip.com Signed-off-by: Arnd Bergmann commit 5be374d0d1c4fc8731736a269083747412901053 Merge: 18b68c695ca6f 2d050f06485ae Author: Arnd Bergmann Date: Thu Feb 16 22:06:41 2023 +0100 Merge tag 'socfpga_dts_updates_for_v6.3_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/dt SoCFPGA dts updates for v6.3, part 2 - Add support for the enclustra PE1 board that is based on Arria10 * tag 'socfpga_dts_updates_for_v6.3_part2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: ARM: dts: socfpga: Add enclustra PE1 devicetree dt-bindings: altera: Add enclustra mercury PE1 Link: https://lore.kernel.org/r/20230216160910.509065-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit 6ad172748db49deef0da9038d29019aedf991a7e Merge: 470ac62dfa573 07c3f9224713c Author: Marc Kleine-Budde Date: Thu Feb 16 20:59:53 2023 +0100 Merge patch series "can: esd_usb: Some more preparation for supporting esd CAN-USB/3" Frank Jungclaus says: Another small batch of patches to be seen as preparation for adding support of the newly available esd CAN-USB/3 to esd_usb.c. Due to some unresolved questions adding support for CAN_CTRLMODE_BERR_REPORTING has been postponed to one of the future patches. v2 -> v3: * More specific subjects * Try to use imperative instead of past tense v1 -> v2: https://lore.kernel.org/all/20230214160223.1199464-1-frank.jungclaus@esd.eu * [Patch v2 1/3]: No changes. * [Patch v2 2/3]: Make use of can_change_state() and relocate testing alloc_can_err_skb() for NULL to the end of esd_usb_rx_event(), to have things like can_bus_off(), can_change_state() working even in out of memory conditions. * [Patch v2 3/3]: No changes. I will 'declare esd_usb_msg as an union instead of a struct' in a separate follow-up patch. v1: https://lore.kernel.org/all/20221219212013.1294820-1-frank.jungclaus@esd.eu https://lore.kernel.org/all/20221219212717.1298282-1-frank.jungclaus@esd.eu Link: https://lore.kernel.org/all/20230216190450.3901254-1-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 07c3f9224713c1b5f82c4583a456a6abc28f9d73 Author: Frank Jungclaus Date: Thu Feb 16 20:04:50 2023 +0100 can: esd_usb: Improve readability on decoding ESD_EV_CAN_ERROR_EXT messages As suggested by Marc introduce a union plus a struct ev_can_err_ext for easier decoding of an ESD_EV_CAN_ERROR_EXT event message (which simply is a rx_msg with some dedicated data). Suggested-by: Marc Kleine-Budde Link: https://lore.kernel.org/linux-can/20220621071152.ggyhrr5sbzvwpkpx@pengutronix.de/ Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/all/20230216190450.3901254-4-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 9684b000a86299b5968fef8ffbf1484def37452a Author: Frank Jungclaus Date: Thu Feb 16 20:04:49 2023 +0100 can: esd_usb: Make use of can_change_state() and relocate checking skb for NULL Start a rework initiated by Vincents remarks "You should not report the greatest of txerr and rxerr but the one which actually increased." [1] and "As far as I understand, those flags should be set only when the threshold is reached" [2] . Therefore make use of can_change_state() to (among others) set the flags CAN_ERR_CRTL_[RT]X_WARNING and CAN_ERR_CRTL_[RT]X_PASSIVE, maintain CAN statistic counters for error_warning, error_passive and bus_off. Relocate testing alloc_can_err_skb() for NULL to the end of esd_usb_rx_event(), to have things like can_bus_off(), can_change_state() working even in out of memory conditions. Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Signed-off-by: Frank Jungclaus Link: [1] https://lore.kernel.org/all/CAMZ6RqKGBWe15aMkf8-QLf-cOQg99GQBebSm+1wEzTqHgvmNuw@mail.gmail.com/ Link: [2] https://lore.kernel.org/all/CAMZ6Rq+QBO1yTX_o6GV0yhdBj-RzZSRGWDZBS0fs7zbSTy4hmA@mail.gmail.com/ Link: https://lore.kernel.org/all/20230216190450.3901254-3-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 118469f88180438ef43dee93d71f77c00e7b425d Author: Frank Jungclaus Date: Thu Feb 16 20:04:48 2023 +0100 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error Move the supply for cf->data[3] (bit stream position of CAN error), in case of a bus- or protocol-error, outside of the "switch (ecc & SJA1000_ECC_MASK){}"-statement, because this bit stream position is independent of the error type. Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/all/20230216190450.3901254-2-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 470ac62dfa5732c149adce2cbce84ac678de701f Author: Yang Li Date: Thu Feb 16 17:06:10 2023 +0800 can: ctucanfd: ctucan_platform_probe(): use devm_platform_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to Use devm_platform_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Yang Li Reviewed-by: Alexander Lobakin Acked-by: Pavel Pisa Link: https://lore.kernel.org/all/20230216090610.130860-1-yang.lee@linux.alibaba.com Signed-off-by: Marc Kleine-Budde commit 84cb1b53cdbad52642571e31a8aee301206d2043 Merge: ca0df43d21103 22551e77e5507 Author: Jakub Kicinski Date: Thu Feb 16 11:36:14 2023 -0800 Merge branch 'mlx5-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Leon Romanovsky says: ==================== mlx5-next changes Following previous conversations [1] and our clear commitment to do the TC work [2], please pull mlx5-next shared branch, which includes low-level steering logic to allow RoCEv2 traffic to be encrypted/ decrypted through IPsec. [1] https://lore.kernel.org/all/20230126230815.224239-1-saeed@kernel.org/ [2] https://lore.kernel.org/all/Y+Z7lVVWqnRBiPh2@nvidia.com/ * 'mlx5-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Configure IPsec steering for egress RoCEv2 traffic net/mlx5: Configure IPsec steering for ingress RoCEv2 traffic net/mlx5: Add IPSec priorities in RDMA namespaces net/mlx5: Implement new destination type TABLE_TYPE net/mlx5: Introduce new destination type TABLE_TYPE ==================== Link: https://lore.kernel.org/r/20230215095624.1365200-1-leon@kernel.org Signed-off-by: Jakub Kicinski commit 5720a18baa4686d56d0a235e6ecbcc55f8d716d7 Author: Guenter Roeck Date: Thu Feb 16 11:34:19 2023 -0800 hwmon: Deprecate [devm_]hwmon_device_register_with_groups Even though the hardware monitoring documentation already stated that new drivers should use [devm_]devm_hwmon_device_register_with_info() to register with the hardware monitoring subsystem, we still get submissions for new drivers using the older APIs. There is no benefit to use those APIs. On the contrary, using the older APIs results in substantially larger code size. Explicitly deprecate [devm_]hwmon_device_register_with_groups() to ensure that all new drivers use the latest API. Signed-off-by: Guenter Roeck commit ca0df43d211039dded5a8f8553356414c9a74731 Merge: 40967f77dfa9f 1a30a6b25f263 Author: Jakub Kicinski Date: Thu Feb 16 11:33:10 2023 -0800 Merge tag 'wireless-next-2023-03-16' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Major stack changes: * EHT channel puncturing support (client & AP) * some support for AP MLD without mac80211 * fixes for A-MSDU on mesh connections Major driver changes: iwlwifi * EHT rate reporting * Bump FW API to 74 for AX devices * STEP equalizer support: transfer some STEP (connection to radio on platforms with integrated wifi) related parameters from the BIOS to the firmware mt76 * switch to using page pool allocator * mt7996 EHT (Wi-Fi 7) support * Wireless Ethernet Dispatch (WED) reset support libertas * WPS enrollee support brcmfmac * Rename Cypress 89459 to BCM4355 * BCM4355 and BCM4377 support mwifiex * SD8978 chipset support rtl8xxxu * LED support ath12k * new driver for Qualcomm Wi-Fi 7 devices ath11k * IPQ5018 support * Fine Timing Measurement (FTM) responder role support * channel 177 support ath10k * store WLAN firmware version in SMEM image table * tag 'wireless-next-2023-03-16' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (207 commits) wifi: brcmfmac: p2p: Introduce generic flexible array frame member wifi: mac80211: add documentation for amsdu_mesh_control wifi: cfg80211: remove gfp parameter from cfg80211_obss_color_collision_notify description wifi: mac80211: always initialize link_sta with sta wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() wifi: cfg80211: Set SSID if it is not already set wifi: rtw89: move H2C of del_pkt_offload before polling FW status ready wifi: rtw89: use readable return 0 in rtw89_mac_cfg_ppdu_status() wifi: rtw88: usb: drop now unnecessary URB size check wifi: rtw88: usb: send Zero length packets if necessary wifi: rtw88: usb: Set qsel correctly wifi: mac80211: fix off-by-one link setting wifi: mac80211: Fix for Rx fragmented action frames wifi: mac80211: avoid u32_encode_bits() warning wifi: mac80211: Don't translate MLD addresses for multicast wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint wifi: cfg80211: get rid of gfp in cfg80211_bss_color_notify wifi: nl80211: Allow authentication frames and set keys on NAN interface wifi: mac80211: fix non-MLO station association wifi: mac80211: Allow NSS change only up to capability ... ==================== Link: https://lore.kernel.org/r/20230216105406.208416-1-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit d8f0ae3ebed416728077fe94698983c30d409241 Author: Tom Zanussi Date: Fri Feb 10 15:33:06 2023 -0600 tracing/histogram: Fix stacktrace histogram Documententation Fix a small problem with the histogram specification in the Documentation, and change the example to show output using a stacktrace field rather than the global stacktrace. Link: https://lkml.kernel.org/r/f75f807dd4998249e513515f703a2ff7407605f4.1676063532.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit f5914b301a17575a4cbcb85a0169a3148b958064 Author: Tom Zanussi Date: Fri Feb 10 15:33:05 2023 -0600 tracing/histogram: Fix stacktrace key The current code will always use the current stacktrace as a key even if a stacktrace contained in a specific event field was specified. For example, we expect to use the 'unsigned long[] stack' field in the below event in the histogram: # echo 's:block_lat pid_t pid; u64 delta; unsigned long[] stack;' > /sys/kernel/debug/tracing/dynamic_events # echo 'hist:keys=delta.buckets=100,stack.stacktrace:sort=delta' > /sys/kernel/debug/tracing/events/synthetic/block_lat/trigger But in fact, when we type out the trigger, we see that it's using the plain old global 'stacktrace' as the key, which is just the stacktrace when the event was hit and not the stacktrace contained in the event, which is what we want: # cat /sys/kernel/debug/tracing/events/synthetic/block_lat/trigger hist:keys=delta.buckets=100,stacktrace:vals=hitcount:sort=delta.buckets=100:size=2048 [active] And in fact, there's no code to actually retrieve it from the event, so we need to add HIST_FIELD_FN_STACK and hist_field_stack() to get it and hook it into the trigger code. For now, since the stack is just using dynamic strings, this could just use the dynamic string function, but it seems cleaner to have a dedicated function an be able to tweak independently as necessary. Link: https://lkml.kernel.org/r/11aa614c82976adbfa4ea763dbe885b5fb01d59c.1676063532.git.zanussi@kernel.org Signed-off-by: Tom Zanussi [ Fixed 32bit build warning reported by kernel test robot ] Signed-off-by: Steven Rostedt (Google) commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 Author: Martin K. Petersen Date: Wed Feb 15 12:18:01 2023 -0500 block: bio-integrity: Copy flags when bio_integrity_payload is cloned Make sure to copy the flags when a bio_integrity_payload is cloned. Otherwise per-I/O properties such as IP checksum flag will not be passed down to the HBA driver. Since the integrity buffer is owned by the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off to avoid a double free in the completion path. Fixes: aae7df50190a ("block: Integrity checksum flag") Fixes: b1f01388574c ("block: Relocate bio integrity flags") Reported-by: Saurav Kashyap Tested-by: Saurav Kashyap Signed-off-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20230215171801.21062-1-martin.petersen@oracle.com Signed-off-by: Jens Axboe commit 0f7c8f0f7934c389b0f9fa1f151e753d8de6348f Author: Jinke Han Date: Thu Feb 16 11:22:50 2023 +0800 block: Fix io statistics for cgroup in throttle path In the current code, io statistics are missing for cgroup when bio was throttled by blk-throttle. Fix it by moving the unreaching code to submit_bio_noacct_nocheck. Fixes: 3f98c753717c ("block: don't check bio in blk_throtl_dispatch_work_fn") Signed-off-by: Jinke Han Reviewed-by: Ming Lei Acked-by: Muchun Song Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230216032250.74230-1-hanjinke.666@bytedance.com Signed-off-by: Jens Axboe commit 1047377754c33bf860d80714f66fa4a8e56cbbec Author: Thomas Weißschuh Date: Thu Feb 16 01:12:25 2023 +0000 PCI/sysfs: Constify struct kobj_type pci_slot_ktype Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definition to prevent modification at runtime. Link: https://lore.kernel.org/r/20230216-kobj_type-pci-v1-1-46a63c8612b5@weissschuh.net Signed-off-by: Thomas Weißschuh Signed-off-by: Bjorn Helgaas commit 2bacfd9f7e5ac18ae40ecd7b29c63580d0e5b329 Author: Tom Zanussi Date: Fri Feb 10 15:33:04 2023 -0600 tracing/histogram: Fix a few problems with stacktrace variable printing Currently, there are a few problems when printing hist triggers and trace output when using stacktrace variables. This fixes the problems seen below: # echo 'hist:keys=delta.buckets=100,stack.stacktrace:sort=delta' > /sys/kernel/debug/tracing/events/synthetic/block_lat/trigger # cat /sys/kernel/debug/tracing/events/synthetic/block_lat/trigger hist:keys=delta.buckets=100,stacktrace:vals=hitcount:sort=delta.buckets=100:size=2048 [active] # echo 'hist:keys=next_pid:ts=common_timestamp.usecs,st=stacktrace if prev_state == 2' >> /sys/kernel/debug/tracing/events/sched/sched_switch/trigger # cat /sys/kernel/debug/tracing/events/sched/sched_switch/trigger hist:keys=next_pid:vals=hitcount:ts=common_timestamp.usecs,st=stacktrace.stacktrace:sort=hitcount:size=2048:clock=global if prev_state == 2 [active] and also in the trace output (should be stack.stacktrace): { delta: ~ 100-199, stacktrace __schedule+0xa19/0x1520 Link: https://lkml.kernel.org/r/60bebd4e546728e012a7a2bcbf58716d48ba6edb.1676063532.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit 7f604e92fb805d2569aa5fb177a1c7231ea2f0cc Author: David Matlack Date: Mon Feb 13 13:28:44 2023 -0800 KVM: x86/mmu: Make tdp_mmu_allowed static Make tdp_mmu_allowed static since it is only ever used within arch/x86/kvm/mmu/mmu.c. Link: https://lore.kernel.org/kvm/202302072055.odjDVd5V-lkp@intel.com/ Reported-by: kernel test robot Signed-off-by: David Matlack Message-Id: <20230213212844.3062733-1-dmatlack@google.com> Signed-off-by: Paolo Bonzini commit 5e7b9a6ae8c352819a2d998a065910b536de0e8c Author: Christoph Hellwig Date: Thu Feb 16 07:24:19 2023 +0100 swiotlb: remove swiotlb_max_segment swiotlb_max_segment has always been a bogus API, so remove it now that the remaining callers are gone. Signed-off-by: Christoph Hellwig Reviewed-by: Robin Murphy commit f77692d65d54665d81815349cc727baa85e8b71d Author: Mike Snitzer Date: Thu Feb 16 12:10:05 2023 -0500 dm: add cond_resched() to dm_wq_requeue_work() Otherwise the while() loop in dm_wq_requeue_work() can result in a "dead loop" on systems that have preemption disabled. This is particularly problematic on single cpu systems. Fixes: 8b211aaccb915 ("dm: add two stage requeue mechanism") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit 0ca44fcef241768fd25ee763b3d203b9852f269b Author: Pingfan Liu Date: Wed Feb 15 19:23:40 2023 +0800 dm: add cond_resched() to dm_wq_work() Otherwise the while() loop in dm_wq_work() can result in a "dead loop" on systems that have preemption disabled. This is particularly problematic on single cpu systems. Cc: stable@vger.kernel.org Signed-off-by: Pingfan Liu Acked-by: Ming Lei Signed-off-by: Mike Snitzer commit 67205f80be9910207481406c47f7d85e703fb2e9 Author: Jens Axboe Date: Wed Feb 15 16:43:47 2023 -0700 brd: mark as nowait compatible By default, non-mq drivers do not support nowait. This causes io_uring to use a slower path as the driver cannot be trust not to block. brd can safely set the nowait flag, as worst case all it does is a NOIO allocation. For io_uring, this makes a substantial difference. Before: submitter=0, tid=453, file=/dev/ram0, node=-1 polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128 Engine=io_uring, sq_ring=128, cq_ring=128 IOPS=440.03K, BW=1718MiB/s, IOS/call=32/31 IOPS=428.96K, BW=1675MiB/s, IOS/call=32/32 IOPS=442.59K, BW=1728MiB/s, IOS/call=32/31 IOPS=419.65K, BW=1639MiB/s, IOS/call=32/32 IOPS=426.82K, BW=1667MiB/s, IOS/call=32/31 and after: submitter=0, tid=354, file=/dev/ram0, node=-1 polled=0, fixedbufs=1/0, register_files=1, buffered=0, QD=128 Engine=io_uring, sq_ring=128, cq_ring=128 IOPS=3.37M, BW=13.15GiB/s, IOS/call=32/31 IOPS=3.45M, BW=13.46GiB/s, IOS/call=32/31 IOPS=3.43M, BW=13.42GiB/s, IOS/call=32/32 IOPS=3.43M, BW=13.39GiB/s, IOS/call=32/31 IOPS=3.43M, BW=13.38GiB/s, IOS/call=32/31 or about an 8x in difference. Now that brd is prepared to deal with REQ_NOWAIT reads/writes, mark it as supporting that. Cc: stable@vger.kernel.org # 5.10+ Link: https://lore.kernel.org/linux-block/20230203103005.31290-1-p.raghav@samsung.com/ Signed-off-by: Jens Axboe commit 6ded703c56c21bfb259725d4f1831a5feb563e9b Author: Jens Axboe Date: Thu Feb 16 08:01:08 2023 -0700 brd: check for REQ_NOWAIT and set correct page allocation mask If REQ_NOWAIT is set, then do a non-blocking allocation if the operation is a write and we need to insert a new page. Currently REQ_NOWAIT cannot be set as the queue isn't marked as supporting nowait, this change is in preparation for allowing that. radix_tree_preload() warns on attempting to call it with an allocation mask that doesn't allow blocking. While that warning could arguably be removed, we need to handle radix insertion failures anyway as they are more likely if we cannot block to get memory. Remove legacy BUG_ON()'s and turn them into proper errors instead, one for the allocation failure and one for finding a page that doesn't match the correct index. Cc: stable@vger.kernel.org # 5.10+ Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit db0ccc44a20b4bb3039c0f6885a1f9c3323c7673 Author: Jens Axboe Date: Thu Feb 16 07:57:32 2023 -0700 brd: return 0/-error from brd_insert_page() It currently returns a page, but callers just check for NULL/page to gauge success. Clean this up and return the appropriate error directly instead. Cc: stable@vger.kernel.org # 5.10+ Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe commit 22ce6843abec19270bf69b176d7ee0a4ef781da5 Author: Joseph Hunkeler Date: Thu Feb 16 10:50:07 2023 -0500 ASoC: amd: yp: Add OMEN by HP Gaming Laptop 16z-n000 to quirks Enables display microphone on the HP OMEN 16z-n000 (8A42) laptop Signed-off-by: Joseph Hunkeler Link: https://lore.kernel.org/r/20230216155007.26143-1-jhunkeler@gmail.com Signed-off-by: Mark Brown commit a77a52385e9a761f896a88a4162e69fb7ccafe3f Author: Bob Pearson Date: Tue Feb 14 01:10:54 2023 -0600 RDMA/rxe: Fix missing memory barriers in rxe_queue.h An earlier patch which introduced smp_load_acquire/smp_store_release into rxe_queue.h incorrectly assumed that surrounding spin-locks in rxe_verbs.c around queue updates for kernel ulps was sufficient to protect the passing of data through the queues between the ulp and the rxe tasklets. But this was incorrect. The typical sequence was ulp rxe requester tasklet ------------------------ --------------------- spin_lock_irqsave() wqe = queue_head(queue) if (!queue_full(q)) { if (!wqe) spin_unlock_irqrestore return; return -ENOMEM } wqe = queue_producer_addr(q) queue_advance_consumer(queue) queue_advance_producer(q) spin_unlock_irqrestore() queue_head() calls queue_empty() which calls smp_load_acquire() For user space apps queue_advance_producer() calls smp_store_release() so that there is a memory barrier between the producer and the consumer but for kernel ulps queue_advance_produce() just incremented the producer index because the lock function is a release function. But to work the barrier has to come between filling in the wqe and updating the producer index. This patch adds the missing barriers. It also changes the enum names for the ulp queue types to QUEUE_TYPE_FROM/TO_ULP instead of QUEUE_TYPE_TO/FROM_DRIVER which is very ambiguous. This bug is suspected as the cause of very rare lockups in a very high scale storage application. It is a bug in any case and should be corrected. Fixes: 0a67c46d2e99 ("RDMA/rxe: Protect user space index loads/stores") Link: https://lore.kernel.org/r/20230214071053.5395-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit 89d42b8c85b4c67d310c5ccaf491acbf71a260c3 Author: Long Li Date: Wed Feb 15 16:32:02 2023 -0800 RDMA/mana_ib: Fix a bug when the PF indicates more entries for registering memory on first packet When registering memory in a large chunk that doesn't fit into a single PF message, the PF may return GDMA_STATUS_MORE_ENTRIES on the first message if there are more messages needed for registering more chunks. Fix the VF to make it process the correct return code. Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Link: https://lore.kernel.org/r/1676507522-21018-1-git-send-email-longli@linuxonhyperv.com Signed-off-by: Long Li Signed-off-by: Jason Gunthorpe commit a46ce4f884817c66d0dc303b663b53b37d2baa24 Author: Bartosz Golaszewski Date: Thu Feb 16 13:30:14 2023 +0100 spi: spidev: drop the incorrect notice from Kconfig The spidev interface has been de-facto stable for many years. This notice has been unchanged since 2007 and is incorrect so remove it. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230216123014.110541-1-brgl@bgdev.pl Signed-off-by: Mark Brown commit 7f62cb8861190e7cc1018ff37597fc49b2eaafa8 Author: Naresh Solanki Date: Thu Feb 16 08:53:01 2023 +0100 regulator: max597x: Align for simple_mfd_i2c driver Use regmap provided by simple_mfd_i2c driver and remove unused variable. Identify device variant by checking compatible property in DT. Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230216075302.68935-1-Naresh.Solanki@9elements.com Signed-off-by: Mark Brown commit 72a03627443d5bc7032ab98bd784740cd8a76f8a Author: Bob Pearson Date: Mon Feb 13 16:55:52 2023 -0600 RDMA/rxe: Remove rxe_alloc() Currently all the object types in the rxe driver are allocated in rdma-core except for MRs. By moving tha kzalloc() call outside of the pool code the rxe_alloc() subroutine can be eliminated and code checking for MR as a special case can be removed. This patch moves the kzalloc() and kfree_rcu() calls into the mr registration and destruction verbs. It removes that code from rxe_pool.c including the rxe_alloc() subroutine which is no longer used. Link: https://lore.kernel.org/r/20230213225551.12437-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Reviewed-by: Devesh Sharma Reviewed-by: Devesh Sharma Reviewed-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe commit 876e480da2f74715fc70e37723e77ca16a631e35 Author: Kees Cook Date: Wed Feb 8 15:25:53 2023 -0800 RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size Clang can do some aggressive inlining, which provides it with greater visibility into the sizes of various objects that are passed into helpers. Specifically, compare_netdev_and_ip() can see through the type given to the "sa" argument, which means it can generate code for "struct sockaddr_in" that would have been passed to ipv6_addr_cmp() (that expects to operate on the larger "struct sockaddr_in6"), which would result in a compile-time buffer overflow condition detected by memcmp(). Logically, this state isn't reachable due to the sa_family assignment two callers above and the check in compare_netdev_and_ip(). Instead, provide a compile-time check on sizes so the size-mismatched code will be elided when inlining. Avoids the following warning from Clang: ../include/linux/fortify-string.h:652:4: error: call to '__read_overflow' declared with 'error' attribute: detected read beyond size of object (1st parameter) __read_overflow(); ^ note: In function 'cma_netevent_callback' note: which inlined function 'node_from_ndev_ip' 1 error generated. When the underlying object size is not known (e.g. with GCC and older Clang), the result of __builtin_object_size() is SIZE_MAX, which will also compile away, leaving the code as it was originally. Link: https://lore.kernel.org/r/20230208232549.never.139-kees@kernel.org Link: https://github.com/ClangBuiltLinux/linux/issues/1687 Signed-off-by: Kees Cook Tested-by: Nathan Chancellor # build Signed-off-by: Jason Gunthorpe commit 2d050f06485ae987ba57da33bc4f7dccd4fd7485 Author: Steffen Trumtrar Date: Tue Feb 7 14:08:12 2023 +0100 ARM: dts: socfpga: Add enclustra PE1 devicetree The enclustra PE1 is a baseboard from enclustra GmbH for the enclustra Mercury AA1+ SOM. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Steffen Trumtrar Signed-off-by: Dinh Nguyen commit fc8070ec9c50008373b84a447fdfad2bea3d4cc7 Author: Steffen Trumtrar Date: Tue Feb 7 14:08:11 2023 +0100 dt-bindings: altera: Add enclustra mercury PE1 Add binding for the enclustra PE1 baseboard from enclustra GmbH. Acked-by: Krzysztof Kozlowski Signed-off-by: Steffen Trumtrar Signed-off-by: Dinh Nguyen commit 5ff31dfcd6d23f9c1bd5dd1a2c648ba499659357 Author: Bob Pearson Date: Wed Feb 1 22:42:41 2023 -0600 Subject: RDMA/rxe: Handle zero length rdma Currently the rxe driver does not handle all cases of zero length rdma operations correctly. The client does not have to provide an rkey for zero length RDMA read or write operations so the rkey provided may be invalid and should not be used to lookup an mr. This patch corrects the driver to ignore the provided rkey if the reth length is zero for read or write operations and make sure to set the mr to NULL. In read_reply() if length is zero rxe_recheck_mr() is not called. Warnings are added in the routines in rxe_mr.c to catch NULL MRs when the length is non-zero. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20230202044240.6304-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Reviewed-by: Daisuke Matsuda Signed-off-by: Jason Gunthorpe commit ddddedaa0db99481c5e5abe628ad54f65e8765bc Author: Asahi Lina Date: Sun Feb 5 21:51:24 2023 +0900 drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() Other functions touching shmem->sgt take the pages lock, so do that here too. drm_gem_shmem_get_pages() & co take the same lock, so move to the _locked() variants to avoid recursive locking. Discovered while auditing locking to write the Rust abstractions. Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") Fixes: 4fa3d66f132b ("drm/shmem: Do dma_unmap_sg before purging pages") Signed-off-by: Asahi Lina Reviewed-by: Javier Martinez Canillas Signed-off-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20230205125124.2260-1-lina@asahilina.net (cherry picked from commit aa8c85affe3facd3842c8912186623415931cc72) Signed-off-by: Javier Martinez Canillas commit 88941ddefc2a2b676135251682376b3163b4e672 Author: Bartosz Golaszewski Date: Fri Aug 19 09:16:58 2022 +0200 MAINTAINERS: make me the maintainer of DaVinci platforms Sekhar is stepping down from supporting DaVinci. As it's quite low-volume, I will keep maintaining it. Acked-by: Sekhar Nori Acked-by: Kevin Hilman Signed-off-by: Bartosz Golaszewski commit 8d1b80a79452630f157bf634ae9cfcd9f4eed161 Author: Dan Carpenter Date: Thu Feb 16 15:13:04 2023 +0300 erofs: fix an error code in z_erofs_init_zip_subsystem() Return -ENOMEM if alloc_workqueue() fails. Don't return success. Fixes: d8a650adf429 ("erofs: add per-cpu threads for decompression as an option") Signed-off-by: Dan Carpenter Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/Y+4d0FRsUq8jPoOu@kili Signed-off-by: Gao Xiang commit 3ce6a115980c019928fcd06e01f64003886af79c Author: Ming Lei Date: Thu Feb 9 20:55:27 2023 +0800 block: sync mixed merged request's failfast with 1st bio's We support mixed merge for requests/bios with different fastfail settings. When request fails, each time we only handle the portion with same failfast setting, then bios with failfast can be failed immediately, and bios without failfast can be retried. The idea is pretty good, but the current implementation has several defects: 1) initially RA bio doesn't set failfast, however bio merge code doesn't consider this point, and just check its failfast setting for deciding if mixed merge is required. Fix this issue by adding helper of bio_failfast(). 2) when merging bio to request front, if this request is mixed merged, we have to sync request's faifast setting with 1st bio's failfast. Fix it by calling blk_update_mixed_merge(). 3) when merging bio to request back, if this request is mixed merged, we have to mark the bio as failfast, because blk_update_request simply updates request failfast with 1st bio's failfast. Fix it by calling blk_update_mixed_merge(). Fixes one normal EXT4 READ IO failure issue, because it is observed that the normal READ IO is merged with RA IO, and the mixed merged request has different failfast setting with 1st bio's, so finally the normal READ IO doesn't get retried. Cc: Tejun Heo Fixes: 80a761fd33cf ("block: implement mixed merge of different failfast requests") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230209125527.667004-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit b14033a3e6ba73a5c68974a80b05cba55553ed5b Author: Nuno Das Neves Date: Thu Feb 9 14:02:52 2023 -0800 x86/hyperv: Fix hv_get/set_register for nested bringup hv_get_nested_reg only translates SINT0, resulting in the wrong sint being registered by nested vmbus. Fix the issue with new utility function hv_is_sint_reg. While at it, improve clarity of hv_set_non_nested_register and hv_is_synic_reg. Signed-off-by: Nuno Das Neves Reviewed-by: Jinank Jain Link: https://lore.kernel.org/r/1675980172-6851-1-git-send-email-nunodasneves@linux.microsoft.com Signed-off-by: Wei Liu commit 1243741f6b02b5f2c06bca910f894c333838f994 Merge: e3eafcf0fabe6 617c331d91077 Author: Greg Kroah-Hartman Date: Thu Feb 16 15:28:28 2023 +0100 Merge tag 'usb-serial-6.3-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for 6.3-rc1 Here are the USB-serial updates for 6.3-rc1; just a new modem device id this time. All have been in linux-next with no reported issues. * tag 'usb-serial-6.3-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add support for VW/Skoda "Carstick LTE" commit 7933b90b42896f5b6596e6a829bb31c5121fc2a9 Merge: 1bdb78368f944 82f1627cb6339 Author: Takashi Iwai Date: Thu Feb 16 15:06:18 2023 +0100 Merge branch 'for-linus' into for-next Pull the pending fixes for 6.3 Signed-off-by: Takashi Iwai commit 257ec290741924f8df678927d0dfecb1deebb9c5 Author: Tina Zhang Date: Thu Feb 16 21:08:16 2023 +0800 iommu/vt-d: Allow to use flush-queue when first level is default Commit 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on") forced default domains to be strict mode as long as IOMMU caching-mode is flagged. The reason for doing this is that when vIOMMU uses VT-d caching mode to synchronize shadowing page tables, the strict mode shows better performance. However, this optimization is orthogonal to the first-level page table because the Intel VT-d architecture does not define the caching mode of the first-level page table. Refer to VT-d spec, section 6.1, "When the CM field is reported as Set, any software updates to remapping structures other than first-stage mapping (including updates to not- present entries or present entries whose programming resulted in translation faults) requires explicit invalidation of the caches." Exclude the first-level page table from this optimization. Generally using first-stage translation in vIOMMU implies nested translation enabled in the physical IOMMU. In this case the first-stage page table is wholly captured by the guest. The vIOMMU only needs to transfer the cache invalidations on vIOMMU to the physical IOMMU. Forcing the default domain to strict mode will cause more frequent cache invalidations, resulting in performance degradation. In a real performance benchmark test measured by iperf receive, the performance result on Sapphire Rapids 100Gb NIC shows: w/ this fix ~51 Gbits/s, w/o this fix ~39.3 Gbits/s. Theoretically a first-stage IOMMU page table can still be shadowed in absence of the caching mode, e.g. with host write-protecting guest IOMMU page table to synchronize changed PTEs with the physical IOMMU page table. In this case the shadowing overhead is decoupled from emulating IOTLB invalidation then the overhead of the latter part is solely decided by the frequency of IOTLB invalidations. Hence allowing guest default dma domain to be lazy can also benefit the overall performance by reducing the total VM-exit numbers. Fixes: 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on") Reported-by: Sanjay Kumar Suggested-by: Sanjay Kumar Signed-off-by: Tina Zhang Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20230214025618.2292889-1-tina.zhang@intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 194b3348bdbb7db65375c72f3f774aee4cc6614e Author: Jacob Pan Date: Thu Feb 16 21:08:15 2023 +0800 iommu/vt-d: Fix PASID directory pointer coherency On platforms that do not support IOMMU Extended capability bit 0 Page-walk Coherency, CPU caches are not snooped when IOMMU is accessing any translation structures. IOMMU access goes only directly to memory. Intel IOMMU code was missing a flush for the PASID table directory that resulted in the unrecoverable fault as shown below. This patch adds clflush calls whenever allocating and updating a PASID table directory to ensure cache coherency. On the reverse direction, there's no need to clflush the PASID directory pointer when we deactivate a context entry in that IOMMU hardware will not see the old PASID directory pointer after we clear the context entry. PASID directory entries are also never freed once allocated. DMAR: DRHD: handling fault status reg 3 DMAR: [DMA Read NO_PASID] Request device [00:0d.2] fault addr 0x1026a4000 [fault reason 0x51] SM: Present bit in Directory Entry is clear DMAR: Dump dmar1 table entries for IOVA 0x1026a4000 DMAR: scalable mode root entry: hi 0x0000000102448001, low 0x0000000101b3e001 DMAR: context entry: hi 0x0000000000000000, low 0x0000000101b4d401 DMAR: pasid dir entry: 0x0000000101b4e001 DMAR: pasid table entry[0]: 0x0000000000000109 DMAR: pasid table entry[1]: 0x0000000000000001 DMAR: pasid table entry[2]: 0x0000000000000000 DMAR: pasid table entry[3]: 0x0000000000000000 DMAR: pasid table entry[4]: 0x0000000000000000 DMAR: pasid table entry[5]: 0x0000000000000000 DMAR: pasid table entry[6]: 0x0000000000000000 DMAR: pasid table entry[7]: 0x0000000000000000 DMAR: PTE not present at level 4 Cc: Fixes: 0bbeb01a4faf ("iommu/vt-d: Manage scalalble mode PASID tables") Reviewed-by: Kevin Tian Reported-by: Sukumar Ghorai Signed-off-by: Ashok Raj Signed-off-by: Jacob Pan Link: https://lore.kernel.org/r/20230209212843.1788125-1-jacob.jun.pan@linux.intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 16a75bbe480c3598b3af57a2504ea89b1e32c3ac Author: Jacob Pan Date: Thu Feb 16 21:08:14 2023 +0800 iommu/vt-d: Avoid superfluous IOTLB tracking in lazy mode Intel IOMMU driver implements IOTLB flush queue with domain selective or PASID selective invalidations. In this case there's no need to track IOVA page range and sync IOTLBs, which may cause significant performance hit. This patch adds a check to avoid IOVA gather page and IOTLB sync for the lazy path. The performance difference on Sapphire Rapids 100Gb NIC is improved by the following (as measured by iperf send): w/o this fix~48 Gbits/s. with this fix ~54 Gbits/s Cc: Fixes: 2a2b8eaa5b25 ("iommu: Handle freelists when using deferred flushing in iommu drivers") Reviewed-by: Robin Murphy Reviewed-by: Kevin Tian Tested-by: Sanjay Kumar Signed-off-by: Sanjay Kumar Signed-off-by: Jacob Pan Link: https://lore.kernel.org/r/20230209175330.1783556-1-jacob.jun.pan@linux.intel.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit 60b1daa3b168fbc648ae2ad28a84759223e49e18 Author: Lu Baolu Date: Thu Feb 16 21:08:13 2023 +0800 iommu/vt-d: Fix error handling in sva enable/disable paths Roll back all previous actions in error paths of intel_iommu_enable_sva() and intel_iommu_disable_sva(). Fixes: d5b9e4bfe0d8 ("iommu/vt-d: Report prq to io-pgfault framework") Reviewed-by: Kevin Tian Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20230208051559.700109-1-baolu.lu@linux.intel.com Signed-off-by: Joerg Roedel commit 1bdb78368f9448cf0de9b11eb1388e887d1b4849 Merge: 5661706efa200 76f5aaabce492 Author: Takashi Iwai Date: Thu Feb 16 14:32:04 2023 +0100 Merge tag 'asoc-v6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.3 There's been quite a lot of activity this release, but not really one big feature - lots of new devices, plus a lot of cleanup and modernisation work spread throughout the subsystem: - More factoring out of common operations into helper functions by Morimoto-san. - DT schema conversons and stylistic nits. - Continued work on building out the new SOF IPC4 scheme. - Support for Awinc AT88395, Infineon PEB2466, Iron Device SMA1303, Mediatek MT8188, Realtek RT712, Renesas IDT821034, Samsung/Tesla FSD SoC I2S, and TI TAS5720A-Q1. commit 5661706efa200252d0e9fea02421b0a5857808c3 Merge: 5791c7699ff1b 5beb5627a2481 Author: Takashi Iwai Date: Thu Feb 16 14:18:54 2023 +0100 Merge branch 'topic/apple-gmux' into for-next Pull vga_switcheroo fix for Macs Signed-off-by: Takashi Iwai commit 5beb5627a2481aade9aa630b7ebb7f99442321b6 Author: Orlando Chamberlain Date: Thu Feb 16 21:34:51 2023 +1100 ALSA: hda/hdmi: Register with vga_switcheroo on Dual GPU Macbooks Commit 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD") caused only AMD gpu's with PX to have their audio component register with vga_switcheroo. This meant that Apple Macbooks with apple-gmux as the gpu switcher no longer had the audio client registering, so when the gpu is powered off by vga_switcheroo snd_hda_intel is unaware that it should have suspended the device: amdgpu: switched off snd_hda_intel 0000:03:00.1: Unable to change power state from D3hot to D0, device inaccessible snd_hda_intel 0000:03:00.1: CORB reset timeout#2, CORBRP = 65535 To resolve this, we use apple_gmux_detect() and register a vga_switcheroo audio client when apple-gmux is detected. Fixes: 586bc4aab878 ("ALSA: hda/hdmi - fix vgaswitcheroo detection for AMD") Link: https://lore.kernel.org/all/20230210044826.9834-9-orlandoch.dev@gmail.com/ Signed-off-by: Orlando Chamberlain Link: https://lore.kernel.org/r/20230216103450.12925-1-orlandoch.dev@gmail.com Signed-off-by: Takashi Iwai commit e922bbf37564a4c67efca9dd6133eaadbffb65f5 Author: Aman Kumar Date: Fri Feb 3 17:47:02 2023 +0530 dmaengine: idma64: Update bytes_transferred field Currently when 8250 data transfer is done, bytes_tranferred always returns 0 at /sys/devices/pci0000\:\:**.*/dma/dma*chan*/bytes_transferred. In many cases it gives false impression that data is not being trasferred via DMA. So, updating the bytes_transferred field to count the bytes whenever there is data transfer using idma64. Co-developed-by: Srikanth Thokala Signed-off-by: Srikanth Thokala Signed-off-by: Aman Kumar Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230203121702.15725-1-aman.kumar@intel.com Signed-off-by: Vinod Koul commit 8d1b7bd543833169a5f5f74c4753509ab406f381 Author: Kai-Heng Feng Date: Tue Feb 7 12:57:45 2023 +0800 dmaengine: imx-sdma: Set DMA channel to be private If async-tx is loaded before device drivers that requires imx-sdma, the dmaengine_get() routine from async-tx grabs all non-private channels, so devices that require DMA fail to work. So mark imx-sdma with DMA_PRIVATE to avoid such situation. Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20230207045745.1029959-1-kai.heng.feng@canonical.com Signed-off-by: Vinod Koul commit 255ccd8b16a516209deb4257aa4e89e42a26413a Author: Andy Shevchenko Date: Mon Jan 30 17:17:47 2023 +0200 dmaengine: dw: Move check for paused channel to dwc_get_residue() Move check for paused channel to dwc_get_residue() and rename the latter to dwc_get_residue_and_status(). This improves data integrity as residue and DMA channel status are set in the same function under the same conditions. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230130151747.20704-1-andriy.shevchenko@linux.intel.com Signed-off-by: Vinod Koul commit 928469986171a6f763b34b039427f5667ba3fd50 Author: Eric Pilmore Date: Thu Feb 9 23:51:43 2023 -0800 dmaengine: ptdma: check for null desc before calling pt_cmd_callback Resolves a panic that can occur on AMD systems, typically during host shutdown, after the PTDMA driver had been exercised. The issue was the pt_issue_pending() function is mistakenly assuming that there will be at least one descriptor in the Submitted queue when the function is called. However, it is possible that both the Submitted and Issued queues could be empty, which could result in pt_cmd_callback() being mistakenly called with a NULL pointer. Ref: Bugzilla Bug 216856. Fixes: 6fa7e0e836e2 ("dmaengine: ptdma: fix concurrency issue with multiple dma transfer") Signed-off-by: Eric Pilmore Link: https://lore.kernel.org/r/20230210075142.58253-1-epilmore@gigaio.com Signed-off-by: Vinod Koul commit be4d46edeee4b2459d2f53f37ada88bbfb634b6c Author: Kees Cook Date: Fri Jan 27 14:36:27 2023 -0800 dmaengine: dw-axi-dmac: Do not dereference NULL structure If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave "bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds: ../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status': ../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct virt_dma_desc[46116860184273879]' [-Warray-bounds=] 329 | bytes = vd_to_axi_desc(vdesc)->length; | ^~ Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity") Cc: Eugeniy Paltsev Cc: Vinod Koul Cc: dmaengine@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230127223623.never.507-kees@kernel.org Signed-off-by: Vinod Koul commit 601bdadadb505a72d9a76cc20cdfa252cba7ddc0 Author: Fenghua Yu Date: Fri Jan 27 11:28:55 2023 -0800 dmaengine: idxd: Fix default allowed read buffers value in group Currently default read buffers that is allowed in a group is 0. grpcfg will be configured to max read buffers that IDXD can support if the group's allowed read buffers value is 0. But 0 is an invalid read buffers value and user may get confused when seeing the invalid initial value 0 through sysfs interface. To show only valid allowed read buffers value and eliminate confusion, directly initialize the allowed read buffers to IDXD's max read buffers. User still can change the value through sysfs interface. Suggested-by: Ramesh Thomas Signed-off-by: Fenghua Yu Reviewed-by: Nikhil Rao Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20230127192855.966929-1-fenghua.yu@intel.com Signed-off-by: Vinod Koul commit b02e07015a5ac7bbc029da931ae17914b8ae0339 Author: Shravan Chippa Date: Fri Jan 20 15:36:23 2023 +0530 dmaengine: sf-pdma: pdma_desc memory leak fix Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally allocate a new sf_pdma_desc each time it is called. The driver previously recycled descs, by checking the in_use flag, only allocating additional descs if the existing one was in use. This logic was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel"), but sf_pdma_free_desc() was not changed to handle the new behaviour. As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous descriptor is leaked, over time leading to memory starvation: unreferenced object 0xffffffe008447300 (size 192): comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s) hex dump (first 32 bytes): 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................ 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p............. backtrace: [<00000000064a04f4>] kmemleak_alloc+0x1e/0x28 [<00000000018927a7>] kmem_cache_alloc+0x11e/0x178 [<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112 Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant in_use flag. Fixes: b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") Signed-off-by: Shravan Chippa Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230120100623.3530634-1-shravan.chippa@microchip.com Signed-off-by: Vinod Koul commit 4932b1fa61322b737dc3615a298aafdc42f97f79 Author: Geert Uytterhoeven Date: Wed Feb 15 15:17:41 2023 +0100 ASoC: rsnd: adg: Fix BRG typos "BRG" stands for "Baud Rate Generator", but is frequently misspelled as "RBG". Signed-off-by: Geert Uytterhoeven Acked-by: Kuninori Morimoto Link: https://lore.kernel.org/r/ac6365c17861d71fbc89d823089db4aafdb763ed.1676470202.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 3584f6392f09440769246d4936e1fcbff76ac3bc Author: Neil Armstrong Date: Wed Feb 8 21:01:58 2023 +0200 phy: qcom: phy-qcom-snps-eusb2: Add support for eUSB2 repeater For USB 2.0 compliance, eUSB2 needs a repeater. The PHY needs to initialize and reset it. So add repeater support Co-developed-by: Abel Vesa Signed-off-by: Abel Vesa Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20230208190200.2966723-6-abel.vesa@linaro.org Signed-off-by: Vinod Koul commit 56d77c9a10d97d15b8da900f861bc28b06b84b1c Author: Abel Vesa Date: Wed Feb 8 21:01:57 2023 +0200 phy: qcom: Add QCOM SNPS eUSB2 repeater driver PM8550B contains a eUSB2 repeater used for making the eUSB2 from SM8550 USB 2.0 compliant. This can be modelled SW-wise as a Phy. So add a new phy driver for it. Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20230208190200.2966723-5-abel.vesa@linaro.org Signed-off-by: Vinod Koul commit 1288b5fef159e7ac57fcc0d82d69a107d3f722f7 Author: Abel Vesa Date: Wed Feb 8 21:01:56 2023 +0200 dt-bindings: phy: qcom,snps-eusb2-phy: Add phys property for the repeater The phys property is used for allowing the eusb2 to interface with the repeater, which is modelled as a phy driver. Signed-off-by: Abel Vesa Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230208190200.2966723-4-abel.vesa@linaro.org Signed-off-by: Vinod Koul commit f990aae9d6e4388b9b12b447bf7bad0cdf36c853 Author: Abel Vesa Date: Wed Feb 8 21:01:54 2023 +0200 dt-bindings: phy: Add qcom,snps-eusb2-repeater schema file The SM8550 SoC uses Synopsis eUSB2 repeater found in PM8550b. Add a dt-binding schema for the new driver. Signed-off-by: Abel Vesa Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230208190200.2966723-2-abel.vesa@linaro.org Signed-off-by: Vinod Koul commit 7d3fd88d61a41016da01889f076fd1c60c7298fc Author: Josh Triplett Date: Tue Feb 14 16:42:22 2023 -0800 io_uring: Support calling io_uring_register with a registered ring fd Add a new flag IORING_REGISTER_USE_REGISTERED_RING (set via the high bit of the opcode) to treat the fd as a registered index rather than a file descriptor. This makes it possible for a library to open an io_uring, register the ring fd, close the ring fd, and subsequently use the ring entirely via registered index. Signed-off-by: Josh Triplett Link: https://lore.kernel.org/r/f2396369e638284586b069dbddffb8c992afba95.1676419314.git.josh@joshtriplett.org [axboe: remove extra high bit clear] Signed-off-by: Jens Axboe commit a9b444988026528788c83c995ebb44eda5a54d8c Author: Neil Armstrong Date: Tue Feb 7 16:03:53 2023 +0100 dt-bindings: phy: amlogic,g12a-usb3-pcie-phy: add missing optional phy-supply property Add missing optional phy-supply property used to power up PHY regulators. Fixes: 87a55485f2fc ("dt-bindings: phy: meson-g12a-usb3-pcie-phy: convert to yaml") Signed-off-by: Neil Armstrong Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230207-b4-amlogic-amlogic-g12a-usb3-pcie-phy-fix-v1-1-3e437b759549@linaro.org Signed-off-by: Vinod Koul commit f765c59c5a72546a2d74a92ae5d0eb0329d8e247 Author: Jiapeng Chong Date: Mon Feb 13 11:57:09 2023 +0800 phy: rockchip-typec: Fix unsigned comparison with less than zero The dp and ufp are defined as bool type, the return value type of function extcon_get_state should be int, so the type of dp and ufp are modified to int. ./drivers/phy/rockchip/phy-rockchip-typec.c:827:12-14: WARNING: Unsigned expression compared with zero: dp > 0. Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3962 Signed-off-by: Jiapeng Chong Link: https://lore.kernel.org/r/20230213035709.99027-1-jiapeng.chong@linux.alibaba.com Signed-off-by: Vinod Koul commit b5929325f06300d28696b9a030539a4009154788 Author: Martin Kaiser Date: Mon Feb 13 20:54:08 2023 +0100 staging: r8188eu: Revert "staging: r8188eu: simplify rtw_get_ff_hwaddr" This reverts commit fd48124e0982 ("staging: r8188eu: simplify rtw_get_ff_hwaddr"). The cleanup in this commit removes the qsel to addr mappings in rtw_get_ff_hwaddr. The underlying assumption is that rtw_write_port uses its addr parameter only for the high_queue check. This is obviously incorrect as rtw_write_port calls ffaddr2pipehdl(pdvobj, addr); where addr is mapped to a usb bulk endpoint. Unfortunately, testing did not show any problems. The Edimax V2 on which I tested has two bulk out endpoints. I guess that with the incorrect patch, addr could only be 0 (no high queue) or 6 (high queue), both of which were mapped to the first bulk out endpoint. Data transfers did still work... Fixes: fd48124e0982 ("staging: r8188eu: simplify rtw_get_ff_hwaddr") Signed-off-by: Martin Kaiser Link: https://lore.kernel.org/r/20230213195407.15085-1-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit c17ffe008463d3a07b633dd0e956f7c1a3a7c347 Author: Martin Kaiser Date: Sat Feb 11 18:02:23 2023 +0100 staging: r8188eu: replace hand coded loop with list_for_each_entry In function rtw_get_stainfo, we can use list_for_each_entry to iterate over the list of stations and make the code a bit simpler. Signed-off-by: Martin Kaiser Tested-by: Philipp Hortmann # Edimax N150 Link: https://lore.kernel.org/r/20230211170223.419205-1-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit da8b09464c59c7c09f7ca880b607b5d8d0cc90fe Author: Martin Kaiser Date: Sat Feb 11 17:50:45 2023 +0100 staging: r8188eu: merge _rtw_enqueue_cmd into its caller The _rtw_enqueue_cmd function is called only by rtw_enqueue_cmd. When _rtw_enqueue_cmd is called, the caller has already checked that the obj parameter is not NULL. _rtw_enqueue_cmd returns _SUCCESS in any case. We can merge the two functions and simplify the error handling. Signed-off-by: Martin Kaiser Tested-by: Philipp Hortmann # Edimax N150 Link: https://lore.kernel.org/r/20230211165045.414424-1-martin@kaiser.cx Signed-off-by: Greg Kroah-Hartman commit d78c8e32890ef7eca79ffd67c96022c7f9d8cce4 Author: Anders Roxell Date: Wed Aug 10 13:43:18 2022 +0200 powerpc/mm: Rearrange if-else block to avoid clang warning Clang warns: arch/powerpc/mm/book3s64/radix_tlb.c:1191:23: error: variable 'hstart' is uninitialized when used here __tlbiel_va_range(hstart, hend, pid, ^~~~~~ arch/powerpc/mm/book3s64/radix_tlb.c:1191:31: error: variable 'hend' is uninitialized when used here __tlbiel_va_range(hstart, hend, pid, ^~~~ Rework the 'if (IS_ENABLE(CONFIG_TRANSPARENT_HUGEPAGE))' so hstart/hend is always initialized to silence the warnings. That will also simplify the 'else' path. Clang is getting confused with these warnings, but the warnings is a false-positive. Suggested-by: Arnd Bergmann Suggested-by: Nathan Chancellor Reviewed-by: Christophe Leroy Reviewed-by: Nathan Chancellor Signed-off-by: Anders Roxell Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220810114318.3220630-1-anders.roxell@linaro.org commit a7caf3f181f160ae13ece0124e1c268d22263708 Author: Michael Ellerman Date: Thu Feb 16 22:29:15 2023 +1100 powerpc/nohash: Fix build with llvm-as When using the LLVM integrated assembler (llvm-as), the book3e build fails with: arch/powerpc/mm/nohash/tlb_low_64e.S:354:2: error: invalid instruction tlbilxva 0,%r15 ^ tlbilxva is an extended mnemonic for tlbilx, but llvm-as also doesn't support tlbilx, despite it being an e500mc instruction. Fix it by using the existing PPC_TLBILX_VA macro. The resulting binary is identical when building with binutils. Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230216112915.1681631-1-mpe@ellerman.id.au commit 91360b446a5cced537d61fc2394253e8c6b9ae7b Author: Michael Ellerman Date: Mon Feb 13 22:23:22 2023 +1100 powerpc/nohash: Fix build error with binutils >= 2.38 With bintils >= 2.38 the ppc64_book3e_allmodconfig build fails: {standard input}: Assembler messages: {standard input}:196: Error: unrecognized opcode: `lbarx' {standard input}:196: Error: unrecognized opcode: `stbcx.' make[5]: *** [scripts/Makefile.build:252: arch/powerpc/mm/nohash/e500_hugetlbpage.o] Error 1 That happens because the default CPU for that config is e5500, set via CONFIG_TARGET_CPU, and so the assembler is building for e5500, which doesn't support those instructions. Fix it by using machine directives to tell the assembler to assemble the relevant code for e6500, which does support lbarx/stbcx. That is safe because the code already has the CPU_FTR_SMT check, which ensures the lbarx sequence doesn't run on e5500, which doesn't support SMT. Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230213112322.998003-1-mpe@ellerman.id.au commit 6ec363fc6142226b9ab5a6528f65333d729d2b6b Author: Carlos Llamas Date: Wed Feb 15 18:38:50 2023 +0000 scripts/tags.sh: fix incompatibility with PCRE2 Starting with release 10.38 PCRE2 drops default support for using \K in lookaround patterns as described in [1]. Unfortunately, scripts/tags.sh relies on such functionality to collect all_compiled_soures() leading to the following error: $ make COMPILED_SOURCE=1 tags GEN tags grep: \K is not allowed in lookarounds (but see PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK) The usage of \K for this pattern was introduced in commit 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely") which speeds up the generation of tags significantly. In order to fix this issue without compromising the performance we can switch over to an equivalent sed expression. The same matching pattern is preserved here except \K is replaced with a backreference \1. [1] https://www.pcre.org/current/doc/html/pcre2syntax.html#SEC11 Cc: Greg Kroah-Hartman Cc: Cristian Ciocaltea Cc: Masahiro Yamada Cc: Jialu Xu Cc: Vipin Sharma Cc: stable@vger.kernel.org Fixes: 4f491bb6ea2a ("scripts/tags.sh: collect compiled source precisely") Signed-off-by: Carlos Llamas Link: https://lore.kernel.org/r/20230215183850.3353198-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 72206cc730b5c9208e9a99ace1c619f542035312 Author: Daniel Starke Date: Tue Feb 14 13:27:37 2023 +0100 tty: n_gsm: add keep alive support n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapters 5.4.6.3.4 and 5.1.8.1.3 describe the test command which can be used to test the mux connection between both sides. Currently, no algorithm is implemented to make use of this command. This requires that each multiplexed upper layer protocol supervises the underlying muxer connection to handle possible connection losses. Introduce ioctl commands and functions to optionally enable keep alive handling via the test command as described in chapter 5.4.6.3.4. A single incrementing octet "ka_num" is being used for unique identification of each single keep alive packet. Retries will use the same "ka_num" value as the original packet. Retry count and interval are taken from the general parameters N2 and T2. Add usage description and basic example for the new ioctl to the n_gsm documentation. Note that support for the test command is mandatory and already present in the muxer implementation since the very first version. Also note that the previous ioctl structure gsm_config cannot be extended due to missing checks against zero of the field "unused". Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20230214122737.1976-1-daniel.starke@siemens.com Signed-off-by: Greg Kroah-Hartman commit 3f92730eed57f8057e1e120a0a2e8ad04ba155d4 Author: Tom Rix Date: Sat Feb 11 07:45:50 2023 -0800 serial: imx: remove a redundant check cpp_check reports drivers/tty/serial/imx.c:1207:15: style: Condition 'r_bytes>0' is always true [knownConditionTrueFalse] if (r_bytes > 0) { r_byte is set to r_bytes = rx_ring->head - rx_ring->tail; The head - tail calculation is also done by the earlier check if (rx_ring->head <= sg_dma_len(sgl) && rx_ring->head > rx_ring->tail) { so r_bytes will always be > 0, so the second check is not needed. Signed-off-by: Tom Rix Reviewed-by: Iuliana Prodan Link: https://lore.kernel.org/r/20230211154550.2130670-1-trix@redhat.com Signed-off-by: Greg Kroah-Hartman commit 9f467f6375afd3c7667dbabcfff35c22961e1c0b Author: Qi Zheng Date: Wed Feb 8 12:00:37 2023 +0800 OPP: fix error checking in opp_migrate_dentry() Since commit ff9fb72bc077 ("debugfs: return error values, not NULL") changed return value of debugfs_rename() in error cases from %NULL to %ERR_PTR(-ERROR), we should also check error values instead of NULL. Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") Signed-off-by: Qi Zheng Link: https://lore.kernel.org/r/20230208040037.60305-1-zhengqi.arch@bytedance.com Signed-off-by: Greg Kroah-Hartman commit d3002468cb5d5da11e22145c9af32facd5c34352 Author: Qi Zheng Date: Wed Feb 8 11:56:34 2023 +0800 debugfs: update comment of debugfs_rename() Since commit ff9fb72bc077 ("debugfs: return error values, not NULL") changed return value of debugfs_rename() in error cases from %NULL to %ERR_PTR(-ERROR), the comment of debugfs_rename should also be updated so as not to mislead readers. Signed-off-by: Qi Zheng Link: https://lore.kernel.org/r/20230208035634.58095-1-zhengqi.arch@bytedance.com Signed-off-by: Greg Kroah-Hartman commit 007ed7900aae514986770f6e14069ebd99c4a4c6 Author: Randy Dunlap Date: Sun Feb 12 23:03:24 2023 -0800 i3c: fix device.h kernel-doc warnings Fix all kernel-doc warnings in : include/linux/i3c/device.h:27: warning: contents before sections include/linux/i3c/device.h:196: warning: Excess function parameter 'dev' description in 'dev_to_i3cdev' Fixes: fa838c8ce537 ("i3c: move dev_to_i3cdev() to use container_of_const()") Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Signed-off-by: Randy Dunlap Cc: Boris Brezillon Cc: Greg Kroah-Hartman Cc: Alexandre Belloni Cc: linux-i3c@lists.infradead.org Link: https://lore.kernel.org/r/20230213070324.1564-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 1470a108a60e8c0c4d19da10117c9b98f0078654 Author: Feng Tang Date: Tue Feb 14 15:58:23 2023 +0800 perf c2c: Add report option to show false sharing in adjacent cachelines Many platforms have feature of adjacent cachelines prefetch, when it is enabled, for data in RAM of 2 cachelines (2N and 2N+1) granularity, if one is fetched to cache, the other one could likely be fetched too, which sort of extends the cacheline size to double, thus the false sharing could happens in adjacent cachelines. 0Day has captured performance changed related with this [1], and some commercial software explicitly makes its hot global variables 128 bytes aligned (2 cache lines) to avoid this kind of extended false sharing. So add an option "--double-cl" for 'perf c2c report' to show false sharing in double cache line granularity, which acts just like the cacheline size is doubled. There is no change to c2c record. The hardware events of shared cacheline are still per cacheline, and this option just changes the granularity of how events are grouped and displayed. In the 'perf c2c report' output below (will-it-scale's 'pagefault2' case on old kernel): ---------------------------------------------------------------------- 26 31 2 0 0 0 0xffff888103ec6000 ---------------------------------------------------------------------- 35.48% 50.00% 0.00% 0.00% 0.00% 0x10 0 1 0xffffffff8133148b 1153 66 971 3748 74 [k] get_mem_cgroup_from_mm 6.45% 0.00% 0.00% 0.00% 0.00% 0x10 0 1 0xffffffff813396e4 570 0 1531 879 75 [k] mem_cgroup_charge 25.81% 50.00% 0.00% 0.00% 0.00% 0x54 0 1 0xffffffff81331472 949 70 593 3359 74 [k] get_mem_cgroup_from_mm 19.35% 0.00% 0.00% 0.00% 0.00% 0x54 0 1 0xffffffff81339686 1352 0 1073 1022 74 [k] mem_cgroup_charge 9.68% 0.00% 0.00% 0.00% 0.00% 0x54 0 1 0xffffffff813396d6 1401 0 863 768 74 [k] mem_cgroup_charge 3.23% 0.00% 0.00% 0.00% 0.00% 0x54 0 1 0xffffffff81333106 618 0 804 11 9 [k] uncharge_batch The offset 0x10 and 0x54 used to displayed in 2 groups, and now they are listed together to give users a hint of extended false sharing. [1]. https://lore.kernel.org/lkml/20201102091543.GM31092@shao2-debian/ Committer notes: Link: https://lore.kernel.org/r/Y+wvVNWqXb70l4uy@feng-clx Removed -a, leaving just as --double-cl, as this probably is not used so frequently and perhaps will be even auto-detected if we manage to record the MSR where this is configured. Reviewed-by: Andi Kleen Reviewed-by: Leo Yan Signed-off-by: Feng Tang Tested-by: Leo Yan Acked-by: Joe Mario Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Tim Chen Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20230214075823.246414-1-feng.tang@intel.com Signed-off-by: Arnaldo Carvalho de Melo commit 40967f77dfa9fa728b7f36a5d2eb432f39de185c Merge: f5b12be34249e 5198cb408fcfc Author: Paolo Abeni Date: Thu Feb 16 13:30:06 2023 +0100 Merge branch 'seg6-add-psp-flavor-support-for-srv6-end-behavior' Andrea Mayer says: ==================== seg6: add PSP flavor support for SRv6 End behavior Segment Routing for IPv6 (SRv6 in short) [1] is the instantiation of the Segment Routing (SR) [2] architecture on the IPv6 dataplane. In SRv6, the segment identifiers (SID) are IPv6 addresses and the segment list (SID List) is carried in the Segment Routing Header (SRH). A segment may be bound to a specific packet processing operation called "behavior". The RFC8986 [3] defines and standardizes the most common/relevant behaviors for network operators, e.g., End, End.X and End.T and so on. The RFC8986 also introduces the "flavors" framework aiming to modify or extend the capabilities of SRv6 End, End.X and End.T behaviors. Specifically, these behaviors support the following flavors (either individually or in combinations): - Penultimate Segment Pop (PSP); - Ultimate Segment Pop (USP); - Ultimate Segment Decapsulation (USD). Such flavors enable an End/End.X/End.T behavior to pop the SRH on the penultimate/ultimate SR endpoint node listed in the SID List or to perform a full decapsulation. Currently, the Linux kernel supports a large subset of behaviors described in RFC8986, including the End, End.X and End.T. However, PSP, USP and USD flavors have not yet been implemented. In this patchset, we extend the SRv6 subsystem to implement the PSP flavor in the SRv6 End behavior. To accomplish this task, we leverage the flavor framework previously introduced by another patchset required for supporting the efficient representation of the SID List through the NEXT-C-SID mechanism [4]. In details, the patchset is made of: - patch 1/3: seg6: factor out End lookup nexthop processing to a dedicated function - patch 2/3: seg6: add PSP flavor support for SRv6 End behavior - patch 3/3: selftests: seg6: add selftest for PSP flavor in SRv6 End behavior From the user space perspective, we do not need to change the iproute2 code to support the PSP flavor. However, we provide the man page for the PSP flavor in a separate patch. Comments, improvements and suggestions are always appreciated. [1] - RFC8754: https://datatracker.ietf.org/doc/html/rfc8754 [2] - RFC8402: https://datatracker.ietf.org/doc/html/rfc8402 [3] - RFC8986: https://datatracker.ietf.org/doc/html/rfc8986 [4] - https://datatracker.ietf.org/doc/html/draft-ietf-spring-srv6-srh-compression ==================== Link: https://lore.kernel.org/r/20230215134659.7613-1-andrea.mayer@uniroma2.it Signed-off-by: Paolo Abeni commit 5198cb408fcfc0b49c418314570423efe2217754 Author: Andrea Mayer Date: Wed Feb 15 14:46:59 2023 +0100 selftests: seg6: add selftest for PSP flavor in SRv6 End behavior This selftest is designed for testing the PSP flavor in SRv6 End behavior. It instantiates a virtual network composed of several nodes: hosts and SRv6 routers. Each node is realized using a network namespace that is properly interconnected to others through veth pairs. The test makes use of the SRv6 End behavior and of the PSP flavor needed for removing the SRH from the IPv6 header at the penultimate node. The correct execution of the behavior is verified through reachability tests carried out between hosts. Signed-off-by: Andrea Mayer Signed-off-by: Paolo Lungaroni Reviewed-by: David Ahern Signed-off-by: Paolo Abeni commit bdf3c0b9c10b44c9355dd68f359bad25489445b6 Author: Andrea Mayer Date: Wed Feb 15 14:46:58 2023 +0100 seg6: add PSP flavor support for SRv6 End behavior The "flavors" framework defined in RFC8986 [1] represents additional operations that can modify or extend a subset of existing behaviors such as SRv6 End, End.X and End.T. We report these flavors hereafter: - Penultimate Segment Pop (PSP); - Ultimate Segment Pop (USP); - Ultimate Segment Decapsulation (USD). Depending on how the Segment Routing Header (SRH) has to be handled, an SRv6 End* behavior can support these flavors either individually or in combinations. In this patch, we only consider the PSP flavor for the SRv6 End behavior. A PSP enabled SRv6 End behavior is used by the Source/Ingress SR node (i.e., the one applying the SRv6 Policy) when it needs to instruct the penultimate SR Endpoint node listed in the SID List (carried by the SRH) to remove the SRH from the IPv6 header. Specifically, a PSP enabled SRv6 End behavior processes the SRH by: i) decreasing the Segment Left (SL) from 1 to 0; ii) copying the Last Segment IDentifier (SID) into the IPv6 Destination Address (DA); iii) removing (i.e., popping) the outer SRH from the extension headers following the IPv6 header. It is important to note that PSP operation (steps i, ii, iii) takes place only at a penultimate SR Segment Endpoint node (i.e., when the SL=1) and does not happen at non-penultimate Endpoint nodes. Indeed, when a SID of PSP flavor is processed at a non-penultimate SR Segment Endpoint node, the PSP operation is not performed because it would not be possible to decrease the SL from 1 to 0. SL=2 SL=1 SL=0 | | | For example, given the SRv6 policy (SID List := < X, Y, Z >): - a PSP enabled SRv6 End behavior bound to SID "Y" will apply the PSP operation as Segment Left (SL) is 1, corresponding to the Penultimate Segment of the SID List; - a PSP enabled SRv6 End behavior bound to SID "X" will *NOT* apply the PSP operation as the Segment Left is 2. This behavior instance will apply the "standard" End packet processing, ignoring the configured PSP flavor at all. [1] - RFC8986: https://datatracker.ietf.org/doc/html/rfc8986 Signed-off-by: Andrea Mayer Reviewed-by: David Ahern Signed-off-by: Paolo Abeni commit 525c65ff5696f7ccd8335edde1d9964420707910 Author: Andrea Mayer Date: Wed Feb 15 14:46:57 2023 +0100 seg6: factor out End lookup nexthop processing to a dedicated function The End nexthop lookup/input operations are moved into a new helper function named input_action_end_finish(). This avoids duplicating the code needed to compute the nexthop in the different flavors of the End behavior. Signed-off-by: Andrea Mayer Reviewed-by: David Ahern Signed-off-by: Paolo Abeni commit f5b12be34249e8fd0f866927bc978f9e08fc9770 Author: Lukas Bulwahn Date: Wed Feb 15 11:46:31 2023 +0100 net: dsa: ocelot: fix selecting MFD_OCELOT Commit 3d7316ac81ac ("net: dsa: ocelot: add external ocelot switch control") adds config NET_DSA_MSCC_OCELOT_EXT, which selects the non-existing config MFD_OCELOT_CORE. Replace this select with the intended and existing MFD_OCELOT. Signed-off-by: Lukas Bulwahn Acked-by: Colin Foster Link: https://lore.kernel.org/r/20230215104631.31568-1-lukas.bulwahn@gmail.com Signed-off-by: Paolo Abeni commit e3eafcf0fabe67d0f854b238c0c247a4b0187e38 Author: Andy Shevchenko Date: Wed Feb 15 18:52:39 2023 +0200 usb: dwc3: xilinx: Remove unused of_gpio,h of_gpio.h provides a single function, which is not used in this driver. Remove unused header. Signed-off-by: Andy Shevchenko Reviewed-by: Michal Simek Link: https://lore.kernel.org/r/20230215165239.83806-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit fa15072b650a1a90f811239f86fcbe081691a058 Merge: e9ab2559e2c50 3b6096c9b30b9 Author: Paolo Abeni Date: Thu Feb 16 12:03:15 2023 +0100 Merge branch 'sfc-devlink-support-for-ef100' Alejandro Lucero says: ==================== sfc: devlink support for ef100 This patchset adds devlink port support for ef100 allowing setting VFs mac addresses through the VF representor devlink ports. Basic devlink infrastructure is first introduced, then support for info command. Next changes for enumerating MAE ports which will be used for devlink port creation when netdevs are registered. Adding support for devlink port_function_hw_addr_get requires changes in the ef100 driver for getting the mac address based on a client handle. This allows to obtain VFs mac addresses during netdev initialization as well what is included in patch 6. Such client handle is used in patches 7 and 8 for getting and setting devlink port addresses. ==================== Link: https://lore.kernel.org/r/20230215090828.11697-1-alejandro.lucero-palau@amd.com Signed-off-by: Paolo Abeni commit 3b6096c9b30b9d65d09f9f4ee5f473c8c28f45d0 Author: Alejandro Lucero Date: Wed Feb 15 09:08:28 2023 +0000 sfc: add support for devlink port_function_hw_addr_set in ef100 Using the builtin client handle id infrastructure, add support for setting the mac address linked to mports in ef100. This implies to execute an MCDI command for giving the address to the firmware for the specific devlink port. Signed-off-by: Alejandro Lucero Reviewed-by: Jiri Pirko Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit fa78b01718d2f1cc95ce052fad3aa49c46d024eb Author: Alejandro Lucero Date: Wed Feb 15 09:08:27 2023 +0000 sfc: add support for devlink port_function_hw_addr_get in ef100 Using the builtin client handle id infrastructure, add support for obtaining the mac address linked to mports in ef100. This implies to execute an MCDI command for getting the data from the firmware for each devlink port. Signed-off-by: Alejandro Lucero Reviewed-by: Jiri Pirko Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit 7e056e2360d9267a20509aa2cdb8905485499e95 Author: Alejandro Lucero Date: Wed Feb 15 09:08:26 2023 +0000 sfc: obtain device mac address based on firmware handle for ef100 Getting device mac address is currently based on a specific MCDI command only available for the PF. This patch changes the MCDI command to a generic one for PFs and VFs based on a client handle. This allows both PFs and VFs to ask for their mac address during initialization using the CLIENT_HANDLE_SELF. Moreover, the patch allows other client handles which will be used by the PF to ask for mac addresses linked to VFs. This is necessary for suporting the port_function_hw_addr_get devlink function in further patches. Signed-off-by: Alejandro Lucero Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit 25414b2a64ae7ea8742933bd7b1d056e069b15a7 Author: Alejandro Lucero Date: Wed Feb 15 09:08:25 2023 +0000 sfc: add devlink port support for ef100 Using the data when enumerating mports, create devlink ports just before netdevs are registered and remove those devlink ports after netdev has been unregistered. Signed-off-by: Alejandro Lucero Reviewed-by: Jiri Pirko Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit 5227adff37af35fdc3c6f029737708c2d0921618 Author: Alejandro Lucero Date: Wed Feb 15 09:08:24 2023 +0000 sfc: add mport lookup based on driver's mport data Obtaining mport id is based on asking the firmware about it. This is still needed for mport initialization itself, but once the mport data is now kept by the driver, further mport id request can be satisfied internally without firmware interaction. Previous function is just modified in name making clear the firmware interaction. The new function uses the old name and looks for the data in the mport data structure. Signed-off-by: Alejandro Lucero Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit a6a15aca4207b5f5ed44f594ddd0ddeb6a495654 Author: Alejandro Lucero Date: Wed Feb 15 09:08:23 2023 +0000 sfc: enumerate mports in ef100 MAE ports (mports) are the ports on the EF100 embedded switch such as networking PCIe functions, the physical port, and potentially others. Signed-off-by: Alejandro Lucero Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit 14743ddd2495c96caa18e382625c034e49a812e2 Author: Alejandro Lucero Date: Wed Feb 15 09:08:22 2023 +0000 sfc: add devlink info support for ef100 Add devlink info support for ef100. The information reported is obtained through the MCDI interface with the specific meaning defined in new documentation file. Signed-off-by: Alejandro Lucero Reviewed-by: Jiri Pirko Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit fa34a5140a8e8f4120e86a1ae622b5df58414c3a Author: Alejandro Lucero Date: Wed Feb 15 09:08:21 2023 +0000 sfc: add devlink support for ef100 Add devlink infrastructure support. Further patches add devlink info and devlink port support. Signed-off-by: Alejandro Lucero Reviewed-by: Jiri Pirko Acked-by: Martin Habets Signed-off-by: Paolo Abeni commit b94335f899542a0da5fafc38af8edcaf90195843 Author: Pietro Borrello Date: Sun Feb 12 00:01:44 2023 +0000 hid: bigben_probe(): validate report count bigben_probe() does not validate that the output report has the needed report values in the first field. A malicious device registering a report with one field and a single value causes an head OOB write in bigben_worker() when accessing report_field->value[1] to report_field->value[7]. Use hid_validate_values() which takes care of all the needed checks. Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it Signed-off-by: Benjamin Tissoires commit 996d120b4de2b0d6b592bd9fbbe6e244b81ab3cc Author: Vasant Hegde Date: Wed Feb 15 05:26:42 2023 +0000 iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always setup and it will hit NULL pointer derefence (see below sample log). Lets check whether domain is setup or not and log appropriate message. Sample log: ---------- amdgpu 0000:00:01.0: amdgpu: SE 1, SH per SE 1, CU per SH 8, active_cu_number 6 BUG: kernel NULL pointer dereference, address: 0000000000000058 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 2 PID: 56 Comm: irq/24-AMD-Vi Not tainted 6.2.0-rc2+ #89 Hardware name: xxx RIP: 0010:report_iommu_fault+0x11/0x90 [...] Call Trace: amd_iommu_int_thread+0x60c/0x760 ? __pfx_irq_thread_fn+0x10/0x10 irq_thread_fn+0x1f/0x60 irq_thread+0xea/0x1a0 ? preempt_count_add+0x6a/0xa0 ? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0xe9/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 Reported-by: Matt Fagnani Suggested-by: Joerg Roedel Signed-off-by: Vasant Hegde Link: https://bugzilla.kernel.org/show_bug.cgi?id=216865 Link: https://lore.kernel.org/lkml/15d0f9ff-2a56-b3e9-5b45-e6b23300ae3b@leemhuis.info/ Link: https://lore.kernel.org/r/20230215052642.6016-3-vasant.hegde@amd.com Cc: stable@vger.kernel.org [joro: Edit commit message] Signed-off-by: Joerg Roedel commit 7096deb7b5387e7899655213b7430ab043ddda4f Author: Andrew Donnellan Date: Thu Feb 16 18:09:03 2023 +1100 powerpc/pseries: Fix endianness issue when parsing PLPKS secvar flags When a user updates a variable through the PLPKS secvar interface, we take the first 8 bytes of the data written to the update attribute to pass through to the H_PKS_SIGNED_UPDATE hcall as flags. These bytes are always written in big-endian format. Currently, the flags bytes are memcpy()ed into a u64, which is then loaded into a register to pass as part of the hcall. This means that on LE systems, the bytes are in the wrong order. Use be64_to_cpup() instead, to ensure the flags bytes are byteswapped if necessary. Reported-by: Stefan Berger Fixes: ccadf154cb00 ("powerpc/pseries: Implement secvars for dynamic secure boot") Signed-off-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230216070903.355091-1-ajd@linux.ibm.com commit 18792e99ea2fea27c72eb1ecca1879e5e6be304d Author: Vasant Hegde Date: Tue Feb 7 09:17:52 2023 +0000 iommu/amd: Do not identity map v2 capable device when snp is enabled Flow: - Booted system with SNP enabled, memory encryption off and IOMMU DMA translation mode - AMD driver detects v2 capable device and amd_iommu_def_domain_type() returns identity mode - amd_iommu_domain_alloc() returns NULL an SNP is enabled - System will fail to register device On SNP enabled system, passthrough mode is not supported. IOMMU default domain is set to translation mode. We need to return zero from amd_iommu_def_domain_type() so that it allocates translation domain. Fixes: fb2accadaa94 ("iommu/amd: Introduce function to check and enable SNP") CC: Suravee Suthikulpanit Signed-off-by: Vasant Hegde Link: https://lore.kernel.org/r/20230207091752.7656-1-vasant.hegde@amd.com Signed-off-by: Joerg Roedel commit e9ab2559e2c501593c58a02a956a6005a2a749fb Merge: 10d13421a6ae4 2d2e75d2d4a22 Author: Paolo Abeni Date: Thu Feb 16 10:39:30 2023 +0100 Merge branch 'net-sched-transition-actions-to-pcpu-stats-and-rcu' Pedro Tammela says: ==================== net/sched: transition actions to pcpu stats and rcu Following the work done for act_pedit[0], transition the remaining tc actions to percpu stats and rcu, whenever possible. Percpu stats make updating the action stats very cheap, while combining it with rcu action parameters makes it possible to get rid of the per action lock in the datapath. For act_connmark and act_nat we run the following tests: - tc filter add dev ens2f0 ingress matchall action connmark - tc filter add dev ens2f0 ingress matchall action nat ingress any 10.10.10.10 Our setup consists of a 26 cores Intel CPU and a 25G NIC. We use TRex to shoot 10mpps TCP packets and take perf measurements. Both actions improved performance as expected since the datapath lock disappeared. For act_pedit we move the drop counter to percpu, when available. For act_gate we move the counters to percpu, when available. [0] https://lore.kernel.org/all/20230131145149.3776656-1-pctammela@mojatatu.com/ ==================== Link: https://lore.kernel.org/r/20230214211534.735718-1-pctammela@mojatatu.com Signed-off-by: Paolo Abeni commit 2d2e75d2d4a2245175d77899764b56e19c5769b4 Author: Pedro Tammela Date: Tue Feb 14 18:15:34 2023 -0300 net/sched: act_pedit: use percpu overlimit counter when available Since act_pedit now has access to percpu counters, use the tcf_action_inc_overlimit_qstats wrapper that will use the percpu counter whenever they are available. Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: Paolo Abeni commit 7afd073e5521bfc1045096802bc4dc640b63ed54 Author: Pedro Tammela Date: Tue Feb 14 18:15:33 2023 -0300 net/sched: act_gate: use percpu stats The tc action act_gate was using shared stats, move it to percpu stats. tdc results: 1..12 ok 1 5153 - Add gate action with priority and sched-entry ok 2 7189 - Add gate action with base-time ok 3 a721 - Add gate action with cycle-time ok 4 c029 - Add gate action with cycle-time-ext ok 5 3719 - Replace gate base-time action ok 6 d821 - Delete gate action with valid index ok 7 3128 - Delete gate action with invalid index ok 8 7837 - List gate actions ok 9 9273 - Flush gate actions ok 10 c829 - Add gate action with duplicate index ok 11 3043 - Add gate action with invalid index ok 12 2930 - Add gate action with cookie Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: Paolo Abeni commit 288864effe33885988d53faf7830b35cb9a84c7a Author: Pedro Tammela Date: Tue Feb 14 18:15:32 2023 -0300 net/sched: act_connmark: transition to percpu stats and rcu The tc action act_connmark was using shared stats and taking the per action lock in the datapath. Improve it by using percpu stats and rcu. perf before: - 13.55% tcf_connmark_act - 81.18% _raw_spin_lock 80.46% native_queued_spin_lock_slowpath perf after: - 2.85% tcf_connmark_act tdc results: 1..15 ok 1 2002 - Add valid connmark action with defaults ok 2 56a5 - Add valid connmark action with control pass ok 3 7c66 - Add valid connmark action with control drop ok 4 a913 - Add valid connmark action with control pipe ok 5 bdd8 - Add valid connmark action with control reclassify ok 6 b8be - Add valid connmark action with control continue ok 7 d8a6 - Add valid connmark action with control jump ok 8 aae8 - Add valid connmark action with zone argument ok 9 2f0b - Add valid connmark action with invalid zone argument ok 10 9305 - Add connmark action with unsupported argument ok 11 71ca - Add valid connmark action and replace it ok 12 5f8f - Add valid connmark action with cookie ok 13 c506 - Replace connmark with invalid goto chain control ok 14 6571 - Delete connmark action with valid index ok 15 3426 - Delete connmark action with invalid index Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: Paolo Abeni commit 7d12057b45fbc1e1315d327dca13e8d6b5019113 Author: Pedro Tammela Date: Tue Feb 14 18:15:31 2023 -0300 net/sched: act_nat: transition to percpu stats and rcu The tc action act_nat was using shared stats and taking the per action lock in the datapath. Improve it by using percpu stats and rcu. perf before: - 10.48% tcf_nat_act - 81.83% _raw_spin_lock 81.08% native_queued_spin_lock_slowpath perf after: - 0.48% tcf_nat_act tdc results: 1..27 ok 1 7565 - Add nat action on ingress with default control action ok 2 fd79 - Add nat action on ingress with pipe control action ok 3 eab9 - Add nat action on ingress with continue control action ok 4 c53a - Add nat action on ingress with reclassify control action ok 5 76c9 - Add nat action on ingress with jump control action ok 6 24c6 - Add nat action on ingress with drop control action ok 7 2120 - Add nat action on ingress with maximum index value ok 8 3e9d - Add nat action on ingress with invalid index value ok 9 f6c9 - Add nat action on ingress with invalid IP address ok 10 be25 - Add nat action on ingress with invalid argument ok 11 a7bd - Add nat action on ingress with DEFAULT IP address ok 12 ee1e - Add nat action on ingress with ANY IP address ok 13 1de8 - Add nat action on ingress with ALL IP address ok 14 8dba - Add nat action on egress with default control action ok 15 19a7 - Add nat action on egress with pipe control action ok 16 f1d9 - Add nat action on egress with continue control action ok 17 6d4a - Add nat action on egress with reclassify control action ok 18 b313 - Add nat action on egress with jump control action ok 19 d9fc - Add nat action on egress with drop control action ok 20 a895 - Add nat action on egress with DEFAULT IP address ok 21 2572 - Add nat action on egress with ANY IP address ok 22 37f3 - Add nat action on egress with ALL IP address ok 23 6054 - Add nat action on egress with cookie ok 24 79d6 - Add nat action on ingress with cookie ok 25 4b12 - Replace nat action with invalid goto chain control ok 26 b811 - Delete nat action with valid index ok 27 a521 - Delete nat action with invalid index Reviewed-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Signed-off-by: Paolo Abeni commit 4daa861174d56023c2068ddb03de0752f07fa199 Author: Jason Gunthorpe Date: Wed Feb 15 21:21:16 2023 -0400 iommu: Fix error unwind in iommu_group_alloc() If either iommu_group_grate_file() fails then the iommu_group is leaked. Destroy it on these error paths. Found by kselftest/iommu/iommufd_fail_nth Fixes: bc7d12b91bd3 ("iommu: Implement reserved_regions iommu-group sysfs file") Fixes: c52c72d3dee8 ("iommu: Add sysfs attribyte for domain type") Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Link: https://lore.kernel.org/r/0-v1-8f616bee028d+8b-iommu_group_alloc_leak_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 4762315d1c971312d55848fdc85eee7f0b09c8f2 Author: Randy Dunlap Date: Wed Feb 8 17:03:59 2023 -0800 iommu/of: mark an unused function as __maybe_unused When CONFIG_OF_ADDRESS is not set, there is a build warning/error about an unused function. Annotate the function to quieten the warning/error. ../drivers/iommu/of_iommu.c:176:29: warning: 'iommu_resv_region_get_type' defined but not used [-Wunused-function] 176 | static enum iommu_resv_type iommu_resv_region_get_type(struct device *dev, struct resource *phys, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: a5bf3cfce8cb ("iommu: Implement of_iommu_get_resv_regions()") Signed-off-by: Randy Dunlap Cc: Thierry Reding Cc: Joerg Roedel Cc: Will Deacon Cc: iommu@lists.linux.dev Reviewed-by: Thierry Reding Link: https://lore.kernel.org/r/20230209010359.23831-1-rdunlap@infradead.org [joro: Improve code formatting] Signed-off-by: Joerg Roedel commit 8573df341545b7b66cfacf9526b1f7a0de917b9e Merge: 48075a66fca61 467fbc77f673e Author: Daniel Vetter Date: Thu Feb 16 10:12:34 2023 +0100 Merge tag 'drm-misc-next-fixes-2023-02-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Short summary of fixes pull: Contains a number of fixes to vc4 and ivpu. The patches to the probe helpers were cherry-picked from the regular development branch. Signed-off-by: Daniel Vetter From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/Y+S6HBmaRJNPYiBG@linux-uq9g commit 10d13421a6ae414ab91d4f2103fc90d1f4216736 Merge: a1d83abc8f2f9 3ba0bf47edf95 Author: Paolo Abeni Date: Thu Feb 16 10:11:29 2023 +0100 Merge branch 'net-core-commmon-prints-for-promisc' Jesse Brandeburg says: ==================== net/core: commmon prints for promisc Add a print to the kernel log for allmulticast entry and exit, and standardize the print for entry and exit of promiscuous mode. These prints are useful to both user and developer and should have the triggering driver/bus/device info that netdev_info (optionally) gives. ==================== Link: https://lore.kernel.org/r/20230214210117.23123-1-jesse.brandeburg@intel.com Signed-off-by: Paolo Abeni commit 3ba0bf47edf955d6f52fdb16b54acd1932cb9445 Author: Jesse Brandeburg Date: Tue Feb 14 13:01:17 2023 -0800 net/core: refactor promiscuous mode message The kernel stack can be more consistent by printing the IFF_PROMISC aka promiscuous enable/disable messages with the standard netdev_info message which can include bus and driver info as well as the device. typical command usage from user space looks like: ip link set eth0 promisc But lots of utilities such as bridge, tcpdump, etc put the interface into promiscuous mode. old message: [ 406.034418] device eth0 entered promiscuous mode [ 408.424703] device eth0 left promiscuous mode new message: [ 406.034431] ice 0000:17:00.0 eth0: entered promiscuous mode [ 408.424715] ice 0000:17:00.0 eth0: left promiscuous mode Signed-off-by: Jesse Brandeburg Signed-off-by: Paolo Abeni commit 802dcbd6f30feaa7c96a1fb4ecb1db57082df9d7 Author: Jesse Brandeburg Date: Tue Feb 14 13:01:16 2023 -0800 net/core: print message for allmulticast When the user sets or clears the IFF_ALLMULTI flag in the netdev, there are no log messages printed to the kernel log to indicate anything happened. This is inexplicably different from most other dev->flags changes, and could suprise the user. Typically this occurs from user-space when a user: ip link set eth0 allmulticast However, other devices like bridge set allmulticast as well, and many other flows might trigger entry into allmulticast as well. The new message uses the standard netdev_info print and looks like: [ 413.246110] ixgbe 0000:17:00.0 eth0: entered allmulticast mode [ 415.977184] ixgbe 0000:17:00.0 eth0: left allmulticast mode Signed-off-by: Jesse Brandeburg Signed-off-by: Paolo Abeni commit 1a30a6b25f263686dbf2028d56041ac012b10dcb Author: Kees Cook Date: Wed Feb 15 14:41:14 2023 -0800 wifi: brcmfmac: p2p: Introduce generic flexible array frame member Silence run-time memcpy() false positive warning when processing management frames: memcpy: detected field-spanning write (size 27) of single field "&mgmt_frame->u" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1469 (size 26) Due to this (soon to be fixed) GCC bug[1], FORTIFY_SOURCE (via __builtin_dynamic_object_size) doesn't recognize that the union may end with a flexible array, and returns "26" (the fixed size of the union), rather than the remaining size of the allocation. Add an explicit flexible array member and set it as the destination here, so that we get the correct coverage for the memcpy(). [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101832 Reported-by: Ard Biesheuvel Cc: Arend van Spriel Cc: Franky Lin Cc: Hante Meuleman Cc: Kalle Valo Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Johannes Berg Cc: "Jason A. Donenfeld" Cc: Greg Kroah-Hartman Cc: "Darrick J. Wong" Cc: Colin Ian King Cc: Brian Henriquez Cc: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com Cc: SHA-cyfmac-dev-list@infineon.com Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230215224110.never.022-kees@kernel.org [rename 'frame' to 'body'] Signed-off-by: Johannes Berg commit a1d83abc8f2f9d2193017665e6804c8baf65d469 Merge: 8fdf6659974d6 265b4da82dbf5 Author: Paolo Abeni Date: Thu Feb 16 09:27:09 2023 +0100 Merge branch 'net-sched-retire-some-tc-qdiscs-and-classifiers' Jamal Hadi Salim says: ==================== net/sched: Retire some tc qdiscs and classifiers The CBQ + dsmark qdiscs and the tcindex + rsvp classifiers have served us for over 2 decades. Unfortunately, they have not been getting much attention due to reduced usage. While we dont have a good metric for tabulating how much use a specific kernel feature gets, for these specific features we observed that some of the functionality has been broken for some time and no users complained. In addition, syzkaller has been going to town on most of these and finding issues; and while we have been fixing those issues, at times it becomes obvious that we would need to perform bigger surgeries to resolve things found while getting a syzkaller fix in place. After some discussion we feel that in order to reduce the maintenance burden it is best to retire them. This patchset leaves the UAPI alone. I could send another version which deletes the UAPI as well. AFAIK, this has not been done before - so it wasnt clear what how to handle UAPI. It seems legit to just delete it but we would need to coordinate with iproute2 (given they sync up with kernel uapi headers). There are probably other users we don't know of that copy kernel headers. If folks feel differently I will resend the patches deleting UAPI for these qdiscs and classifiers. I will start another thread on iproute2 before sending any patches to iproute2. ==================== Link: https://lore.kernel.org/r/20230214134915.199004-1-jhs@mojatatu.com Signed-off-by: Paolo Abeni commit 265b4da82dbf5df04bee5a5d46b7474b1aaf326a Author: Jamal Hadi Salim Date: Tue Feb 14 08:49:15 2023 -0500 net/sched: Retire rsvp classifier The rsvp classifier has served us well for about a quarter of a century but has has not been getting much maintenance attention due to lack of known users. Signed-off-by: Jamal Hadi Salim Acked-by: Jiri Pirko Signed-off-by: Paolo Abeni commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28 Author: Jamal Hadi Salim Date: Tue Feb 14 08:49:14 2023 -0500 net/sched: Retire tcindex classifier The tcindex classifier has served us well for about a quarter of a century but has not been getting much TLC due to lack of known users. Most recently it has become easy prey to syzkaller. For this reason, we are retiring it. Signed-off-by: Jamal Hadi Salim Acked-by: Jiri Pirko Signed-off-by: Paolo Abeni commit bbe77c14ee6185a61ba6d5e435c1cbb489d2a9ed Author: Jamal Hadi Salim Date: Tue Feb 14 08:49:13 2023 -0500 net/sched: Retire dsmark qdisc The dsmark qdisc has served us well over the years for diffserv but has not been getting much attention due to other more popular approaches to do diffserv services. Most recently it has become a shooting target for syzkaller. For this reason, we are retiring it. Signed-off-by: Jamal Hadi Salim Acked-by: Jiri Pirko Signed-off-by: Paolo Abeni commit fb38306ceb9e770adfb5ffa6e3c64047b55f7a07 Author: Jamal Hadi Salim Date: Tue Feb 14 08:49:12 2023 -0500 net/sched: Retire ATM qdisc The ATM qdisc has served us well over the years but has not been getting much TLC due to lack of known users. Most recently it has become a shooting target for syzkaller. For this reason, we are retiring it. Signed-off-by: Jamal Hadi Salim Acked-by: Jiri Pirko Signed-off-by: Paolo Abeni commit 051d442098421c28c7951625652f61b1e15c4bd5 Author: Jamal Hadi Salim Date: Tue Feb 14 08:49:11 2023 -0500 net/sched: Retire CBQ qdisc While this amazing qdisc has served us well over the years it has not been getting any tender love and care and has bitrotted over time. It has become mostly a shooting target for syzkaller lately. For this reason, we are retiring it. Goodbye CBQ - we loved you. Signed-off-by: Jamal Hadi Salim Acked-by: Jiri Pirko Signed-off-by: Paolo Abeni commit 5c3d1d0abb12a6915d0f43233837053945621a89 Author: Masahiro Yamada Date: Wed Feb 15 10:20:23 2023 +0900 kbuild: add a tool to list files ignored by git In short, the motivation of this commit is to build a source package without cleaning the source tree. The deb-pkg and (src)rpm-pkg targets first run 'make clean' before creating a source tarball. Otherwise build artifacts such as *.o, *.a, etc. would be included in the tarball. Yet, the tarball ends up containing several garbage files since 'make clean' does not clean everything. Cleaning the tree every time is annoying since it makes the incremental build impossible. It is desirable to create a source tarball without cleaning the tree. In fact, there are some ways to achieve this. The easiest solution is 'git archive'. 'make perf-tar*-src-pkg' uses it, but I do not like it because it works only when the source tree is managed by git, and all files you want in the tarball must be committed in advance. I want to make it work without relying on git. We can do this. Files that are ignored by git are generated files, so should be excluded from the source tarball. We can list them out by parsing the .gitignore files. Of course, .gitignore does not cover all the cases, but it works well enough. tar(1) claims to support it: --exclude-vcs-ignores Exclude files that match patterns read from VCS-specific ignore files. Supported files are: .cvsignore, .gitignore, .bzrignore, and .hgignore. The best scenario would be to use 'tar --exclude-vcs-ignores', but this option does not work. --exclude-vcs-ignore does not understand any of the negation (!), preceding slash, following slash, etc.. So, this option is just useless. Hence, I wrote this gitignore parser. The previous version [1], written in Python, was so slow. This version is implemented in C, so it works much faster. I imported the code from git (commit: 23c56f7bd5f1), so we get the same result. This tool traverses the source tree, parsing all .gitignore files, and prints file paths that are ignored by git. The output is similar to 'git ls-files --ignored --directory --others --exclude-per-directory=.gitignore', except [1] Not sorted [2] No trailing slash for directories [2] is intentional because tar's --exclude-from option cannot handle trailing slashes. [How to test this tool] $ git clean -dfx $ make -s -j$(nproc) defconfig all # or allmodconifg or whatever $ git archive -o ../linux1.tar --prefix=./ HEAD $ tar tf ../linux1.tar | LANG=C sort > ../file-list1 # files emitted by 'git archive' $ make scripts_package HOSTCC scripts/list-gitignored $ scripts/list-gitignored --prefix=./ -o ../exclude-list $ tar cf ../linux2.tar --exclude-from=../exclude-list . $ tar tf ../linux2.tar | LANG=C sort > ../file-list2 # files emitted by 'tar' $ diff ../file-list1 ../file-list2 | grep -E '^(<|>)' < ./Documentation/devicetree/bindings/.yamllint < ./drivers/clk/.kunitconfig < ./drivers/gpu/drm/tests/.kunitconfig < ./drivers/hid/.kunitconfig < ./fs/ext4/.kunitconfig < ./fs/fat/.kunitconfig < ./kernel/kcsan/.kunitconfig < ./lib/kunit/.kunitconfig < ./mm/kfence/.kunitconfig < ./tools/testing/selftests/arm64/tags/ < ./tools/testing/selftests/arm64/tags/.gitignore < ./tools/testing/selftests/arm64/tags/Makefile < ./tools/testing/selftests/arm64/tags/run_tags_test.sh < ./tools/testing/selftests/arm64/tags/tags_test.c < ./tools/testing/selftests/kvm/.gitignore < ./tools/testing/selftests/kvm/Makefile < ./tools/testing/selftests/kvm/config < ./tools/testing/selftests/kvm/settings The source tarball contains most of files that are tracked by git. You see some diffs, but it is just because some .gitignore files are wrong. $ git ls-files -i -c --exclude-per-directory=.gitignore Documentation/devicetree/bindings/.yamllint drivers/clk/.kunitconfig drivers/gpu/drm/tests/.kunitconfig drivers/hid/.kunitconfig fs/ext4/.kunitconfig fs/fat/.kunitconfig kernel/kcsan/.kunitconfig lib/kunit/.kunitconfig mm/kfence/.kunitconfig tools/testing/selftests/arm64/tags/.gitignore tools/testing/selftests/arm64/tags/Makefile tools/testing/selftests/arm64/tags/run_tags_test.sh tools/testing/selftests/arm64/tags/tags_test.c tools/testing/selftests/kvm/.gitignore tools/testing/selftests/kvm/Makefile tools/testing/selftests/kvm/config tools/testing/selftests/kvm/settings [1]: https://lore.kernel.org/all/20230128173843.765212-1-masahiroy@kernel.org/ Signed-off-by: Masahiro Yamada commit 8fdf6659974d697ef09acd216ffff34706a1b83a Merge: 72bc7f163179c ebf44ded76e92 Author: Paolo Abeni Date: Thu Feb 16 08:59:51 2023 +0100 Merge branch 'adding-sparx5-es0-vcap-support' Steen Hegelund says: ==================== Adding Sparx5 ES0 VCAP support This provides the Egress Stage 0 (ES0) VCAP (Versatile Content-Aware Processor) support for the Sparx5 platform. The ES0 VCAP is an Egress Access Control VCAP that uses frame keyfields and previously classified keyfields to add, rewrite or remove VLAN tags on the egress frames, and is therefore often referred to as the rewriter. The ES0 VCAP also supports trapping frames to the host. The ES0 VCAP has 1 lookup accessible with this chain id: - chain 10000000: ES0 Lookup 0 The ES0 VCAP does not do traffic classification to select a keyset, but it does have two keysets that can be used on all traffic. For now only the ISDX keyset is used. The ES0 VCAP can match on an ISDX key (Ingress Service Index) as one of the frame metadata keyfields, similar to the ES2 VCAP. The ES0 VCAP uses external counters in the XQS (statistics) group. ==================== Link: https://lore.kernel.org/r/20230214104049.1553059-1-steen.hegelund@microchip.com Signed-off-by: Paolo Abeni commit ebf44ded76e92e0812e0e4a2acd20c7f86550e2c Author: Steen Hegelund Date: Tue Feb 14 11:40:49 2023 +0100 net: microchip: sparx5: Add TC vlan action support for the ES0 VCAP This provides these 3 actions for rule in the ES0 VCAP: - action vlan pop - action vlan modify id X priority Y - action vlan push id X priority Y protocol Z Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit 52b28a93c45d2eb6177f073665ca5e4b2f6a229a Author: Steen Hegelund Date: Tue Feb 14 11:40:48 2023 +0100 net: microchip: sparx5: Add TC support for the ES0 VCAP This enables the TC command to use the Sparx5 ES0 VCAP, and handling of rule links between IS0 and ES0. Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit 3cbe7537a7f1aaafc4eebc124dfcc8eaf67f1ec7 Author: Steen Hegelund Date: Tue Feb 14 11:40:47 2023 +0100 net: microchip: sparx5: Add ES0 VCAP keyset configuration for Sparx5 This adds the ES0 VCAP port keyset configuration for Sparx5. Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit f2a77dd69f51358ab6fb169f5582c329a2315e6c Author: Steen Hegelund Date: Tue Feb 14 11:40:46 2023 +0100 net: microchip: sparx5: Updated register interface with VCAP ES0 access This provides access to the ES0 VCAP register targets Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit a5cc98adf3cbb187a7b9063ccb2b1c7065a05401 Author: Steen Hegelund Date: Tue Feb 14 11:40:45 2023 +0100 net: microchip: sparx5: Add ES0 VCAP model and updated KUNIT VCAP model This provides the VCAP model for the Sparx5 ES0 (Egress Stage 0) VCAP. This VCAP provides rewriting functionality in the egress path. Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit b5b0c364598835739451e6cd8a9dd84d41089c02 Author: Steen Hegelund Date: Tue Feb 14 11:40:44 2023 +0100 net: microchip: sparx5: Improve the error handling for linked rules Ensure that an error is returned if the VCAP instance was not found. The chain offset (diff) is allowed to be zero as this just means that the user did not request rules to be linked. Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit 0518e914f34ae539a1a6f4a19ead3b1d5d9881f4 Author: Steen Hegelund Date: Tue Feb 14 11:40:43 2023 +0100 net: microchip: sparx5: Use chain ids without offsets when enabling rules This improves the check performed on linked rules when enabling or disabling them. The chain id used must be the chain id without the offset used for linking the rules. Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit 38f6408c6071f1233644cc1d23e34ec5b36700d7 Author: Steen Hegelund Date: Tue Feb 14 11:40:42 2023 +0100 net: microchip: sparx5: Egress VLAN TPID configuration follows IFH This changes the TPID of the egress frames to use the TPID stored in the IFH (internal frame header), which ensures that this is the TPID classified for the frame at ingress. Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit d7953da4f2935039430322a31b9da93f978fcc86 Author: Steen Hegelund Date: Tue Feb 14 11:40:41 2023 +0100 net: microchip: sparx5: Clear rule counter even if lookup is disabled The rule counter must be cleared when creating a new rule, even if the VCAP lookup is currently disabled. This ensures that rules located in VCAPs that use external counters (such as Sparx5 IS2 and ES0) will have their counter reset even if the VCAP lookup is not enabled at the moment. Signed-off-by: Steen Hegelund Fixes: 95fa74148daa ("net: microchip: sparx5: Reset VCAP counter for new rules") Signed-off-by: Paolo Abeni commit 65b6625069a42edf2a813dd1c50604c6c6236fe5 Author: Steen Hegelund Date: Tue Feb 14 11:40:40 2023 +0100 net: microchip: sparx5: Discard frames with SMAC multicast addresses A valid frame should never use a multicast address as its source MAC address, so discard these invalid frames. Signed-off-by: Steen Hegelund Signed-off-by: Paolo Abeni commit 72bc7f163179cb0b39e1a18dbf69e175267ce500 Merge: 1f26c8b7507c4 13b599f15e1cb Author: Jakub Kicinski Date: Wed Feb 15 21:52:33 2023 -0800 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-02-14 (ice) This series contains updates to ice driver only. Karol extends support for GPIO pins to E823 devices. Daniel Vacek stops processing of PTP packets when link is down. Pawel adds support for BIG TCP for IPv6. Tony changes return type of ice_vsi_realloc_stat_arrays() as it always returns success. Zhu Yanjun updates kdoc stating supported TLVs. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: Mention CEE DCBX in code comment ice: Change ice_vsi_realloc_stat_arrays() to void ice: add support BIG TCP on IPv6 ice/ptp: fix the PTP worker retrying indefinitely if the link went down ice: Add GPIO pin support for E823 products ==================== Link: https://lore.kernel.org/r/20230214213003.2117125-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1f26c8b7507c42f5fec95e757c435300e8af0d1a Author: Randy Dunlap Date: Tue Feb 14 21:37:38 2023 -0800 Documentation: core-api: packing: correct spelling Correct spelling problems for Documentation/core-api/packing.rst as reported by codespell. Signed-off-by: Randy Dunlap Cc: Vladimir Oltean Cc: Jonathan Corbet Reviewed-by: Mukesh Ojha Acked-by: Daniel Jordan Link: https://lore.kernel.org/r/20230215053738.11562-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit affb6a3fd8f44e4848f17989417415d158c1b8c4 Author: Andrew Halaney Date: Tue Feb 14 11:15:04 2023 -0600 dt-bindings: net: snps,dwmac: Fix snps,reset-delays-us dependency The schema had snps,reset-delay-us as dependent on snps,reset-gpio. The actual property is called snps,reset-delays-us, so fix this to catch any devicetree defining snsps,reset-delays-us without snps,reset-gpio. Fixes: 7db3545aef5f ("dt-bindings: net: stmmac: Convert the binding to a schemas") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andrew Halaney Link: https://lore.kernel.org/r/20230214171505.224602-1-ahalaney@redhat.com Signed-off-by: Jakub Kicinski commit f58531716ced8975a4ade108ef4af35f98722af7 Author: Davide Caratti Date: Tue Feb 14 10:52:37 2023 +0100 selftests: forwarding: tc_actions: cleanup temporary files when test is aborted remove temporary files created by 'mirred_egress_to_ingress_tcp' test in the cleanup() handler. Also, change variable names to avoid clashing with globals from lib.sh. Suggested-by: Paolo Abeni Signed-off-by: Davide Caratti Link: https://lore.kernel.org/r/091649045a017fc00095ecbb75884e5681f7025f.1676368027.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 1b8d1c5088efa5af881e8e78c80bd1197dc4c420 Author: Mengyuan Lou Date: Tue Feb 14 17:15:27 2023 +0800 net: wangxun: Add the basic ethtool interfaces Add the basic ethtool ops get_drvinfo and get_link for ngbe and txgbe. Ngbe implements get_link_ksettings, nway_reset and set_link_ksettings for free using phylib code. The code related to the physical interface is not yet fully implemented in txgbe using phylink code. So do not implement get_link_ksettings, nway_reset and set_link_ksettings in txgbe. Signed-off-by: Mengyuan Lou Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230214091527.69943-1-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 14ade6ba4120fb38fcb5033998882c5b3d591194 Author: Willem de Bruijn Date: Tue Feb 14 10:57:40 2023 -0500 net: msg_zerocopy: elide page accounting if RLIM_INFINITY MSG_ZEROCOPY ensures that pinned user pages do not exceed the limit. If no limit is set, skip this accounting as otherwise expensive atomic_long operations are called for no reason. This accounting is already skipped for privileged (CAP_IPC_LOCK) users. Rely on the same mechanism: if no mmp->user is set, mm_unaccount_pinned_pages does not decrement either. Tested by running tools/testing/selftests/net/msg_zerocopy.sh with an unprivileged user for the TXMODE binary: ip netns exec "${NS1}" sudo -u "{$USER}" "${BIN}" "-${IP}" ... Signed-off-by: Willem de Bruijn Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230214155740.3448763-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit c24a34f5a3d7dec595635ad54167a8c471e4e24f Author: Oleksij Rempel Date: Wed Feb 15 06:04:53 2023 +0100 net: phy: c45: genphy_c45_an_config_aneg(): fix uninitialized symbol error Fix warning: drivers/net/phy/phy-c45.c:712 genphy_c45_write_eee_adv() error: uninitialized symbol 'changed' Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202302150232.q6idsV8s-lkp@intel.com/ Fixes: 022c3f87f88e ("net: phy: add genphy_c45_ethtool_get/set_eee() support") Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230215050453.2251360-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 9753613f7399601f9bae6ee81e9d4274246c98ab Author: Dan Carpenter Date: Wed Feb 15 07:21:47 2023 +0300 net: phy: motorcomm: uninitialized variables in yt8531_link_change_notify() These booleans are never set to false, but are just used without being initialized. Fixes: 4ac94f728a58 ("net: phy: Add driver for Motorcomm yt8531 gigabit ethernet phy") Signed-off-by: Dan Carpenter Reviewed-by: Frank Sae Link: https://lore.kernel.org/r/Y+xd2yJet2ImHLoQ@kili Signed-off-by: Jakub Kicinski commit 8658db0a4a0f84f50fe6643fe8665efe1a4bdb66 Author: Heiko Stuebner Date: Fri Jan 13 22:19:55 2023 +0100 RISC-V: move some stray __RISCV_INSN_FUNCS definitions from kprobes The __RISCV_INSN_FUNCS originally declared riscv_insn_is_* functions inside the kprobes implementation. This got moved into a central header in commit ec5f90877516 ("RISC-V: Move riscv_insn_is_* macros into a common header"). Though it looks like I overlooked two of them, so fix that. FENCE itself is an instruction defined directly by its own opcode, while the created riscv_isn_is_system function covers all instructions defined under the SYSTEM opcode. Reviewed-by: Conor Dooley Reviewed-by: Andrew Jones Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20230113211955.3534431-1-heiko@sntech.de Signed-off-by: Palmer Dabbelt commit 80c6d6804f31451848a3956a70c2bcb1f07cfcb0 Author: Aurabindo Pillai Date: Wed Feb 15 12:51:20 2023 -0500 drm/amd/display: disable SubVP + DRR to prevent underflow [Why&How] Temporarily disable SubVP+DRR since Xorg has an architectural limitation where freesync will not work in a multi monitor configuration. SubVP+DRR requires that freesync be working. Whether OS has variable refresh setting enabled or not, the state on the crtc remains same unless an application requests VRR. Due to this, there is no way to know whether freesync will actually work or not while we are on the desktop from the kernel's perspective. If userspace does not have a limitation with multi-display freesync (for example wayland), then this feature can be enabled by adding a dcfeaturemask option to amdgpu on the kernel cmdline like: amdgpu.dcfeaturemask=0x200 Signed-off-by: Aurabindo Pillai Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit ac0bb08d2cb711dc0e332f91c4e67783fcbe3439 Author: Leo Li Date: Thu Feb 9 12:15:21 2023 -0500 drm/amd/display: Fail atomic_check early on normalize_zpos error [Why] drm_atomic_normalize_zpos() can return an error code when there's modeset lock contention. This was being ignored. [How] Bail out of atomic check if normalize_zpos() returns an error. Fixes: b261509952bc ("drm/amd/display: Fix double cursor on non-video RGB MPO") Signed-off-by: Leo Li Tested-by: Mikhail Gavrilov Reviewed-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit f989fa298c0f57070dca9816439aa2e72f1bec8d Author: Jonathan Gray Date: Tue Feb 14 17:52:12 2023 +1100 drm/amd/pm: avoid unaligned access warnings When building on OpenBSD/arm64 with clang 15, unaligned access warnings are seen when a union is embedded inside a packed struct. drm/amd/pm/powerplay/hwmgr/vega20_pptable.h:136:17: error: field smcPPTable within 'struct _ATOM_VEGA20_POWERPLAYTABLE' is less aligned than 'PPTable_t' and is usually due to 'struct _ATOM_VEGA20_POWERPLAYTABLE' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] PPTable_t smcPPTable; ^ Make PPTable_t packed to avoid this. Signed-off-by: Jonathan Gray Signed-off-by: Alex Deucher commit 6e60cba666831e148d24b0aed783e1eb5bf99ff4 Author: Jonathan Gray Date: Tue Feb 14 17:49:44 2023 +1100 drm/amd/display: avoid unaligned access warnings When building on OpenBSD/arm64 with clang 15, unaligned access warnings are seen when a union is embedded inside a packed struct. drm/amd/display/dmub/inc/dmub_cmd.h:941:18: error: field cursor_copy_src within 'struct dmub_rb_cmd_mall' is less aligned than 'union dmub_addr' and is usually due to 'struct dmub_rb_cmd_mall' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] union dmub_addr cursor_copy_src; /**< Cursor copy address */ ^ drm/amd/display/dmub/inc/dmub_cmd.h:942:18: error: field cursor_copy_dst within 'struct dmub_rb_cmd_mall' is less aligned than 'union dmub_addr' and is usually due to 'struct dmub_rb_cmd_mall' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] union dmub_addr cursor_copy_dst; /**< Cursor copy destination */ ^ Add pragma pack around dmub_addr to avoid this. Signed-off-by: Jonathan Gray Signed-off-by: Alex Deucher commit e26b51c79bac2bd808c5b6472087011f7c7259a9 Author: Deepak R Varma Date: Fri Feb 10 15:30:43 2023 +0530 drm/amd/display: Remove duplicate/repeating expressions Remove duplicate or repeating expressions in the if condition evaluation. Issue identified using doubletest.cocci Coccinelle semantic patch. Reviewed-by: Harry Wentland Signed-off-by: Deepak R Varma Signed-off-by: Alex Deucher commit 0f19f514dea1837caff0b40c3e966ecedc95fec8 Merge: 388a9c907a514 72ed5d5624af3 Author: Jakub Kicinski Date: Wed Feb 15 19:24:52 2023 -0800 Merge tag 'mlx5-updates-2023-02-10' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2023-02-10 1) From Roi and Mark: MultiPort eswitch support MultiPort E-Switch builds on newer hardware's capabilities and introduces a mode where a single E-Switch is used and all the vports and physical ports on the NIC are connected to it. The new mode will allow in the future a decrease in the memory used by the driver and advanced features that aren't possible today. This represents a big change in the current E-Switch implantation in mlx5. Currently, by default, each E-Switch manager manages its E-Switch. Steering rules in each E-Switch can only forward traffic to the native physical port associated with that E-Switch. While there are ways to target non-native physical ports, for example using a bond or via special TC rules. None of the ways allows a user to configure the driver to operate by default in such a mode nor can the driver decide to move to this mode by default as it's user configuration-driven right now. While MultiPort E-Switch single FDB mode is the preferred mode, older generations of ConnectX hardware couldn't support this mode so it was never implemented. Now that there is capable hardware present, start the transition to having this mode by default. Introduce a devlink parameter to control MultiPort Eswitch single FDB mode. This will allow users to select this mode on their system right now and in the future will allow the driver to move to this mode by default. 2) From Jiri: Improvements and fixes for mlx5 netdev's devlink logic 2.1) Cleanups related to mlx5's devlink port logic 2.2) Move devlink port registration to be done before netdev alloc 2.3) Create auxdev devlink instance in the same ns as parent devlink 2.4) Suspend auxiliary devices only in case of PCI device suspend * tag 'mlx5-updates-2023-02-10' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Suspend auxiliary devices only in case of PCI device suspend net/mlx5: Remove "recovery" arg from mlx5_load_one() function net/mlx5e: Create auxdev devlink instance in the same ns as parent devlink net/mlx5e: Move devlink port registration to be done before netdev alloc net/mlx5e: Move dl_port to struct mlx5e_dev net/mlx5e: Replace usage of mlx5e_devlink_get_dl_port() by netdev->devlink_port net/mlx5e: Pass mdev to mlx5e_devlink_port_register() net/mlx5: Remove outdated comment net/mlx5e: TC, Remove redundant parse_attr argument net/mlx5e: Use a simpler comparison for uplink rep net/mlx5: Lag, Add single RDMA device in multiport mode net/mlx5: Lag, set different uplink vport metadata in multiport eswitch mode net/mlx5: E-Switch, rename bond update function to be reused net/mlx5e: TC, Add peer flow in mpesw mode net/mlx5: Lag, Control MultiPort E-Switch single FDB mode ==================== Link: https://lore.kernel.org/r/20230214221239.159033-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 578292aaecfea58cdae0f0b2275cfffc4d47f048 Author: Deepak R Varma Date: Fri Feb 10 15:41:51 2023 +0530 drm/amd/display: Remove duplicate/repeating expression Remove duplicate or repeating expressions in the if condition evaluation. Issue identified using doubletest.cocci Coccinelle semantic patch. Reviewed-by: Harry Wentland Signed-off-by: Deepak R Varma Signed-off-by: Alex Deucher commit 60b07cf5d3462ec0183d463b43619e98bc63c951 Author: Arthur Grillo Date: Mon Feb 13 17:49:22 2023 -0300 drm/amd/display: Make variables declaration inside ifdef guard Make variables declaration inside ifdef guard, as they are only used inside the same ifdef guard. This remove some of the -Wunused-but-set-variable warning. Signed-off-by: Arthur Grillo Signed-off-by: Alex Deucher commit 01543dcf99bdaba32178c7b40998778682f0305d Author: Arthur Grillo Date: Mon Feb 13 17:49:18 2023 -0300 drm/amd/display: Fix excess arguments on kernel-doc Remove arguments present on kernel-doc that are not present on the function declaration and add the new ones if present. Signed-off-by: Arthur Grillo Signed-off-by: Alex Deucher commit 8dc2507f4b24dc322da32dedab65d3d36979a79d Author: Arthur Grillo Date: Mon Feb 13 17:49:17 2023 -0300 drm/amd/display: Add previously missing includes Add includes that were previously missing to reduce the number of -Wmissing-prototypes warnings. Signed-off-by: Arthur Grillo Signed-off-by: Alex Deucher commit 877b57c6b550e44c348b2225ac61e550a64a9942 Author: Arthur Grillo Date: Mon Feb 13 17:49:16 2023 -0300 drm/amd/amdgpu: Add function prototypes to headers Add function prototypes to headers to reduce the number of -Wmissing-prototypes warnings. Signed-off-by: Arthur Grillo Signed-off-by: Alex Deucher commit 6884b0e4077676f21ebd310ac983d819ea109f89 Author: Arthur Grillo Date: Mon Feb 13 17:49:15 2023 -0300 drm/amd/display: Add function prototypes to headers Add function prototypes to headers to reduce the number of -Wmissing-prototypes warnings. Signed-off-by: Arthur Grillo Signed-off-by: Alex Deucher commit 1706d9a412e90959ba0b593ad3b9113a7c9c9b6c Author: Arthur Grillo Date: Mon Feb 13 17:49:14 2023 -0300 drm/amd/display: Turn global functions into static Turn global functions that are only used locally into static ones. This reduces the number of -Wmissing-prototypes warnings. Signed-off-by: Arthur Grillo Signed-off-by: Alex Deucher commit 9a13ff8f52dde1345f2e98468ce74fbb3be82970 Author: Melissa Wen Date: Tue Feb 14 11:14:06 2023 -0100 drm/amd/display: remove unused _calculate_degamma_curve function We don't use this function anywhere, therefore, remove it. Reviewed-by: Christian König Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit 62f9286fc26fb271529ca28e233df65662874900 Author: Melissa Wen Date: Tue Feb 14 11:14:05 2023 -0100 drm/amd/display: remove unused func declaration from resource headers The function resource_validate_ctx_update_pointer_after_copy() is declared in resource.h but never defined, therefore, remove its declaration from headers. Reviewed-by: Christian König Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit af54167d2b35be289a6aa98c0ebbb9bc38a1bdce Author: Melissa Wen Date: Tue Feb 14 11:14:04 2023 -0100 drm/amd/display: unset initial value for tf since it's never used In mod_color_calculate_{degamma/regamma}_params(), a tf variable is initialized as TRANSFER_FUNCTION_SRGB but tf is only used after tf = input->tf, therefore, better to just remove this initial value and avoid misleading interpretations. Reviewed-by: Christian König Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit 6ff387e889c48e0380e41ac6a5b06c71380110cd Author: Melissa Wen Date: Tue Feb 14 11:14:03 2023 -0100 drm/amd/display: camel case cleanup in color_gamma file Rename mapUserRamp to map_user_ramp and doClamping to do_clamping Reviewed-by: Christian König Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit 18c4e319db02c68237021ea7d3040ef3b21f09b9 Author: Lijo Lazar Date: Thu Jan 19 18:43:28 2023 +0530 drm/amd/pm: Allocate dummy table only if needed Only Navi1x requires dummy read workaround. Allocate the table in VRAM only for Navi1x. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit d8f3b3951ff4db44cd4695c396e26160de789370 Author: Qingqing Zhuo Date: Wed Feb 15 01:40:40 2023 -0500 Revert "drm/amd/display: enable DPG when disabling plane for phantom pipe" This reverts commit d47d2f9392f69f069c31d60ac3088471b1e1c7d4. regression detected by the change. Revert until fix is available. Signed-off-by: Qingqing Zhuo Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 2f5d28ae2da563f209a964f65c7243403ef37dd0 Author: Aric Cyr Date: Sun Feb 5 13:36:54 2023 -0500 drm/amd/display: Promote DAL to 3.2.223 This version brings along the following: - Move domain power control to DMCUB for DCN314 - Enable P-state validation check for DCN314 - Add support for multiple overlay planes - Fixes in prefetch, k1 k2 divider programming and more - Code cleanup Acked-by: Qingqing Zhuo Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d2994b25e0787eabf7477ccb17b62c7f680809fa Author: Ayush Gupta Date: Fri Feb 3 12:39:14 2023 -0500 drm/amd/display: temporary fix for page faulting This reverts a part of the commit 826e7ffaf079c72607bf3199d4e19730eaf8ca00 ("drm/amd/display: [FW Promotion] Release 0.0.153.0") Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Ayush Gupta Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8e5cfe547bf3beeb29d9608be68d22dff2b5012b Author: Mustapha Ghaddar Date: Fri Jan 27 07:48:55 2023 -0500 drm/amd/display: upstream link_dp_dpia_bw.c [WHY & HOW] - make link_dp_dpia_bw.c available for linux. - add the verify link peak bw - clean up code and comment format. Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Mustapha Ghaddar Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b7c67f72408b11b922f23f06c7df0f6743a2e89d Author: Nicholas Kazlauskas Date: Thu Feb 2 15:15:51 2023 -0500 drm/amd/display: Disable HUBP/DPP PG on DCN314 for now [Why] The DMCUB implementation required to workaround corruption is not currently stable and may cause intermittent corruption or hangs. [How] Disable PG until the sequence is stable. Reviewed-by: Hansen Dsouza Acked-by: Qingqing Zhuo Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 94369589e4ec13c762fe10a1fdc4463bdfee5d5f Author: Melissa Wen Date: Tue Feb 14 11:14:02 2023 -0100 drm/amd/display: clean code-style issues in dcn30_set_mpc_shaper_3dlut This function has many conditions and all code style issues (identation, missing braces, etc.) make reading it really annoying. Reviewed-by: Christian König Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit f52231c4a8ae9b3154626c165d6127cf608ec0a3 Author: Melissa Wen Date: Tue Feb 14 11:14:01 2023 -0100 drm/amd/display: ident braces in dcn30_acquire_post_bldn_3dlut correctly Reviewed-by: Christian König Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit dc907c9db8f71e3ba5faad6038f089a70d18e71f Author: Jack Xiao Date: Fri Feb 10 10:31:32 2023 +0800 drm/amd/amdgpu: fix warning during suspend Freeing memory was warned during suspend. Move the self test out of suspend. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2151825 Cc: jfalempe@redhat.com Signed-off-by: Jack Xiao Reviewed-by: Christian König Reviewed-by: Feifei Xu Reviewed-and-tested-by: Evan Quan Tested-by: Jocelyn Falempe Signed-off-by: Alex Deucher commit 388a9c907a51489bf566165c72e4e8aa4d62ab49 Merge: b6a4103c3538d d0ab772c1f155 Author: Jakub Kicinski Date: Wed Feb 15 19:15:45 2023 -0800 Merge branch 'devlink-cleanups-and-move-devlink-health-functionality-to-separate-file' Moshe Shemesh says: ==================== devlink: cleanups and move devlink health functionality to separate file This patchset moves devlink health callbacks, helpers and related code from leftover.c to new file health.c. About 1.3K LoC are moved by this patchset, covering all devlink health functionality. In addition this patchset includes a couple of small cleanups in devlink health code and documentation update. ==================== Link: https://lore.kernel.org/r/1676392686-405892-1-git-send-email-moshe@nvidia.com Signed-off-by: Jakub Kicinski commit d0ab772c1f1558af84f3293a52e9e886e08e0754 Author: Moshe Shemesh Date: Tue Feb 14 18:38:06 2023 +0200 devlink: Fix TP_STRUCT_entry in trace of devlink health report Fix a bug in trace point definition for devlink health report, as TP_STRUCT_entry of reporter_name should get reporter_name and not msg. Note no fixes tag as this is a harmless bug as both reporter_name and msg are strings and TP_fast_assign for this entry is correct. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit c745cfb27ae3eec2d16e1f8643338f2067d4fef8 Author: Moshe Shemesh Date: Tue Feb 14 18:38:05 2023 +0200 devlink: Update devlink health documentation Update devlink-health.rst file: - Add devlink formatted message (fmsg) API documentation. - Add auto-dump as a condition to do dump once error reported. - Expand OOB to clarify this acronym. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit 12af29e7790af811611409194f61d054e54365b9 Author: Moshe Shemesh Date: Tue Feb 14 18:38:04 2023 +0200 devlink: Move health common function to health file Now that all devlink health callbacks and related code are in file health.c move common health functions and devlink_health_reporter struct to be local in health.c file. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit c9311ee13f0ebd6d684793f88b91092672c21171 Author: Moshe Shemesh Date: Tue Feb 14 18:38:03 2023 +0200 devlink: Move devlink health test to health file Move devlink health report test callback from leftover.c to health.c. No functional change in this patch. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit 7004c6c45761143836d3c8122d91264320d87e8e Author: Moshe Shemesh Date: Tue Feb 14 18:38:02 2023 +0200 devlink: Move devlink health dump to health file Move devlink health report dump callbacks and related code from leftover.c to health.c. No functional change in this patch. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit a929df7fd9c6fbfb4ebbed7c9cf96657e9f622b6 Author: Moshe Shemesh Date: Tue Feb 14 18:38:01 2023 +0200 devlink: Move devlink fmsg and health diagnose to health file Devlink fmsg (formatted message) is used by devlink health diagnose, dump and drivers which support these devlink health callbacks. Therefore, move devlink fmsg helpers and related code to file health.c. Move devlink health diagnose to file health.c. No functional change in this patch. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit 55b9b249685214cc700113e6b677b78d2c0b97f9 Author: Moshe Shemesh Date: Tue Feb 14 18:38:00 2023 +0200 devlink: Move devlink health report and recover to health file Move devlink health report helper and recover callback and related code from leftover.c to health.c. No functional change in this patch. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit db6b5f3ec400479c0906be6884c9ecceaf0b8c46 Author: Moshe Shemesh Date: Tue Feb 14 18:37:59 2023 +0200 devlink: Move devlink health get and set code to health file Move devlink health get and set callbacks and related code from leftover.c to health.c. No functional change in this patch. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit bfd4e6a5dbbc12f77620602e764ac940ccb159de Author: Moshe Shemesh Date: Tue Feb 14 18:37:58 2023 +0200 devlink: health: Fix nla_nest_end in error flow devlink_nl_health_reporter_fill() error flow calls nla_nest_end(). Fix it to call nla_nest_cancel() instead. Note the bug is harmless as genlmsg_cancel() cancel the entire message, so no fixes tag added. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit b4740e3a8137faa5831c690d0bf0b46f41008baf Author: Moshe Shemesh Date: Tue Feb 14 18:37:57 2023 +0200 devlink: Split out health reporter create code Move devlink health reporter create/destroy and related dev code to new file health.c. This file shall include all callbacks and functionality that are related to devlink health. In addition, fix kdoc indentation and make reporter create/destroy kdoc more clear. No functional change in this patch. Signed-off-by: Moshe Shemesh Reviewed-by: Jiri Pirko Signed-off-by: Jakub Kicinski commit b6a4103c3538dec0a9ec8a6d1de7c009e428e7ab Author: Lorenzo Bianconi Date: Tue Feb 14 15:39:27 2023 +0100 ice: update xdp_features with xdp multi-buff Now ice driver supports xdp multi-buffer so add it to xdp_features. Check vsi type before setting xdp_features flag. Signed-off-by: Lorenzo Bianconi Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/r/8a4781511ab6e3cd280e944eef69158954f1a15f.1676385351.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 9dd6e53ef63dd384d63263ab9ef3a23471f1cd13 Author: Lorenzo Bianconi Date: Tue Feb 14 21:07:33 2023 +0100 i40e: check vsi type before setting xdp_features flag Set xdp_features flag just for I40E_VSI_MAIN vsi type since XDP is supported just in this configuration. Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/f2b537f86b34fc176fbc6b3d249b46a20a87a2f3.1676405131.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 6c20822fada1b8adb77fa450d03a0d449686a4a9 Author: Alexander Lobakin Date: Wed Feb 15 19:54:40 2023 +0100 bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES &xdp_buff and &xdp_frame are bound in a way that xdp_buff->data_hard_start == xdp_frame It's always the case and e.g. xdp_convert_buff_to_frame() relies on this. IOW, the following: for (u32 i = 0; i < 0xdead; i++) { xdpf = xdp_convert_buff_to_frame(&xdp); xdp_convert_frame_to_buff(xdpf, &xdp); } shouldn't ever modify @xdpf's contents or the pointer itself. However, "live packet" code wrongly treats &xdp_frame as part of its context placed *before* the data_hard_start. With such flow, data_hard_start is sizeof(*xdpf) off to the right and no longer points to the XDP frame. Instead of replacing `sizeof(ctx)` with `offsetof(ctx, xdpf)` in several places and praying that there are no more miscalcs left somewhere in the code, unionize ::frm with ::data in a flex array, so that both starts pointing to the actual data_hard_start and the XDP frame actually starts being a part of it, i.e. a part of the headroom, not the context. A nice side effect is that the maximum frame size for this mode gets increased by 40 bytes, as xdp_buff::frame_sz includes everything from data_hard_start (-> includes xdpf already) to the end of XDP/skb shared info. Also update %MAX_PKT_SIZE accordingly in the selftests code. Leave it hardcoded for 64 bit && 4k pages, it can be made more flexible later on. Minor: align `&head->data` with how `head->frm` is assigned for consistency. Minor #2: rename 'frm' to 'frame' in &xdp_page_head while at it for clarity. (was found while testing XDP traffic generator on ice, which calls xdp_convert_frame_to_buff() for each XDP frame) Fixes: b530e9e1063e ("bpf: Add "live packet" mode for XDP in BPF_PROG_RUN") Acked-by: Toke Høiland-Jørgensen Signed-off-by: Alexander Lobakin Link: https://lore.kernel.org/r/20230215185440.4126672-1-aleksander.lobakin@intel.com Signed-off-by: Martin KaFai Lau commit b4ff830eca097df51af10a9be29e8cc817327919 Author: Jason Gunthorpe Date: Mon Feb 13 14:02:42 2023 -0400 iommufd: Do not add the same hwpt to the ioas->hwpt_list twice The hwpt is added to the hwpt_list only during its creation, it is never added again. This hunk is some missed leftover from rework. Adding it twice will corrupt the linked list in some cases. It effects HWPT specific attachment, which is something the test suite cannot cover until we can create a legitimate struct device with a non-system iommu "driver" (ie we need the bus removed from the iommu code) Cc: stable@vger.kernel.org Fixes: e8d57210035b ("iommufd: Add kAPI toward external drivers for physical devices") Link: https://lore.kernel.org/r/1-v1-4336b5cb2fe4+1d7-iommufd_hwpt_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: Kevin Tian Signed-off-by: Jason Gunthorpe commit 8261ef2eb35fce689a82d346b25e945e16bcb9d3 Author: Steven Rostedt (Google) Date: Wed Feb 15 20:25:38 2023 -0500 tracing: Add BUILD_BUG() to make sure stacktrace fits in strings The max string length for a histogram variable is 256 bytes. The max depth of a stacktrace is 16. With 8byte words, that's 16 * 8 = 128. Which can easily fit in the string variable. The histogram stacktrace is being stored in the string value (with the given max length), with the assumption it will fit. To make sure that this is always the case (in the case that the stack trace depth increases), add a BUILD_BUG_ON() to test this. Link: https://lore.kernel.org/linux-trace-kernel/20230214002418.0103b9e765d3e5c374d2aa7d@kernel.org/ Signed-off-by: Steven Rostedt (Google) commit fc1a9dc101292403babe0c5c2f99f4748580ed98 Author: Tom Zanussi Date: Fri Feb 10 15:33:03 2023 -0600 tracing/histogram: Don't use strlen to find length of stacktrace variables Because stacktraces are saved in dynamic strings, trace_event_raw_event_synth() uses strlen to determine the length of the stack. Stacktraces may contain 0-bytes, though, in the saved addresses, so the length found and passed to reserve() will be too small. Fix this by using the first unsigned long in the stack variables to store the actual number of elements in the stack and have trace_event_raw_event_synth() use that to determine the length of the stack. Link: https://lkml.kernel.org/r/1ed6906cd9d6477ef2bd8e63c61de20a9ffe64d7.1676063532.git.zanussi@kernel.org Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) commit d964f09af457f79be637a50e726d4bda7f443349 Merge: 3538a0fbbd81b f371f2dc53d10 Author: Andrii Nakryiko Date: Wed Feb 15 16:29:32 2023 -0800 Merge branch 'New benchmark for hashmap lookups' Anton Protopopov says: ==================== Add a new benchmark for hashmap lookups and fix several typos. In commit 3 I've patched the bench utility so that now command line options can be reused by different benchmarks. The benchmark itself is added in the last commit 7. I was using this benchmark to test map lookup productivity when using a different hash function [1]. When run with --quiet, the results can be easily plotted [2]. The results provided by the benchmark look reasonable and match the results of my different benchmarks (requiring to patch kernel to get actual statistics on map lookups). Links: [1] https://fosdem.org/2023/schedule/event/bpf_hashing/ [2] https://github.com/aspsk/bpf-bench/tree/master/hashmap-bench Changes, v1->v2: - percpu_times_index[] is of wrong size (Martin) - use base 0 for strtol (Andrii) - just use -q without argument (Andrii) - use less hacks when parsing arguments (Andrii) ==================== Signed-off-by: Andrii Nakryiko commit f371f2dc53d107af25171f29c852a3908ee0afb6 Author: Anton Protopopov Date: Mon Feb 13 09:15:19 2023 +0000 selftest/bpf/benchs: Add benchmark for hashmap lookups Add a new benchmark which measures hashmap lookup operations speed. A user can control the following parameters of the benchmark: * key_size (max 1024): the key size to use * max_entries: the hashmap max entries * nr_entries: the number of entries to insert/lookup * nr_loops: the number of loops for the benchmark * map_flags The hashmap flags passed to BPF_MAP_CREATE The BPF program performing the benchmarks calls two nested bpf_loop: bpf_loop(nr_loops/nr_entries) bpf_loop(nr_entries) bpf_map_lookup() So the nr_loops determines the number of actual map lookups. All lookups are successful. Example (the output is generated on a AMD Ryzen 9 3950X machine): for nr_entries in `seq 4096 4096 65536`; do echo -n "$((nr_entries*100/65536))% full: "; sudo ./bench -d2 -a bpf-hashmap-lookup --key_size=4 --nr_entries=$nr_entries --max_entries=65536 --nr_loops=1000000 --map_flags=0x40 | grep cpu; done 6% full: cpu01: lookup 50.739M ± 0.018M events/sec (approximated from 32 samples of ~19ms) 12% full: cpu01: lookup 47.751M ± 0.015M events/sec (approximated from 32 samples of ~20ms) 18% full: cpu01: lookup 45.153M ± 0.013M events/sec (approximated from 32 samples of ~22ms) 25% full: cpu01: lookup 43.826M ± 0.014M events/sec (approximated from 32 samples of ~22ms) 31% full: cpu01: lookup 41.971M ± 0.012M events/sec (approximated from 32 samples of ~23ms) 37% full: cpu01: lookup 41.034M ± 0.015M events/sec (approximated from 32 samples of ~24ms) 43% full: cpu01: lookup 39.946M ± 0.012M events/sec (approximated from 32 samples of ~25ms) 50% full: cpu01: lookup 38.256M ± 0.014M events/sec (approximated from 32 samples of ~26ms) 56% full: cpu01: lookup 36.580M ± 0.018M events/sec (approximated from 32 samples of ~27ms) 62% full: cpu01: lookup 36.252M ± 0.012M events/sec (approximated from 32 samples of ~27ms) 68% full: cpu01: lookup 35.200M ± 0.012M events/sec (approximated from 32 samples of ~28ms) 75% full: cpu01: lookup 34.061M ± 0.009M events/sec (approximated from 32 samples of ~29ms) 81% full: cpu01: lookup 34.374M ± 0.010M events/sec (approximated from 32 samples of ~29ms) 87% full: cpu01: lookup 33.244M ± 0.011M events/sec (approximated from 32 samples of ~30ms) 93% full: cpu01: lookup 32.182M ± 0.013M events/sec (approximated from 32 samples of ~31ms) 100% full: cpu01: lookup 31.497M ± 0.016M events/sec (approximated from 32 samples of ~31ms) Signed-off-by: Anton Protopopov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230213091519.1202813-8-aspsk@isovalent.com commit a237dda05e9101404a634ac53ee65c8f8c8fce58 Author: Anton Protopopov Date: Mon Feb 13 09:15:18 2023 +0000 selftest/bpf/benchs: Print less if the quiet option is set The bench utility will print Setting up benchmark ''... Benchmark '' started. on startup to stdout. Suppress this output if --quiet option if given. This makes it simpler to parse benchmark output by a script. Signed-off-by: Anton Protopopov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230213091519.1202813-7-aspsk@isovalent.com commit 90c22503cd8910c54a8cd4bfe5bb6873d9ba8e0b Author: Anton Protopopov Date: Mon Feb 13 09:15:17 2023 +0000 selftest/bpf/benchs: Make quiet option common The "local-storage-tasks-trace" benchmark has a `--quiet` option. Move it to the list of common options, so that the main code and other benchmarks can use (new) env.quiet variable. Patch the run_bench_local_storage_rcu_tasks_trace.sh helper script accordingly. Signed-off-by: Anton Protopopov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230213091519.1202813-6-aspsk@isovalent.com commit 9644546260eac49348b2c0694b01bdf72c627194 Author: Anton Protopopov Date: Mon Feb 13 09:15:16 2023 +0000 selftest/bpf/benchs: Remove an unused header The benchs/bench_bpf_hashmap_full_update.c doesn't set a custom argp, so it shouldn't include the header. Signed-off-by: Anton Protopopov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230213091519.1202813-5-aspsk@isovalent.com commit 22ff7aeaa9e3d0533df613da3500db1ecf452253 Author: Anton Protopopov Date: Mon Feb 13 09:15:15 2023 +0000 selftest/bpf/benchs: Enhance argp parsing To parse command line the bench utility uses the argp_parse() function. This function takes as an argument a parent 'struct argp' structure which defines common command line options and an array of children 'struct argp' structures which defines additional command line options for particular benchmarks. This implementation doesn't allow benchmarks to share option names, e.g., if two benchmarks want to use, say, the --option option, then only one of them will succeed (the first one encountered in the array). This will be convenient if same option names could be used in different benchmarks (with the same semantics, e.g., --nr_loops=N). Fix this by calling the argp_parse() function twice. The first call is the same as it was before, with all children argps, and helps to find the benchmark name and to print a combined help message if anything is wrong. Given the name, we can call the argp_parse the second time, but now the children array points only to a correct benchmark thus always calling the correct parsers. (If there's no a specific list of arguments, then only one call to argp_parse will be done.) Signed-off-by: Anton Protopopov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230213091519.1202813-4-aspsk@isovalent.com commit 2f1c59637fb17dbb2a725c3bd48e4d9d3809df89 Author: Anton Protopopov Date: Mon Feb 13 09:15:14 2023 +0000 selftest/bpf/benchs: Make a function static in bpf_hashmap_full_update The hashmap_report_final callback function defined in the benchs/bench_bpf_hashmap_full_update.c file should be static. Signed-off-by: Anton Protopopov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230213091519.1202813-3-aspsk@isovalent.com commit 4db98ab445c58bd26c303ef7a10ccd8f049acc22 Author: Anton Protopopov Date: Mon Feb 13 09:15:13 2023 +0000 selftest/bpf/benchs: Fix a typo in bpf_hashmap_full_update To call the bpf_hashmap_full_update benchmark, one should say: bench bpf-hashmap-ful-update The patch adds a missing 'l' to the benchmark name. Signed-off-by: Anton Protopopov Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20230213091519.1202813-2-aspsk@isovalent.com commit 3538a0fbbd81bc131afe48b4cf02895735944359 Merge: b2d9002ee9a65 f88da2d46cc9a Author: Alexei Starovoitov Date: Wed Feb 15 15:40:06 2023 -0800 Merge branch 'Use __GFP_ZERO in bpf memory allocator' Hou Tao says: ==================== From: Hou Tao Hi, The patchset tries to fix the hard-up problem found when checking how htab handles element reuse in bpf memory allocator. The immediate reuse of freed elements will reinitialize special fields (e.g., bpf_spin_lock) in htab map value and it may corrupt lookup procedure with BFP_F_LOCK flag which acquires bpf-spin-lock during value copying, and lead to hard-lock as shown in patch #2. Patch #1 fixes it by using __GFP_ZERO when allocating the object from slab and the behavior is similar with the preallocated hash-table case. Please see individual patches for more details. And comments are always welcome. Regards, Change Log: v1: * Use __GFP_ZERO instead of ctor to avoid retpoline overhead (from Alexei) * Add comments for check_and_init_map_value() (from Alexei) * split __GFP_ZERO patches out of the original patchset to unblock the development work of others. RFC: https://lore.kernel.org/bpf/20221230041151.1231169-1-houtao@huaweicloud.com ==================== Signed-off-by: Alexei Starovoitov commit f88da2d46cc9a19b0c233285339659cae36c5d9a Author: Hou Tao Date: Wed Feb 15 16:21:32 2023 +0800 selftests/bpf: Add test case for element reuse in htab map The reinitialization of spin-lock in map value after immediate reuse may corrupt lookup with BPF_F_LOCK flag and result in hard lock-up, so add one test case to demonstrate the problem. Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20230215082132.3856544-3-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 997849c4b969034e225153f41026657def66d286 Author: Hou Tao Date: Wed Feb 15 16:21:31 2023 +0800 bpf: Zeroing allocated object from slab in bpf memory allocator Currently the freed element in bpf memory allocator may be immediately reused, for htab map the reuse will reinitialize special fields in map value (e.g., bpf_spin_lock), but lookup procedure may still access these special fields, and it may lead to hard-lockup as shown below: NMI backtrace for cpu 16 CPU: 16 PID: 2574 Comm: htab.bin Tainted: G L 6.1.0+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), RIP: 0010:queued_spin_lock_slowpath+0x283/0x2c0 ...... Call Trace: copy_map_value_locked+0xb7/0x170 bpf_map_copy_value+0x113/0x3c0 __sys_bpf+0x1c67/0x2780 __x64_sys_bpf+0x1c/0x20 do_syscall_64+0x30/0x60 entry_SYSCALL_64_after_hwframe+0x46/0xb0 ...... For htab map, just like the preallocated case, these is no need to initialize these special fields in map value again once these fields have been initialized. For preallocated htab map, these fields are initialized through __GFP_ZERO in bpf_map_area_alloc(), so do the similar thing for non-preallocated htab in bpf memory allocator. And there is no need to use __GFP_ZERO for per-cpu bpf memory allocator, because __alloc_percpu_gfp() does it implicitly. Fixes: 0fd7c5d43339 ("bpf: Optimize call_rcu in non-preallocated hash map.") Signed-off-by: Hou Tao Link: https://lore.kernel.org/r/20230215082132.3856544-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 748ea32d2dbd813d3bd958117bde5191182f909a Author: Nathan Chancellor Date: Wed Feb 15 10:12:12 2023 -0700 macintosh: windfarm: Use unsigned type for 1-bit bitfields Clang warns: drivers/macintosh/windfarm_lm75_sensor.c:63:14: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] lm->inited = 1; ^ ~ drivers/macintosh/windfarm_smu_sensors.c:356:19: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] pow->fake_volts = 1; ^ ~ drivers/macintosh/windfarm_smu_sensors.c:368:18: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] pow->quadratic = 1; ^ ~ There is no bug here since no code checks the actual value of these fields, just whether or not they are zero (boolean context), but this can be easily fixed by switching to an unsigned type. Signed-off-by: Nathan Chancellor Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230215-windfarm-wsingle-bit-bitfield-constant-conversion-v1-1-26415072e855@kernel.org commit 7fde88eda855952766a74026c181c6270b3392fc Author: David Rau Date: Wed Feb 15 10:10:45 2023 +0000 ASoC: da7219: Improve the IRQ process to increase the stability Remove the sleep control in IRQ thread and create an individual task to handel it for Jack plug in event. This commit improves the control of ground switches in the AAD IRQ. Signed-off-by: David Rau Link: https://lore.kernel.org/r/20230215101045.21456-1-David.Rau.opensource@dm.renesas.com Signed-off-by: Mark Brown commit c142872ea40a99258e2a86bf5c471bcc81752f56 Author: Arnd Bergmann Date: Wed Feb 15 13:47:08 2023 +0100 power: reset: odroid-go-ultra: fix I2C dependency Since this driver can only be built-in, it fails to link when the I2C layer is in a loadable module: x86_64-linux-ld: drivers/power/reset/odroid-go-ultra-poweroff.o: in function `odroid_go_ultra_poweroff_get_pmic_device': odroid-go-ultra-poweroff.c:(.text+0x30): undefined reference to `i2c_find_device_by_fwnode' Tighten the dependency to only allow enabling POWER_RESET_ODROID_GO_ULTRA_POWEROFF is I2C is built-in as well. Fixes: cec3b46b8bda ("power: reset: add Odroid Go Ultra poweroff driver") Signed-off-by: Arnd Bergmann Acked-by: Neil Armstrong Signed-off-by: Sebastian Reichel commit 9de10a51b0c6e7c1ca99a65c043243597002202e Author: Thomas Weißschuh Date: Wed Feb 15 01:12:55 2023 +0000 power: supply: leds: explicitly include linux/leds.h Instead of relying on an accidental, transitive inclusion of linux/leds.h use it directly. Signed-off-by: Thomas Weißschuh Signed-off-by: Sebastian Reichel commit 97b7cea04f52c3263a74b945a4738f678181b117 Author: Dan Carpenter Date: Wed Feb 15 17:05:20 2023 +0300 spi: bcm63xx-hsspi: fix error code in probe This code accidentally returns success instead of a negative error code. Fixes: 50a6620dd1fb ("spi: bcm63xx-hsspi: Add polling mode support") Signed-off-by: Dan Carpenter Reviewed-by: William Zhang Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/Y+zmoGH6LubPhiI0@kili Signed-off-by: Mark Brown commit 0696532e12524855fa8044590d374079f271f216 Author: Dan Carpenter Date: Wed Feb 15 17:05:32 2023 +0300 spi: bcmbca-hsspi: Fix error code in probe() function This code accidentally returns success instead of a negative error code. Fixes: a38a2233f23b ("spi: bcmbca-hsspi: Add driver for newer HSSPI controller") Signed-off-by: Dan Carpenter Reviewed-by: Florian Fainelli Reviewed-by: William Zhang Link: https://lore.kernel.org/r/Y+zmrNJ9zjNQpzWq@kili Signed-off-by: Mark Brown commit b2b911afd86631e601537c7dd7bb0acc0b1f9b51 Author: Konrad Dybcio Date: Tue Feb 14 10:08:48 2023 +0100 dt-bindings: power: supply: pm8941-coincell: Don't require charging properties It's fine for these properties to be absent, as the driver doesn't fail without them and functions with settings inherited from the reset/previous stage bootloader state. Fixes: 6c463222a21d ("dt-bindings: power: supply: pm8941-coincell: Convert to DT schema format") Signed-off-by: Konrad Dybcio Acked-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel commit b8ad34ce75a2e029946d7bf6832c363ce5578e39 Author: Konrad Dybcio Date: Tue Feb 14 10:08:47 2023 +0100 dt-bindings: power: supply: pm8941-coincell: Add PM8998 compatible Add a specific compatible for the coincell charger present on PM8998. Acked-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Signed-off-by: Sebastian Reichel commit 25eba1598c8e1e804c02e3a0da50782c50c11c41 Author: Cristian Ciocaltea Date: Thu Feb 9 21:37:35 2023 +0200 dt-bindings: Fix multi pattern support in DT_SCHEMA_FILES DT_SCHEMA_FILES used to allow specifying a space separated list of file paths, but the introduction of partial matches support broke this feature: $ make dtbs_check DT_SCHEMA_FILES="path/to/schema1.yaml path/to/schema2.yaml" [...] LINT Documentation/devicetree/bindings usage: yamllint [-h] [-] [-c CONFIG_FILE | -d CONFIG_DATA] [--list-files] [...] [-v] [FILE_OR_DIR ...] yamllint: error: one of the arguments FILE_OR_DIR - is required [...] Restore the lost functionality by preparing a grep filter that is able to handle multiple search patterns. Additionally, as suggested by Rob, use ':' instead of ' ' as the patterns separator char. Hence, the command above becomes: $ make dtbs_check DT_SCHEMA_FILES="path/to/schema1.yaml:path/to/schema2.yaml" Fixes: 309d955985ee ("dt-bindings: kbuild: Support partial matches with DT_SCHEMA_FILES") Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20230209193735.795288-1-cristian.ciocaltea@collabora.com Signed-off-by: Rob Herring commit aeb9267eb6b1df992e39467a620da8fdf434df54 Author: Martin Liu Date: Fri Feb 10 00:09:55 2023 +0800 of: reserved-mem: print out reserved-mem details during boot It's important to know reserved-mem information in mobile world since reserved memory via device tree keeps increased in platform (e.g., 45% in our platform). Therefore, it's crucial to know the reserved memory sizes breakdown for the memory accounting. This patch prints out reserved memory details during boot to make them visible. Below is an example output: [ 0.000000] OF: reserved mem: 0x00000009f9400000..0x00000009fb3fffff ( 32768 KB ) map reusable test1 [ 0.000000] OF: reserved mem: 0x00000000ffdf0000..0x00000000ffffffff ( 2112 KB ) map non-reusable test2 [ 0.000000] OF: reserved mem: 0x0000000091000000..0x00000000912fffff ( 3072 KB ) nomap non-reusable test3 Signed-off-by: Martin Liu Link: https://lore.kernel.org/r/20230209160954.1471909-1-liumartin@google.com Signed-off-by: Rob Herring commit 74ff8864cc842be994853095dba6db48e716400a Author: Lukas Wunner Date: Fri Jan 20 10:19:02 2023 +0100 PCI: hotplug: Allow marking devices as disconnected during bind/unbind On surprise removal, pciehp_unconfigure_device() and acpiphp's trim_stale_devices() call pci_dev_set_disconnected() to mark removed devices as permanently offline. Thereby, the PCI core and drivers know to skip device accesses. However pci_dev_set_disconnected() takes the device_lock and thus waits for a concurrent driver bind or unbind to complete. As a result, the driver's ->probe and ->remove hooks have no chance to learn that the device is gone. That doesn't make any sense, so drop the device_lock and instead use atomic xchg() and cmpxchg() operations to update the device state. As a byproduct, an AB-BA deadlock reported by Anatoli is fixed which occurs on surprise removal with AER concurrently performing a bus reset. AER bus reset: INFO: task irq/26-aerdrv:95 blocked for more than 120 seconds. Tainted: G W 6.2.0-rc3-custom-norework-jan11+ schedule rwsem_down_write_slowpath down_write_nested pciehp_reset_slot # acquires reset_lock pci_reset_hotplug_slot pci_slot_reset # acquires device_lock pci_bus_error_reset aer_root_reset pcie_do_recovery aer_process_err_devices aer_isr pciehp surprise removal: INFO: task irq/26-pciehp:96 blocked for more than 120 seconds. Tainted: G W 6.2.0-rc3-custom-norework-jan11+ schedule_preempt_disabled __mutex_lock mutex_lock_nested pci_dev_set_disconnected # acquires device_lock pci_walk_bus pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist # acquires reset_lock Link: https://bugzilla.kernel.org/show_bug.cgi?id=215590 Fixes: a6bd101b8f84 ("PCI: Unify device inaccessible") Link: https://lore.kernel.org/r/3dc88ea82bdc0e37d9000e413d5ebce481cbd629.1674205689.git.lukas@wunner.de Reported-by: Anatoli Antonovitch Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v4.20+ Cc: Keith Busch commit d2ad8f0c89e2a002293aa53a628e9600453a0a53 Merge: a06377c5d01ee b6c0c237bea19 Author: Jens Axboe Date: Wed Feb 15 13:47:57 2023 -0700 Merge tag 'nvme-6.3-2023-02-15' of git://git.infradead.org/nvme into for-6.3/block Pull NVMe fixes from Christoph: "nvme fixes for Linux 6.3 - fix and cleanup freeing single sgl (Keith Busch)" * tag 'nvme-6.3-2023-02-15' of git://git.infradead.org/nvme: nvme-pci: remove iod use_sgls nvme-pci: fix freeing single sgl commit 38bd413638b245246fb35b5e94c63e0f0b791256 Author: Randy Dunlap Date: Sat Jan 28 11:21:09 2023 -0800 Documentation: i2c: correct spelling Correct spelling problems for Documentation/i2c/ as reported by codespell. Signed-off-by: Randy Dunlap Signed-off-by: Wolfram Sang commit b3de755d6041ebb197d89a4dcb27c85521e034c8 Author: Alain Volmat Date: Mon Feb 13 20:16:06 2023 +0100 dt-bindings: i2c: i2c-st: convert to DT schema Convert i2c-st.txt into st,sti-i2c.yaml for the i2c-st driver. Signed-off-by: Alain Volmat Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wolfram Sang commit b2d9002ee9a65aa0eaf01ae494876fe16389d535 Merge: 62d101d5f422c 2a33c5a25ef4f Author: Alexei Starovoitov Date: Wed Feb 15 11:48:48 2023 -0800 Merge branch 'Improvements for BPF_ST tracking by verifier ' Eduard Zingerman says: ==================== This patch-set is a part of preparation work for -mcpu=v4 option for BPF C compiler (discussed in [1]). Among other things -mcpu=v4 should enable generation of BPF_ST instruction by the compiler. - Patches #1,2 adjust verifier to track values of constants written to stack using BPF_ST. Currently these are tracked imprecisely, unlike the writes using BPF_STX, e.g.: fp[-8] = 42; currently verifier assumes that fp[-8]=mmmmmmmm after such instruction, where m stands for "misc", just a note that something is written at fp[-8]. r1 = 42; verifier tracks r1=42 after this instruction. fp[-8] = r1; verifier tracks fp[-8]=42 after this instruction. This patch makes both cases equivalent. - Patches #3,4 adjust verifier.c:check_stack_write_fixed_off() to preserve STACK_ZERO marks when BPF_ST writes zero. Currently these are replaced by STACK_MISC, unlike zero writes using BPF_STX, e.g.: ... stack range [X,Y] is marked as STACK_ZERO ... r0 = ... variable offset pointer to stack with range [X,Y] ... fp[r0] = 0; currently verifier marks range [X,Y] as STACK_MISC for such instructions. r1 = 0; fp[r0] = r1; verifier keeps STACK_ZERO marks for range [X,Y]. This patch makes both cases equivalent. Motivating example for patch #1 could be found at [3]. Previous version of the patch-set is here [2], the changes are: - Explicit initialization of fake register parent link is removed from verifier.c:check_stack_write_fixed_off() as parent links are now correctly handled by verifier.c:save_register_state(). - Original patch #1 is split in patches #1 & #3. - Missing test case added for patch #3 verifier.c:check_stack_write_fixed_off() adjustment. - Test cases are updated to use .prog_type = BPF_PROG_TYPE_SK_LOOKUP, which requires return value to be in the range [0,1] (original test cases assumed that such range is always required, which is not true). - Original patch #3 with changes allowing BPF_ST writes to context is withheld for now, w/o compiler support for BPF_ST it requires some creative testing. - Original patch #5 is removed from the patch-set. This patch contained adjustments to expected verifier error messages in some tests, necessary when C compiler generates BPF_ST instruction instead of BPF_STX (changes to expected instruction indices). These changes are not necessary yet. [1] https://lore.kernel.org/bpf/01515302-c37d-2ee5-c950-2f556a4caad0@meta.com/ [2] https://lore.kernel.org/bpf/20221231163122.1360813-1-eddyz87@gmail.com/ [3] https://lore.kernel.org/bpf/f1e4282bf00aa21a72fc5906f8c3be1ae6c94a5e.camel@gmail.com/ ==================== Signed-off-by: Alexei Starovoitov commit 2a33c5a25ef4fb574e6744fe7636956b124ad78f Author: Eduard Zingerman Date: Wed Feb 15 01:20:30 2023 +0200 selftests/bpf: check if BPF_ST with variable offset preserves STACK_ZERO A test case to verify that variable offset BPF_ST instruction preserves STACK_ZERO marks when writes zeros, e.g. in the following situation: *(u64*)(r10 - 8) = 0 ; STACK_ZERO marks for fp[-8] r0 = random(-7, -1) ; some random number in range of [-7, -1] r0 += r10 ; r0 is now variable offset pointer to stack *(u8*)(r0) = 0 ; BPF_ST writing zero, STACK_ZERO mark for ; fp[-8] should be preserved. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230214232030.1502829-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 31ff2135121ca9c0fd6c60de6b851509a24446ab Author: Eduard Zingerman Date: Wed Feb 15 01:20:29 2023 +0200 bpf: BPF_ST with variable offset should preserve STACK_ZERO marks BPF_STX instruction preserves STACK_ZERO marks for variable offset writes in situations like below: *(u64*)(r10 - 8) = 0 ; STACK_ZERO marks for fp[-8] r0 = random(-7, -1) ; some random number in range of [-7, -1] r0 += r10 ; r0 is now a variable offset pointer to stack r1 = 0 *(u8*)(r0) = r1 ; BPF_STX writing zero, STACK_ZERO mark for ; fp[-8] is preserved This commit updates verifier.c:check_stack_write_var_off() to process BPF_ST in a similar manner, e.g. the following example: *(u64*)(r10 - 8) = 0 ; STACK_ZERO marks for fp[-8] r0 = random(-7, -1) ; some random number in range of [-7, -1] r0 += r10 ; r0 is now variable offset pointer to stack *(u8*)(r0) = 0 ; BPF_ST writing zero, STACK_ZERO mark for ; fp[-8] is preserved Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230214232030.1502829-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 1a24af65bb5fed673a9377e794ee3cf416fec64d Author: Eduard Zingerman Date: Wed Feb 15 01:20:28 2023 +0200 selftests/bpf: check if verifier tracks constants spilled by BPF_ST_MEM Check that verifier tracks the value of 'imm' spilled to stack by BPF_ST_MEM instruction. Cover the following cases: - write of non-zero constant to stack; - write of a zero constant to stack. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230214232030.1502829-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit ecdf985d7615356b78241fdb159c091830ed0380 Author: Eduard Zingerman Date: Wed Feb 15 01:20:27 2023 +0200 bpf: track immediate values written to stack by BPF_ST instruction For aligned stack writes using BPF_ST instruction track stored values in a same way BPF_STX is handled, e.g. make sure that the following commands produce similar verifier knowledge: fp[-8] = 42; r1 = 42; fp[-8] = r1; This covers two cases: - non-null values written to stack are stored as spill of fake registers; - null values written to stack are stored as STACK_ZERO marks. Previously both cases above used STACK_MISC marks instead. Some verifier test cases relied on the old logic to obtain STACK_MISC marks for some stack values. These test cases are updated in the same commit to avoid failures during bisect. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20230214232030.1502829-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 7c855ef7137a67bcff0e039691b969428dd8ef6a Author: Krzysztof Kozlowski Date: Wed Feb 8 11:15:42 2023 +0100 dt-bindings: mailbox: qcom,apcs-kpss-global: drop mbox-names from example Qualcomm G-Link RPM edge bindings do not allow and do not use mbox-names property. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230208101545.45711-4-krzysztof.kozlowski@linaro.org commit dd855f01e8d194d2dfeda36b620203c623c10430 Merge: ace5029856c09 cf3e0251868c5 71bc571c64c13 Author: Rafael J. Wysocki Date: Wed Feb 15 20:09:09 2023 +0100 Merge branches 'pm-tools' and 'pm-docs' Merge power management utilities and documentation updates for 6.3-rc1: - Modify some power management utilities to use the canonical ftrace path (Ross Zwisler). - Correct spelling problems for Documentation/power/ as reported by codespell (Randy Dunlap). * pm-tools: PM: tools: use canonical ftrace path * pm-docs: Documentation: power: correct spelling commit ace5029856c09a63c63eaca066d922c331ed1539 Merge: 7e71a13353ff7 cf835b005b285 0b6200e1e9f53 a0e8c13ccd6a9 99537067aca7e Author: Rafael J. Wysocki Date: Wed Feb 15 20:06:26 2023 +0100 Merge branches 'powercap', 'pm-domains', 'pm-em' and 'pm-opp' Merge updates of the powercap framework, generic PM domains, Energy Model and operating performance points for 6.3-rc1: - Fix possible name leak in powercap_register_zone() (Yang Yingliang). - Add Meteor Lake and Emerald Rapids support to the intel_rapl power capping driver (Zhang Rui). - Modify the idle_inject power capping facility to support 100% idle injection (Srinivas Pandruvada). - Fix large time windows handling in the intel_rapl power capping driver (Zhang Rui). - Fix memory leaks with using debugfs_lookup() in the generic PM domains and Energy Model code (Greg Kroah-Hartman). - Add missing 'cache-unified' property in example for kryo OPP bindings (Rob Herring). - Fix error checking in opp_migrate_dentry() (Qi Zheng). - Remove "select SRCU" (Paul E. McKenney). - Let qcom,opp-fuse-level be a 2-long array for qcom SoCs (Konrad Dybcio). * powercap: powercap: intel_rapl: Fix handling for large time window powercap: idle_inject: Support 100% idle injection powercap: intel_rapl: add support for Emerald Rapids powercap: intel_rapl: add support for Meteor Lake powercap: fix possible name leak in powercap_register_zone() * pm-domains: PM: domains: fix memory leak with using debugfs_lookup() * pm-em: PM: EM: fix memory leak with using debugfs_lookup() * pm-opp: OPP: fix error checking in opp_migrate_dentry() dt-bindings: opp: v2-qcom-level: Let qcom,opp-fuse-level be a 2-long array drivers/opp: Remove "select SRCU" dt-bindings: opp: opp-v2-kryo-cpu: Add missing 'cache-unified' property in example commit ec6311919ea616be69076d03c3e2d2f7769d5f5f Merge: 9a5c09dd97014 6724a76cff85e Author: Palmer Dabbelt Date: Wed Feb 15 10:57:13 2023 -0800 Merge patch series "riscv: Optimize function trace" guoren@kernel.org says: From: Guo Ren The previous ftrace detour implementation fc76b8b8011 ("riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT") contain three problems. - The most horrible bug is preemption panic which found by Andy [1]. Let's disable preemption for ftrace first, and Andy could continue the ftrace preemption work. - The "-fpatchable-function-entry= CFLAG" wasted code size !RISCV_ISA_C. - The ftrace detour implementation wasted code size. - When livepatching, the trampoline (ftrace_regs_caller) would not return to but would rather jump to the new function. So, "REG_L ra, -SZREG(sp)" would not run and the original return address would not be restored. The kernel is likely to hang or crash as a result. (Found by Evgenii Shatokhin [4]) [Palmer: The first three patches in this series are pretty concrete fixes, so I'm pulling them ahead of the rest of the series.] * b4-shazam-merge: riscv: ftrace: Reduce the detour code size to half riscv: ftrace: Remove wasted nops for !RISCV_ISA_C riscv: ftrace: Fixup panic by disabling preemption Link: https://lore.kernel.org/r/20230112090603.1295340-1-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 6724a76cff85ee271bbbff42ac527e4643b2ec52 Author: Guo Ren Date: Thu Jan 12 04:05:59 2023 -0500 riscv: ftrace: Reduce the detour code size to half Use a temporary register to reduce the size of detour code from 16 bytes to 8 bytes. The previous implementation is from 'commit afc76b8b8011 ("riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT")'. Before the patch: : 0: REG_S ra, -SZREG(sp) 4: auipc ra, ? 8: jalr ?(ra) 12: REG_L ra, -SZREG(sp) (func_boddy) After the patch: : 0: auipc t0, ? 4: jalr t0, ?(t0) (func_boddy) This patch not just reduces the size of detour code, but also fixes an important issue: An Ftrace callback registered with FTRACE_OPS_FL_IPMODIFY flag can actually change the instruction pointer, e.g. to "replace" the given kernel function with a new one, which is needed for livepatching, etc. In this case, the trampoline (ftrace_regs_caller) would not return to but would rather jump to the new function. So, "REG_L ra, -SZREG(sp)" would not run and the original return address would not be restored. The kernel is likely to hang or crash as a result. This can be easily demonstrated if one tries to "replace", say, cmdline_proc_show() with a new function with the same signature using instruction_pointer_set(&fregs->regs, new_func_addr) in the Ftrace callback. Link: https://lore.kernel.org/linux-riscv/20221122075440.1165172-1-suagrfillet@gmail.com/ Link: https://lore.kernel.org/linux-riscv/d7d5730b-ebef-68e5-5046-e763e1ee6164@yadro.com/ Co-developed-by: Song Shuai Signed-off-by: Song Shuai Signed-off-by: Guo Ren Signed-off-by: Guo Ren Cc: Evgenii Shatokhin Reviewed-by: Evgenii Shatokhin Link: https://lore.kernel.org/r/20230112090603.1295340-4-guoren@kernel.org Cc: stable@vger.kernel.org Fixes: 10626c32e382 ("riscv/ftrace: Add basic support") Signed-off-by: Palmer Dabbelt commit 409c8fb20c66df7150e592747412438c04aeb11f Author: Guo Ren Date: Thu Jan 12 04:05:58 2023 -0500 riscv: ftrace: Remove wasted nops for !RISCV_ISA_C When CONFIG_RISCV_ISA_C=n, -fpatchable-function-entry=8 would generate more nops than we expect. Because it treat nop opcode as 0x00000013 instead of 0x0001. Dump of assembler code for function dw_pcie_free_msi: 0xffffffff806fce94 <+0>: sd ra,-8(sp) 0xffffffff806fce98 <+4>: auipc ra,0xff90f 0xffffffff806fce9c <+8>: jalr -684(ra) # 0xffffffff8000bbec 0xffffffff806fcea0 <+12>: ld ra,-8(sp) 0xffffffff806fcea4 <+16>: nop /* wasted */ 0xffffffff806fcea8 <+20>: nop /* wasted */ 0xffffffff806fceac <+24>: nop /* wasted */ 0xffffffff806fceb0 <+28>: nop /* wasted */ 0xffffffff806fceb4 <+0>: addi sp,sp,-48 0xffffffff806fceb8 <+4>: sd s0,32(sp) 0xffffffff806fcebc <+8>: sd s1,24(sp) 0xffffffff806fcec0 <+12>: sd s2,16(sp) 0xffffffff806fcec4 <+16>: sd s3,8(sp) 0xffffffff806fcec8 <+20>: sd ra,40(sp) 0xffffffff806fcecc <+24>: addi s0,sp,48 Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20230112090603.1295340-3-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 8547649981e6631328cd64f583667501ae385531 Author: Andy Chiu Date: Thu Jan 12 04:05:57 2023 -0500 riscv: ftrace: Fixup panic by disabling preemption In RISCV, we must use an AUIPC + JALR pair to encode an immediate, forming a jump that jumps to an address over 4K. This may cause errors if we want to enable kernel preemption and remove dependency from patching code with stop_machine(). For example, if a task was switched out on auipc. And, if we changed the ftrace function before it was switched back, then it would jump to an address that has updated 11:0 bits mixing with previous XLEN:12 part. p: patched area performed by dynamic ftrace ftrace_prologue: p| REG_S ra, -SZREG(sp) p| auipc ra, 0x? ------------> preempted ... change ftrace function ... p| jalr -?(ra) <------------- switched back p| REG_L ra, -SZREG(sp) func: xxx ret Fixes: afc76b8b8011 ("riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT") Signed-off-by: Andy Chiu Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20230112090603.1295340-2-guoren@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 964a54e5e1a0d70cd80bd5a0885a1938463625b1 Author: Thomas Weißschuh Date: Fri Feb 10 02:13:40 2023 +0000 btrfs: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Reviewed-by: Anand Jain Signed-off-by: Thomas Weißschuh Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1eb82ef87336045459929d915b8050beaea92951 Author: Christoph Hellwig Date: Mon Dec 12 08:37:24 2022 +0100 btrfs: remove the bdev argument to btrfs_rmap_block The only user in the zoned remap code is gone now, so remove the argument. Reviewed-by: Josef Bacik Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 04f0847c4552b898ec5867a6b36f1e953330beae Author: Christoph Hellwig Date: Mon Dec 12 08:37:23 2022 +0100 btrfs: don't rely on unchanging ->bi_bdev for zone append remaps btrfs_record_physical_zoned relies on a bio->bi_bdev samples in the bio_end_io handler to find the reverse map for remapping the zone append write, but stacked block device drivers can and usually do change bi_bdev when sending on the bio to a lower device. This can happen e.g. with the nvme-multipath driver when a NVMe SSD sets the shared namespace bit. But there is no real need for the bdev in btrfs_record_physical_zoned, as it is only passed to btrfs_rmap_block, which uses it to pick the mapping to report if there are multiple reverse mappings. As zone writes can only do simple non-mirror writes right now, and anything more complex will use the stripe tree there is no chance of the multiple mappings case actually happening. Instead open code the subset of btrfs_rmap_block in btrfs_record_physical_zoned, which also removes a memory allocation and remove the bdev field in the ordered extent. Fixes: d8e3fb106f39 ("btrfs: zoned: use ZONE_APPEND write for zoned mode") Reviewed-by: Josef Bacik Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit fdf9a37dcfd47e9bd18d1218f2d0b2fa3748d00d Author: Christoph Hellwig Date: Mon Dec 12 08:37:22 2022 +0100 btrfs: never return true for reads in btrfs_use_zone_append Using Zone Append only makes sense for writes to the device, so check that in btrfs_use_zone_append. This avoids the possibility of artificially limited read size on zoned file systems. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 921603c76246a7f716b9a244d7b1fa1653935f31 Author: Christoph Hellwig Date: Mon Dec 12 08:37:21 2022 +0100 btrfs: pass a btrfs_bio to btrfs_use_append struct btrfs_bio has all the information needed for btrfs_use_append, so pass that instead of a btrfs_inode and file_offset. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0d495430db8d704b3a70b244b54d5ee30cf03f69 Author: Christoph Hellwig Date: Mon Dec 12 08:37:20 2022 +0100 btrfs: set bbio->file_offset in alloc_new_bio Instead of digging into the bio_vec in submit_one_bio, set file_offset at bio allocation time from the provided parameter. This also ensures that the file_offset is available all the time when building up the bio payload. Reviewed-by: Josef Bacik Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 72fcf1a47b8daba82ffdeddd630688df5ac1bddb Author: Christoph Hellwig Date: Mon Dec 12 08:37:18 2022 +0100 btrfs: use file_offset to limit bios size in calc_bio_boundaries btrfs_ordered_extent->disk_bytenr can be rewritten by the zoned I/O completion handler, and thus in general is not a good idea to limit I/O size. But the maximum bio size calculation can easily be done using the file_offset fields in the btrfs_ordered_extent and btrfs_bio structures, so switch to that instead. Reviewed-by: Josef Bacik Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit a724f313f84beb5b63b8844d9ec42a547e4a3c18 Author: Filipe Manana Date: Wed Feb 8 17:46:49 2023 +0000 btrfs: do unsigned integer division in the extent buffer binary search loop In the search loop of the binary search function, we are doing a division by 2 of the sum of the high and low slots. Because the slots are integers, the generated assembly code for it is the following on x86_64: 0x00000000000141f1 <+145>: mov %eax,%ebx 0x00000000000141f3 <+147>: shr $0x1f,%ebx 0x00000000000141f6 <+150>: add %eax,%ebx 0x00000000000141f8 <+152>: sar %ebx It's a few more instructions than a simple right shift, because signed integer division needs to round towards zero. However we know that slots can never be negative (btrfs_header_nritems() returns an u32), so we can instead use unsigned types for the low and high slots and therefore use unsigned integer division, which results in a single instruction on x86_64: 0x00000000000141f0 <+144>: shr %ebx So use unsigned types for the slots and therefore unsigned division. This is part of a small patchset comprised of the following two patches: btrfs: eliminate extra call when doing binary search on extent buffer btrfs: do unsigned integer division in the extent buffer binary search loop The following fs_mark test was run on a non-debug kernel (Debian's default kernel config) before and after applying the patchset: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi MOUNT_OPTIONS="-o ssd" MKFS_OPTIONS="-O no-holes -R free-space-tree" FILES=100000 THREADS=$(nproc --all) FILE_SIZE=0 umount $DEV &> /dev/null mkfs.btrfs -f $MKFS_OPTIONS $DEV mount $MOUNT_OPTIONS $DEV $MNT OPTS="-S 0 -L 6 -n $FILES -s $FILE_SIZE -t $THREADS -k" for ((i = 1; i <= $THREADS; i++)); do OPTS="$OPTS -d $MNT/d$i" done fs_mark $OPTS umount $MNT Results before applying patchset: FSUse% Count Size Files/sec App Overhead 2 1200000 0 174472.0 11549868 4 2400000 0 253503.0 11694618 4 3600000 0 257833.1 11611508 6 4800000 0 247089.5 11665983 6 6000000 0 211296.1 12121244 10 7200000 0 187330.6 12548565 Results after applying patchset: FSUse% Count Size Files/sec App Overhead 2 1200000 0 207556.0 11393252 4 2400000 0 266751.1 11347909 4 3600000 0 274397.5 11270058 6 4800000 0 259608.4 11442250 6 6000000 0 238895.8 11635921 8 7200000 0 211942.2 11873825 Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7b00dfffebd4f3444a3ec04d9e4203b7ac1acb47 Author: Filipe Manana Date: Wed Feb 8 17:46:48 2023 +0000 btrfs: eliminate extra call when doing binary search on extent buffer The function btrfs_bin_search() is just a wrapper around the function generic_bin_search(), which passes the same arguments plus a default low slot with a value of 0. This adds an unnecessary extra function call, since btrfs_bin_search() is not static. So improve on this by making btrfs_bin_search() an inline function that calls generic_bin_search(), renaming the later to btrfs_generic_bin_search() and exporting it. Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 08241d3c745ed7c6de8a762c0737b337c68a6c87 Author: Christoph Hellwig Date: Wed Jan 11 07:23:34 2023 +0100 btrfs: raid56: handle endio in scrub_rbio The only caller of scrub_rbio calls rbio_orig_end_io right after it, move it into scrub_rbio to match the other work item helpers. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 40f87ddb5dbe43fb209901815d24e3e718aef155 Author: Christoph Hellwig Date: Wed Jan 11 07:23:33 2023 +0100 btrfs: raid56: handle endio in recover_rbio Both callers of recover_rbio call rbio_orig_end_io right after it, so move the call into the shared function. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1d0ef1ca119f1a1fbcf5be5acce407147cb15245 Author: Christoph Hellwig Date: Wed Jan 11 07:23:32 2023 +0100 btrfs: raid56: handle endio in rmw_rbio Both callers of rmv_rbio call rbio_orig_end_io right after it, so move the call into the shared function. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 52f0c198645c68b80536384b7e666c4c56777b5e Author: Christoph Hellwig Date: Wed Jan 11 07:23:31 2023 +0100 btrfs: raid56: submit the read bios from scrub_assemble_read_bios Instead of filling in a bio_list and submitting the bios in the only caller, do that in scrub_assemble_read_bios. This removes the need to pass the bio_list, and also makes it clear that the extra bio_list cleanup in the caller is entirely pointless. Rename the function to scrub_read_bios to make it clear that the bios are not only assembled. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 02efa3a6baffdd753dc04034c848a5956784422d Author: Christoph Hellwig Date: Wed Jan 11 07:23:30 2023 +0100 btrfs: raid56: fold rmw_read_wait_recover into rmw_read_bios There is very little extra code in rmw_read_bios, and a large part of it is the superfluous extra cleanup of the bio list. Merge the two functions, and only clean up the bio list after it has been added to but before it has been emptied again by submit_read_wait_bio_list. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit d838d05ea5091044957d664b9f9c38fefcaf6d97 Author: Christoph Hellwig Date: Wed Jan 11 07:23:29 2023 +0100 btrfs: raid56: fold recover_assemble_read_bios into recover_rbio There is very little extra code in recover_rbio, and a large part of it is the superfluous extra cleanup of the bio list. Merge the two functions, and only clean up the bio list after it has been added to but before it has been emptied again by submit_read_wait_bio_list. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 801fcfc5d790f4a9be2897713bd6dd08bed253f1 Author: Christoph Hellwig Date: Wed Jan 11 07:23:28 2023 +0100 btrfs: raid56: add a bio_list_put helper Add a helper to put all bios in a list. This does not need to be added to block layer as there are no other users of such code. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c76fb7b31a43ad8b63faa3c6612b04eb3dea5d6 Author: Christoph Hellwig Date: Wed Jan 11 07:23:27 2023 +0100 btrfs: raid56: wait for I/O completion in submit_read_bios In addition to setting up the end_io handler and submitting the bios in submit_read_bios, also wait for them to be completed instead of waiting for the completion manually in all three callers. Rename submit_read_bios to submit_read_wait_bio_list to make it clear it waits for the bios as well. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4d7627010bc24f68d617c1c455e12a3dfcffcb2c Author: Christoph Hellwig Date: Wed Jan 11 07:23:26 2023 +0100 btrfs: raid56: simplify code flow in rmw_rbio Remove the write goto label by moving the data page allocation and data read into the branch. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit abb49e87425be0d573bdafb9a5dbe2c64719796f Author: Christoph Hellwig Date: Wed Jan 11 07:23:25 2023 +0100 btrfs: raid56: simplify error handling and code flow in raid56_parity_write Handle the error return on alloc_rbio failure directly instead of using a goto and remove the queue_rbio goto label by moving the plugged check into the if branch. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 79b02ec1d8ce1fafc8c39f888dbba6a3aa9a35cc Author: Josef Bacik Date: Thu Jan 26 16:01:00 2023 -0500 btrfs: replace btrfs_wait_tree_block_writeback by wait_on_extent_buffer_writeback This is used in the tree-log code and is a holdover from previous iterations of extent buffer writeback. We can simply use wait_on_extent_buffer_writeback here, and remove btrfs_wait_tree_block_writeback completely as it's equivalent (waiting on page write writeback). Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 98c8d683c291285be35c50579ac984e71d17ddc1 Author: Josef Bacik Date: Thu Jan 26 16:00:59 2023 -0500 btrfs: combine btrfs_clear_buffer_dirty and clear_extent_buffer_dirty btrfs_clear_buffer_dirty just does the test_clear_bit() and then calls clear_extent_buffer_dirty and does the dirty metadata accounting. Combine this into clear_extent_buffer_dirty and make the result btrfs_clear_buffer_dirty. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 190a83391bc40862538572d1313c207c348d356d Author: Josef Bacik Date: Thu Jan 26 16:00:58 2023 -0500 btrfs: rename btrfs_clean_tree_block to btrfs_clear_buffer_dirty btrfs_clean_tree_block is a misnomer, it's just clear_extent_buffer_dirty with some extra accounting around it. Rename this to btrfs_clear_buffer_dirty to make it more clear it belongs with it's setter, btrfs_mark_buffer_dirty. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit f88fd6504329ca8de0a04b6214e932c46746800d Author: Josef Bacik Date: Thu Jan 26 16:00:57 2023 -0500 btrfs: do not increment dirty_metadata_bytes in set_btree_ioerr We only add if we set the extent buffer dirty, and we subtract when we clear the extent buffer dirty. If we end up in set_btree_ioerr we have already cleared the buffer dirty, and we aren't resetting dirty on the extent buffer, so this is simply wrong. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit c4e54a65711688e78e81d6e2720f19f0747eb176 Author: Josef Bacik Date: Thu Jan 26 16:00:56 2023 -0500 btrfs: replace clearing extent buffer dirty bit with btrfs_clean_block Now that we're passing in the trans into btrfs_clean_tree_block, we can easily roll in the handling of the !trans case and replace all occurrences of if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &eb->bflags)) clear_extent_buffer_dirty(eb); with btrfs_tree_lock(eb); btrfs_clean_tree_block(eb); btrfs_tree_unlock(eb); We need the lock because if we are actually dirty we need to make sure we aren't racing with anything that's starting writeout currently. This also makes sure that we're accounting fs_info->dirty_metadata_bytes appropriately. Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit ed25dab3a0d1b14b59a3ad74b9d6bb4f4dca03b8 Author: Josef Bacik Date: Thu Jan 26 16:00:55 2023 -0500 btrfs: add trans argument to btrfs_clean_tree_block We check the header generation in the extent buffer against the current running transaction id to see if it's safe to clear DIRTY on this buffer. Generally speaking if we're clearing the buffer dirty we're holding the transaction open, but in the case of cleaning up an aborted transaction we don't, so we have extra checks in that path to check the transid. To allow for a future cleanup go ahead and pass in the trans handle so we don't have to rely on ->running_transaction being set. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit d3fb66150c05b1b082984c88e6895e663119ac4e Author: Josef Bacik Date: Thu Jan 26 16:00:54 2023 -0500 btrfs: always lock the block before calling btrfs_clean_tree_block We want to clean up the dirty handling for extent buffers so it's a little more consistent, so skip the check for generation == transid and simply always lock the extent buffer before calling btrfs_clean_tree_block. Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 8e81aa16a42169faae1ba15cd648cc8bb83eaa48 Author: Christoph Hellwig Date: Sat Jan 21 07:50:31 2023 +0100 iomap: remove IOMAP_F_ZONE_APPEND No users left now that btrfs takes REQ_OP_WRITE bios from iomap and splits and converts them to REQ_OP_ZONE_APPEND internally. Reviewed-by: Josef Bacik Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit d5e4377d505189c30df50d54f9944d7fb8d528bb Author: Christoph Hellwig Date: Sat Jan 21 07:50:30 2023 +0100 btrfs: split zone append bios in btrfs_submit_bio The current btrfs zoned device support is a little cumbersome in the data I/O path as it requires the callers to not issue I/O larger than the supported ZONE_APPEND size of the underlying device. This leads to a lot of extra accounting. Instead change btrfs_submit_bio so that it can take write bios of arbitrary size and form from the upper layers, and just split them internally to the ZONE_APPEND queue limits. Then remove all the upper layer warts catering to limited write sized on zoned devices, including the extra refcount in the compressed_bio. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 243cf8d1b6737d4b53ac16b211987bbd299478e6 Author: Christoph Hellwig Date: Sat Jan 21 07:50:29 2023 +0100 btrfs: calculate file system wide queue limit for zoned mode To be able to split a write into properly sized zone append commands, we need a queue_limits structure that contains the least common denominator suitable for all devices. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 35a8d7da3ca87d8612fa86a21fab4e07a70d35cb Author: Christoph Hellwig Date: Sat Jan 21 07:50:28 2023 +0100 btrfs: remove now spurious bio submission helpers Call btrfs_submit_bio and btrfs_submit_compressed_read directly from submit_one_bio now that all additional functionality has moved into btrfs_submit_bio. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 285599b6fe15d642df643fd4383ab3a278374e35 Author: Christoph Hellwig Date: Sat Jan 21 07:50:27 2023 +0100 btrfs: remove the fs_info argument to btrfs_submit_bio btrfs_submit_bio can derive it trivially from bbio->inode, so stop bothering in the callers. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 48253076c3a93f795fcd84ffdc97c5e763709dee Author: Christoph Hellwig Date: Sat Jan 21 07:50:26 2023 +0100 btrfs: open code submit_encoded_read_bio Open code the functionality in the only caller and remove the now superfluous error handling there. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit f8a02dc6fd38da3dd045509ec321b2f9130bd003 Author: Christoph Hellwig Date: Sat Jan 21 07:50:25 2023 +0100 btrfs: remove struct btrfs_io_geometry Now that btrfs_get_io_geometry has a single caller, we can massage it into a form that is more suitable for that caller and remove the marshalling into and out of struct btrfs_io_geometry. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit a34e4c3f884cc592f105d214d21baee9f9c6bae8 Author: Qu Wenruo Date: Sat Jan 21 07:50:24 2023 +0100 btrfs: remove stripe boundary calculation for encoded I/O Stop looking at the stripe boundary in btrfs_encoded_read_regular_fill_pages() now that btrfs_submit_bio can split bios. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 30493ff49f81d0ba42286b72498272db1a1ccae6 Author: Qu Wenruo Date: Sat Jan 21 07:50:23 2023 +0100 btrfs: remove stripe boundary calculation for compressed I/O Stop looking at the stripe boundary in alloc_compressed_bio() now that that btrfs_submit_bio can split bios, open code the now trivial code from alloc_compressed_bio() in btrfs_submit_compressed_read and stop maintaining the pending_ios count for reads as there is always just a single bio now. Reviewed-by: Josef Bacik Signed-off-by: Qu Wenruo [hch: remove more cruft in btrfs_submit_compressed_read, use btrfs_zoned_get_device in alloc_compressed_bio] Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 2380220e1e13b2dec4ae6f561841763ed6e1b0c0 Author: Qu Wenruo Date: Sat Jan 21 07:50:22 2023 +0100 btrfs: remove stripe boundary calculation for buffered I/O Remove btrfs_bio_ctrl::len_to_stripe_boundary, so that buffer I/O will no longer limit its bio size according to stripe length now that btrfs_submit_bio can split bios at stripe boundaries. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Qu Wenruo [hch: simplify calc_bio_boundaries a little more] Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 67d66982509043962cf15457051e1b840578a323 Author: Christoph Hellwig Date: Sat Jan 21 07:50:21 2023 +0100 btrfs: pass the iomap bio to btrfs_submit_bio Now that btrfs_submit_bio splits the bio when crossing stripe boundaries, there is no need for the higher level code to do that manually. For direct I/O this is really helpful, as btrfs_submit_io can now simply take the bio allocated by iomap and send it on to btrfs_submit_bio instead of allocating clones. For that to work, the bio embedded into struct btrfs_dio_private needs to become a full btrfs_bio as expected by btrfs_submit_bio. With this change there is a single work item to offload the entire iomap bio so the heuristics to skip async processing for bios that were split isn't needed anymore either. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 852eee62d31abd695cd43e1b875d664ed292a8ca Author: Christoph Hellwig Date: Sat Jan 21 07:50:20 2023 +0100 btrfs: allow btrfs_submit_bio to split bios Currently the I/O submitters have to split bios according to the chunk stripe boundaries. This leads to extra lookups in the extent trees and a lot of boilerplate code. To drop this requirement, split the bio when __btrfs_map_block returns a mapping that is smaller than the requested size and keep a count of pending bios in the original btrfs_bio so that the upper level completion is only invoked when all clones have completed. Based on a patch from Qu Wenruo. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 542e300e8398ea529a4a20a125c77d234d5ca37e Author: Christoph Hellwig Date: Sat Jan 21 07:50:19 2023 +0100 btrfs: support cloned bios in btree_csum_one_bio To allow splitting bios in btrfs_submit_bio, btree_csum_one_bio needs to be able to handle cloned bios. As btree_csum_one_bio is always called before handing the bio to the block layer that is trivially done by using bio_for_each_segment instead of bio_for_each_segment_all. Also switch the function to take a btrfs_bio and use that to derive the fs_info. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 69ccf3f4244abc5f6d73ca5d8caf6b42a1db42c6 Author: Christoph Hellwig Date: Sat Jan 21 07:50:18 2023 +0100 btrfs: handle recording of zoned writes in the storage layer Move the code that splits the ordered extents and records the physical location for them to the storage layer so that the higher level consumers don't have to care about physical block numbers at all. This will also allow to eventually remove accounting for the zone append write sizes in the upper layer with a little bit more block layer work. Reviewed-by: Naohiro Aota Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit f8a53bb58ec7e2150f9b03f210675ba3e6d8b919 Author: Christoph Hellwig Date: Sat Jan 21 07:50:17 2023 +0100 btrfs: handle checksum generation in the storage layer Instead of letting the callers of btrfs_submit_bio deal with checksumming the (meta)data in the bio and making decisions on when to offload the checksumming to the bio, leave that to btrfs_submit_bio. Do do so the existing btrfs_submit_bio function is split into an upper and a lower half, so that the lower half can be offloaded to a workqueue. Note that this changes the behavior for direct writes to raid56 volumes so that async checksum offloading is not skipped when more I/O is expected. This runs counter to the argument explaining why it was done, although I can't measure any affects of the change. Commits later in this series will make sure the entire direct writes is offloaded to the workqueue at once and thus make sure it is sent to the raid56 code from a single thread. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit f8c44673e5a5f5131773d4a6974fb8ea4db033f8 Author: Christoph Hellwig Date: Sat Jan 21 07:50:16 2023 +0100 btrfs: simplify the btrfs_csum_one_bio calling convention To prepare for further bio submission changes btrfs_csum_one_bio should be able to take all it's arguments from the btrfs_bio structure. It can always use the bbio->inode already, and once the compression code is updated to set ->file_offset that one can be used unconditionally as well instead of looking at the page mapping now that btrfs doesn't allow ordered extents to span discontiguous data ranges. The only slightly tricky bit is the one_ordered flag set by the compressed writes. Replace that one with the driver private bio flag, which gets cleared before the bio is handed off to the block layer so that we don't get in the way of driver use. Note: this leaves an argument and a flag to btrfs_wq_submit_bio unused. But that whole mechanism will be removed in its current form in the next patch. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit deb6216fa0b6b66304fc81e19b509af1b8203f98 Author: Christoph Hellwig Date: Sat Jan 21 07:50:15 2023 +0100 btrfs: open code the submit_bio_start helpers The submit helpers are now trivial and can be called directly. Note that btree_csum_one_bio has to be moved up in the file a bit to avoid a forward declaration. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 295fe46ff19b990c19b84b0d39a88d7e73710b19 Author: Christoph Hellwig Date: Sat Jan 21 07:50:14 2023 +0100 btrfs: remove struct btrfs_bio::is_metadata flag This flag is unused now, so remove it. Re-expand the mirror_num field to 8 bits, and move it to the I/O completion internal section of the structure. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0d3acb25e70d5f58f99ae9c695326a097b4b56be Author: Christoph Hellwig Date: Sat Jan 21 07:50:13 2023 +0100 btrfs: rename btrfs_bio::iter field Rename iter to saved_iter and move it next to the repair internals and nothing outside of bio.c should be touching it. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0571b6357c5e414cd5db8e03150074a5ca1c5c12 Author: Christoph Hellwig Date: Sat Jan 21 07:50:12 2023 +0100 btrfs: remove the io_failure_record infrastructure struct io_failure_record and the io_failure_tree tree are unused now, so remove them. This in turn makes struct btrfs_inode smaller by 16 bytes. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 860c8c451661c72f05713ffdef3707f1fa9184d1 Author: Christoph Hellwig Date: Sat Jan 21 07:50:11 2023 +0100 btrfs: remove struct btrfs_bio::device field The device field is only used by the simple end I/O handler, and for that it can simply be stored in the bi_private field of the bio, which is currently used for the fs_info that can be retrieved through bbio->inode as well. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3d49d0d31237d11268959c7873c56aab166be07b Author: Christoph Hellwig Date: Sat Jan 21 07:50:10 2023 +0100 btrfs: remove now unused checksumming helpers Remove the unused btrfs_verify_data_csum helper, and fold btrfs_check_data_csum into its only caller. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit ac9f942e86941e8e615b04f791214cc04acd09d0 Author: Christoph Hellwig Date: Sat Jan 21 07:50:09 2023 +0100 btrfs: remove btrfs_bio_for_each_sector btrfs_bio_for_each_sector is unused now, so remove it. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7ab0fdfc810209fc493f2f67bdd41d5aafbc3a05 Author: Christoph Hellwig Date: Sat Jan 21 07:50:08 2023 +0100 btrfs: open code btrfs_bio_free_csum btrfs_bio_free_csum has only one caller left, and that caller is always for an data inode and doesn't need zeroing of the csum pointer as that pointer will never be touched again. Just open code the conditional kfree there. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7609afac677546b225d8327d726cc558d3666496 Author: Christoph Hellwig Date: Sat Jan 21 07:50:07 2023 +0100 btrfs: handle checksum validation and repair at the storage layer Currently btrfs handles checksum validation and repair in the end I/O handler for the btrfs_bio. This leads to a lot of duplicate code plus issues with varying semantics or bugs, e.g. - the until recently broken repair for compressed extents - the fact that encoded reads validate the checksums but do not kick of read repair - the inconsistent checking of the BTRFS_FS_STATE_NO_CSUMS flag This commit revamps the checksum validation and repair code to instead work below the btrfs_submit_bio interfaces. In case of a checksum failure (or a plain old I/O error), the repair is now kicked off before the upper level ->end_io handler is invoked. Progress of an in-progress repair is tracked by a small structure that is allocated using a mempool for each original bio with failed sectors, which holds a reference to the original bio. This new structure is allocated using a mempool to guarantee forward progress even under memory pressure. The mempool will be replenished when the repair completes, just as the mempools backing the bios. There is one significant behavior change here: If repair fails or is impossible to start with, the whole bio will be failed to the upper layer. This is the behavior that all I/O submitters except for buffered I/O already emulated in their end_io handler. For buffered I/O this now means that a large readahead request can fail due to a single bad sector, but as readahead errors are ignored the following readpage if the sector is actually accessed will still be able to read. This also matches the I/O failure handling in other file systems. Reviewed-by: Josef Bacik Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit e52190441bd6b268aed6ecc0efe3614c4222014e Author: Christoph Hellwig Date: Sat Jan 21 07:50:06 2023 +0100 btrfs: add a btrfs_data_csum_ok helper Add a new checksumming helper that wraps btrfs_check_data_csum and does all the checks to if we're dealing with some form of nodatacsum I/O. This helper will be used by the new storage layer checksum validation and repair code. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c2b3ee3b0ec4bc971e23fe18d4c92333a6ad18a Author: Christoph Hellwig Date: Sat Jan 21 07:50:05 2023 +0100 btrfs: pre-load data checksum for reads in btrfs_submit_bio Instead of calling btrfs_lookup_bio_sums in every caller of btrfs_submit_bio that reads data, do the call once in btrfs_submit_bio. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7276aa7d38255b40e578267c3634ebc05f5d5236 Author: Christoph Hellwig Date: Sat Jan 21 07:50:04 2023 +0100 btrfs: save the bio iter for checksum validation in common code All callers of btrfs_submit_bio that want to validate checksums currently have to store a copy of the iter in the btrfs_bio. Move the assignment into common code. Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9ba0004bd95e059983b4ca8defad82ab41627e51 Author: Christoph Hellwig Date: Sat Jan 21 07:50:03 2023 +0100 btrfs: refactor error handling in btrfs_submit_bio Add a bbio local variable and to prepare for calling functions that return a blk_status_t, rename the existing int used for error handling so that ret can be reused for the blk_status_t, and a label that can be reused for failing the passed in bio. Reviewed-by: Anand Jain Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4ae2edf12d49fdbaea2dfda0bb2ec06501bd3493 Author: Christoph Hellwig Date: Sat Jan 21 07:50:02 2023 +0100 btrfs: simplify parameters of btrfs_lookup_bio_sums The csums argument is always NULL now, so remove it and always allocate the csums array in the btrfs_bio. Also pass the btrfs_bio instead of inode + bio to document that this function requires a btrfs_bio and not just any bio. Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5fa356531e33e7c7783ccd0d7938a070b5df8c22 Author: Christoph Hellwig Date: Sat Jan 21 07:50:01 2023 +0100 btrfs: remove the direct I/O read checksum lookup optimization To prepare for pending changes drop the optimization to only look up csums once per bio that is submitted from the iomap layer. In the short run this does cause additional lookups for fragmented direct reads, but later in the series, the bio based lookup will be used on the entire bio submitted from iomap, restoring the old behavior in common code. Reviewed-by: Anand Jain Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit d0e5cb2be7703172d98699275d722c4081241144 Author: Christoph Hellwig Date: Sat Jan 21 07:50:00 2023 +0100 btrfs: add a btrfs_inode pointer to struct btrfs_bio All btrfs_bio I/Os are associated with an inode. Add a pointer to that inode, which will allow to simplify a lot of calling conventions, and which will be needed in the I/O completion path in the future. This grow the btrfs_bio structure by a pointer, but that grows will be offset by the removal of the device pointer soon. Reviewed-by: Anand Jain Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit e0cfbb2ccabbeaea9e6b3b203d83edca49c702b2 Author: Christoph Hellwig Date: Sat Jan 21 07:49:59 2023 +0100 btrfs: better document struct btrfs_bio Update the comments on btrfs_bio to better describe the structure. Reviewed-by: Anand Jain Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit fd8f8ede239bc0531aca65f408ecf44d6755c558 Author: Christoph Hellwig Date: Sat Jan 21 07:49:58 2023 +0100 block: export bio_split_rw bio_split_rw can be used by file systems to split and incoming write bio into multiple bios fitting the hardware limit for use as ZONE_APPEND bios. Export it for initial use in btrfs. Reviewed-by: Josef Bacik Reviewed-by: Chaitanya Kulkarni Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit c9a43aaf0971660e388b794feb0db4649746390a Author: Qu Wenruo Date: Sat Jan 21 16:06:12 2023 +0800 btrfs: raid56: reduce overhead to calculate the bio length In rbio_update_error_bitmap(), we need to calculate the length of the rbio. As since it's called in the endio function, we can not directly grab the length from bi_iter. Currently we call bio_for_each_segment_all(), which will always return a range inside a page. But that's not necessary as we don't really care about anything inside the page. So use bio_for_each_bvec_all(), which can return a bvec across multiple continuous pages thus reduce the loops. Reviewed-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 67da05b3f28166b24316ecf675637f9b77661983 Author: Colin Ian King Date: Tue Jan 17 10:03:21 2023 +0000 btrfs: fix spelling mistakes found using codespell There quite a few spelling mistakes as found using codespell. Fix them. Signed-off-by: Colin Ian King Reviewed-by: David Sterba Signed-off-by: David Sterba commit e2fd83064a9bae368ce1c88a0cb9aee64ad4e124 Author: Filipe Manana Date: Tue Jan 17 11:21:39 2023 +0000 btrfs: skip backref walking during fiemap if we know the leaf is shared During fiemap, when checking if a data extent is shared we are doing the backref walking even if we already know the leaf is shared, which is a waste of time since if the leaf shared then the data extent is also shared. So skip the backref walking when we know we are in a shared leaf. The following test was measures the gains for a case where all leaves are shared due to a snapshot: $ cat test.sh #!/bin/bash DEV=/dev/sdj MNT=/mnt/sdj umount $DEV &> /dev/null mkfs.btrfs -f $DEV # Use compression to quickly create files with a lot of extents # (each with a size of 128K). mount -o compress=lzo $DEV $MNT # 40G gives 327680 extents, each with a size of 128K. xfs_io -f -c "pwrite -S 0xab -b 1M 0 40G" $MNT/foobar # Add some more files to increase the size of the fs and extent # trees (in the real world there's a lot of files and extents # from other files). xfs_io -f -c "pwrite -S 0xcd -b 1M 0 20G" $MNT/file1 xfs_io -f -c "pwrite -S 0xef -b 1M 0 20G" $MNT/file2 xfs_io -f -c "pwrite -S 0x73 -b 1M 0 20G" $MNT/file3 # Create a snapshot so all the extents become indirectly shared # through subtrees, with a generation less than or equals to the # generation used to create the snapshot. btrfs subvolume snapshot -r $MNT $MNT/snap1 # Unmount and mount again to clear cached metadata. umount $MNT mount -o compress=lzo $DEV $MNT start=$(date +%s%N) # The filefrag tool uses the fiemap ioctl. filefrag $MNT/foobar end=$(date +%s%N) dur=$(( (end - start) / 1000000 )) echo "fiemap took $dur milliseconds (metadata not cached)" echo start=$(date +%s%N) filefrag $MNT/foobar end=$(date +%s%N) dur=$(( (end - start) / 1000000 )) echo "fiemap took $dur milliseconds (metadata cached)" umount $MNT The results were the following on a non-debug kernel (Debian's default kernel config). Before this patch: (...) /mnt/sdi/foobar: 327680 extents found fiemap took 1821 milliseconds (metadata not cached) /mnt/sdi/foobar: 327680 extents found fiemap took 399 milliseconds (metadata cached) After this patch: (...) /mnt/sdi/foobar: 327680 extents found fiemap took 591 milliseconds (metadata not cached) /mnt/sdi/foobar: 327680 extents found fiemap took 123 milliseconds (metadata cached) That's a speedup of 3.1x and 3.2x. Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 4e4488d4efd56951e6c1c0f60f1fc8e0f93b7964 Author: Filipe Manana Date: Tue Jan 17 11:21:38 2023 +0000 btrfs: assert commit root semaphore is held when accessing backref cache During fiemap, when accessing the cache that stores the sharedness of an extent, we need to either be holding a transaction handle or the commit root semaphore. I left comments about this in the comment that precedes store_backref_shared_cache() and lookup_backref_shared_cache(), but have actually not enforced it through assertions. So assert that the commit root semaphore is held if we are not holding a transaction handle. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2b5463fcbdfb24e898916bcae2b1359042d26963 Author: Boris Burkov Date: Thu Jan 12 16:05:11 2023 -0800 btrfs: hold block group refcount during async discard Async discard does not acquire the block group reference count while it holds a reference on the discard list. This is generally OK, as the paths which destroy block groups tend to try to synchronize on cancelling async discard work. However, relying on cancelling work requires careful analysis to be sure it is safe from races with unpinning scheduling more work. While I am unable to find a race with unpinning in the current code for either the unused bgs or relocation paths, I believe we have one in an older version of auto relocation in a Meta internal build. This suggests that this is in fact an error prone model, and could be fragile to future changes to these bg deletion paths. To make this ownership more clear, add a refcount for async discard. If work is queued for a block group, its refcount should be incremented, and when work is completed or canceled, it should be decremented. CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 3e49363be6330f49e670240e8f46e6fe0bf5628a Author: Filipe Manana Date: Wed Jan 11 11:36:20 2023 +0000 btrfs: send: cache utimes operations for directories if possible Whenever we add or remove an entry to a directory, we issue an utimes command for the directory. If we add 1000 entries to a directory (create 1000 files under it or move 1000 files to it), then we issue the same utimes command 1000 times, which increases the send stream size, results in more pipe IO, one search in the send b+tree, allocating one path for the search, etc, as well as making the receiver do a system call for each duplicated utimes command. We also issue an utimes command when we create a new directory, but later we might add entries to it corresponding to inodes with an higher inode number, so it's pointless to issue the utimes command before we create the last inode under the directory. So use a lru cache to track directories for which we must send a utimes command. When we need to remove an entry from the cache, we issue the utimes command for the respective directory. When finishing the send operation, we go over each cache element and issue the respective utimes command. Finally the caching is entirely optional, just a performance optimization, meaning that if we fail to cache (due to memory allocation failure), we issue the utimes command right away, that is, we fallback to the previous, unoptimized, behaviour. This patch belongs to a patchset comprised of the following patches: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible The following test was run before and after applying the whole patchset, and on a non-debug kernel (Debian's default kernel config): #!/bin/bash MNT=/mnt/sdi DEV=/dev/sdi mkfs.btrfs -f $DEV > /dev/null mount $DEV $MNT mkdir $MNT/A for ((i = 1; i <= 20000; i++)); do echo -n > $MNT/A/file_$i done btrfs subvolume snapshot -r $MNT $MNT/snap1 mkdir $MNT/B for ((i = 20000; i <= 40000; i++)); do echo -n > $MNT/B/file_$i done mv $MNT/A/file_* $MNT/B/ btrfs subvolume snapshot -r $MNT $MNT/snap2 start=$(date +%s%N) btrfs send -p $MNT/snap1 $MNT/snap2 > /dev/null end=$(date +%s%N) dur=$(( (end - start) / 1000000 )) echo "Incremental send took $dur milliseconds" umount $MNT Before the whole patchset: 18408 milliseconds After the whole patchset: 1942 milliseconds (9.5x speedup) Using 60000 files instead of 40000: Before the whole patchset: 39764 milliseconds After the whole patchset: 3076 milliseconds (12.9x speedup) Using 20000 files instead of 40000: Before the whole patchset: 5072 milliseconds After the whole patchset: 916 milliseconds (5.5x speedup) Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ace79df8a44ae1f668615c7177fa1a7bdc04af7e Author: Filipe Manana Date: Wed Jan 11 11:36:19 2023 +0000 btrfs: send: update size of roots array for backref cache entries Currently we limit the size of the roots array, for backref cache entries, to 12 elements. This is because that number is enough for most cases and to make the backref cache entry size to be exactly 128 bytes, so that memory is allocated from the kmalloc-128 slab and no space is wasted. However recent changes in the series refactored the backref cache to be more generic and allow it to be reused for other purposes, which resulted in increasing the size of the embedded structure btrfs_lru_cache_entry in order to allow for supporting inode numbers as keys on 32 bits system and allow multiple generations per key. This resulted in increasing the size of struct backref_cache_entry from 128 bytes to 152 bytes. Since the cache entries are allocated with kmalloc(), it means we end up using the slab kmalloc-192, so we end up wasting 40 bytes of memory. So bump the size of the roots array from 12 elements to 17 elements, so we end up using 192 bytes for each backref cache entry. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c48545debfff5624a1dd2581f6f8f2fa7fb5f287 Author: Filipe Manana Date: Wed Jan 11 11:36:18 2023 +0000 btrfs: send: use the lru cache to implement the name cache The name cache in send is basically a lru cache implemented with a radix tree and linked lists, very similar to the lru cache module which is used for the send backref cache and the cache of previously created directories during a send operation. So remove all the custom caching code for the name cache and make it use the lru cache instead. One particular detail to note is that the current cache behaves a bit differently when it comes to eviction of entries. Namely when after inserting a new name in the cache, if the cache now has 256 entries, we evict the last 128 LRU entries. The lru_cache.{c,h} module behaves a bit differently in that once we reach the cache limit, we evict a single LRU entry. In practice this doesn't make much difference, but it's actually better to evict just one entry instead of half of the entries, as there's always a chance we will need a name stored in one of that last 128 removed entries. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit c620f4d5b25bcbb851daa1f88edc764cf5f29cb6 Author: Saranya Gopal Date: Tue Feb 14 17:15:43 2023 +0530 usb: typec: pd: Add higher capability sysfs for sink PDO 28th bit of fixed supply sink PDO represents higher capability. When this bit is set, the sink device needs more than vsafe5V (eg: 12 V) to provide full functionality. This patch adds this higher capability sysfs interface for sink PDO. 28th bit of fixed supply source PDO represents usb_suspend_supported attribute. This usb_suspend_supported sysfs is already exposed for source PDOs. This patch adds 'source-capabilities' in usb_suspend_supported sysfs documentation for additional clarity. Signed-off-by: Saranya Gopal Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230214114543.205103-2-saranya.gopal@intel.com Signed-off-by: Greg Kroah-Hartman commit e4e7b2dc27c4bb877d850eaff69d41410b2f4237 Author: Saranya Gopal Date: Tue Feb 14 17:15:42 2023 +0530 usb: typec: pd: Remove usb_suspend_supported sysfs from sink PDO As per USB PD specification, 28th bit of fixed supply sink PDO represents "higher capability" attribute and not "usb suspend supported" attribute. So, this patch removes the usb_suspend_supported attribute from sink PDO. Fixes: 662a60102c12 ("usb: typec: Separate USB Power Delivery from USB Type-C") Cc: stable Reported-by: Rajaram Regupathy Signed-off-by: Saranya Gopal Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230214114543.205103-1-saranya.gopal@intel.com Signed-off-by: Greg Kroah-Hartman commit 8e5248c3a8778f3e394e9a19195bc7a48f567ca2 Author: Heikki Krogerus Date: Wed Feb 15 15:27:11 2023 +0200 usb: dwc3: pci: add support for the Intel Meteor Lake-M This patch adds the necessary PCI IDs for Intel Meteor Lake-M devices. Signed-off-by: Heikki Krogerus Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230215132711.35668-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit ddf1eca4fc5a4038cb323306f51fbba34ce3f4d2 Author: Yangtao Li Date: Wed Feb 15 14:17:01 2023 +0800 f2fs: drop unnecessary arg for f2fs_ioc_*() They are not used, let's remove them. Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c7dbc06688292db34c1bb9c715e29ac4935af994 Author: Jaegeuk Kim Date: Tue Feb 14 15:53:52 2023 -0800 f2fs: Revert "f2fs: truncate blocks in batch in __complete_revoke_list()" We should not truncate replaced blocks, and were supposed to truncate the first part as well. This reverts commit 78a99fe6254cad4be310cd84af39f6c46b668c72. Cc: stable@vger.kernel.org Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e4922088f8e90ea163281ba8e69b98f34a7a1b83 Merge: 33436335e93a1 5fc5b94a27365 Author: Paolo Bonzini Date: Wed Feb 15 12:35:26 2023 -0500 Merge tag 'kvm-s390-next-6.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD * Two more V!=R patches * The last part of the cmpxchg patches * A few fixes commit 33436335e93a1788a58443fc99c5ab320ce4b9d9 Merge: 27b025ebb0f60 c39cea6f38eef Author: Paolo Bonzini Date: Wed Feb 15 12:33:28 2023 -0500 Merge tag 'kvm-riscv-6.3-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.3 - Fix wrong usage of PGDIR_SIZE to check page sizes - Fix privilege mode setting in kvm_riscv_vcpu_trap_redirect() - Redirect illegal instruction traps to guest - SBI PMU support for guest commit 3caf31e7b18a90b74a2709d761a0dfa423f2c2e4 Author: Johannes Berg Date: Wed Feb 15 18:30:26 2023 +0100 wifi: mac80211: add documentation for amsdu_mesh_control This documentation wasn't added in the original patch, add it now. Reported-by: Stephen Rothwell Fixes: 6e4c0d0460bd ("wifi: mac80211: add a workaround for receiving non-standard mesh A-MSDU") Signed-off-by: Johannes Berg commit 4048a6a7380c8be2f06c1c386dd63d1bd3cdb0a0 Author: Lorenzo Bianconi Date: Wed Feb 15 10:32:07 2023 +0100 wifi: cfg80211: remove gfp parameter from cfg80211_obss_color_collision_notify description Get rid of gfp parameter from cfg80211_obss_color_collision_notify routine description. Fixes: 935ef47b16cc ("wifi: cfg80211: get rid of gfp in cfg80211_bss_color_notify") Reported-by: Stephen Rothwell Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/2da652e2cd5c7903191091ae9757718f1be802a1.1676453359.git.lorenzo@kernel.org Signed-off-by: Johannes Berg commit ab5f171e36063b33aba1dd4c7c6d5031b00b42aa Author: Johannes Berg Date: Wed Feb 15 10:40:41 2023 +0100 wifi: mac80211: always initialize link_sta with sta When we have multiple interfaces receiving the same frame, such as a multicast frame, one interface might have a sta and the other not. In this case, link_sta would be set but not cleared again. Always set link_sta, so we keep an invariant that link_sta and sta are either both set or both not set. Signed-off-by: Johannes Berg commit 0d846bdc11101ac0ba4d89c2be359af08cb9379b Author: Johannes Berg Date: Wed Feb 15 10:07:05 2023 +0100 wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() There's at least one case in ieee80211_rx_for_interface() where we might pass &((struct sta_info *)NULL)->sta to it only to then do container_of(), and then checking the result for NULL, but checking the result of container_of() for NULL looks really odd. Fix this by just passing the struct sta_info * instead. Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Signed-off-by: Johannes Berg commit c38c701851011c94ce3be1ccb3593678d2933fd8 Author: Marc Bornand Date: Wed Feb 15 08:47:53 2023 +0000 wifi: cfg80211: Set SSID if it is not already set When a connection was established without going through NL80211_CMD_CONNECT, the ssid was never set in the wireless_dev struct. Now we set it in __cfg80211_connect_result() when it is not already set. When using a userspace configuration that does not call cfg80211_connect() (can be checked with breakpoints in the kernel), this patch should allow `networkctl status device_name` to output the SSID instead of null. Cc: stable@vger.kernel.org Reported-by: Yohan Prod'homme Fixes: 7b0a0e3c3a88 (wifi: cfg80211: do some rework towards MLO link APIs) Link: https://bugzilla.kernel.org/show_bug.cgi?id=216711 Signed-off-by: Marc Bornand Signed-off-by: Johannes Berg commit 62d101d5f422cde39b269f7eb4cbbe2f1e26f9d4 Author: Alexei Starovoitov Date: Tue Feb 14 15:50:51 2023 -0800 selftests/bpf: Fix map_kptr test. The compiler is optimizing out majority of unref_ptr read/writes, so the test wasn't testing much. For example, one could delete '__kptr' tag from 'struct prog_test_ref_kfunc __kptr *unref_ptr;' and the test would still "pass". Convert it to volatile stores. Confirmed by comparing bpf asm before/after. Fixes: 2cbc469a6fc3 ("selftests/bpf: Add C tests for kptr") Signed-off-by: Alexei Starovoitov Acked-by: Stanislav Fomichev Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20230214235051.22938-1-alexei.starovoitov@gmail.com Signed-off-by: Martin KaFai Lau commit 27b025ebb0f6092d5c0a88de2ab73545bc1c496e Merge: 4bc6dcaa159b7 93827a0a36396 Author: Paolo Bonzini Date: Wed Feb 15 12:23:19 2023 -0500 Merge tag 'kvm-x86-vmx-6.3' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.3: - Handle NMI VM-Exits before leaving the noinstr region - A few trivial cleanups in the VM-Enter flows - Stop enabling VMFUNC for L1 purely to document that KVM doesn't support EPTP switching (or any other VM function) for L1 - Fix a crash when using eVMCS's enlighted MSR bitmaps commit 4bc6dcaa159b77ecc2c0c657433c3f5c8a657711 Merge: e84183f68edb7 f94f053aa3a5d Author: Paolo Bonzini Date: Wed Feb 15 12:23:06 2023 -0500 Merge tag 'kvm-x86-svm-6.3' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.3: - Fix a mostly benign overflow bug in SEV's send|receive_update_data() - Move the SVM-specific "host flags" into vcpu_svm (extracted from the vNMI enabling series) - A handful for fixes and cleanups commit 4ab3a086d10eeec1424f2e8a968827a6336203df Author: Pietro Borrello Date: Sun Feb 12 19:00:03 2023 +0000 HID: asus: use spinlock to safely schedule workers Use spinlocks to deal with workers introducing a wrapper asus_schedule_work(), and several spinlock checks. Otherwise, asus_kbd_backlight_set() may schedule led->work after the structure has been freed, causing a use-after-free. Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-5-7860c5763c38@diag.uniroma1.it Signed-off-by: Benjamin Tissoires commit 315c537068a13f0b5681d33dd045a912f4bece6f Author: Pietro Borrello Date: Sun Feb 12 19:00:02 2023 +0000 HID: asus: use spinlock to protect concurrent accesses asus driver has a worker that may access data concurrently. Proct the accesses using a spinlock. Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-4-7860c5763c38@diag.uniroma1.it Signed-off-by: Benjamin Tissoires commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 Author: Pietro Borrello Date: Sun Feb 12 19:00:01 2023 +0000 HID: bigben: use spinlock to safely schedule workers Use spinlocks to deal with workers introducing a wrapper bigben_schedule_work(), and several spinlock checks. Otherwise, bigben_set_led() may schedule bigben->worker after the structure has been freed, causing a use-after-free. Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it Signed-off-by: Benjamin Tissoires commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b Author: Pietro Borrello Date: Sun Feb 12 19:00:00 2023 +0000 HID: bigben_worker() remove unneeded check on report_field bigben_worker() checks report_field to be non-NULL. The check has been added in commit 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") to prevent a NULL pointer crash. However, the true root cause was a missing check for output reports, patched in commit c7bf714f8755 ("HID: check empty report_list in bigben_probe()"), where the type-confused report list_entry was overlapping with a NULL pointer, which was then causing the crash. Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@diag.uniroma1.it Signed-off-by: Benjamin Tissoires commit 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 Author: Pietro Borrello Date: Sun Feb 12 18:59:59 2023 +0000 HID: bigben: use spinlock to protect concurrent accesses bigben driver has a worker that may access data concurrently. Proct the accesses using a spinlock. Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") Signed-off-by: Pietro Borrello Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-1-7860c5763c38@diag.uniroma1.it Signed-off-by: Benjamin Tissoires commit 8843e06f67b14f71c044bf6267b2387784c7e198 Author: Mukesh Ojha Date: Tue Feb 14 17:36:43 2023 +0530 ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages(): rb_check_pages() rb_handle_head_page(): -------- -------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking. [1] and [2] are the test to reproduce and the crash report respectively. 1: ``` read_trace.sh while true; do # the "trace" file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ``` 2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Call Trace: ring_buffer_lock_reserve+0x136/0x360 ? __do_softirq+0x287/0x2df ? __pfx_rcu_softirq_qs+0x10/0x10 trace_function+0x21/0x110 ? __pfx_rcu_softirq_qs+0x10/0x10 ? __do_softirq+0x287/0x2df function_trace_call+0xf6/0x120 0xffffffffc038f097 ? rcu_softirq_qs+0x5/0x140 rcu_softirq_qs+0x5/0x140 __do_softirq+0x287/0x2df run_ksoftirqd+0x2a/0x30 smpboot_thread_fn+0x188/0x220 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0xe7/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 ---[ end trace 0000000000000000 ]--- [ crash report and test reproducer credit goes to Zheng Yejian] Link: https://lore.kernel.org/linux-trace-kernel/1676376403-16462-1-git-send-email-quic_mojha@quicinc.com Cc: Cc: stable@vger.kernel.org Fixes: 1039221cc278 ("ring-buffer: Do not disable recording when there is an iterator") Reported-by: Zheng Yejian Signed-off-by: Mukesh Ojha Signed-off-by: Steven Rostedt (Google) commit 5e53e5c7edc6d69b8cb48b3b370cfe531e4b4132 Author: Björn Töpel Date: Tue Feb 14 17:12:53 2023 +0100 selftests/bpf: Cross-compile bpftool When the BPF selftests are cross-compiled, only the a host version of bpftool is built. This version of bpftool is used on the host-side to generate various intermediates, e.g., skeletons. The test runners are also using bpftool, so the Makefile will symlink bpftool from the selftest/bpf root, where the test runners will look the tool: | $(Q)ln -sf $(if $2,..,.)/tools/build/bpftool/bootstrap/bpftool \ | $(OUTPUT)/$(if $2,$2/)bpftool There are two problems for cross-compilation builds: 1. There is no native (cross-compilation target) of bpftool 2. The bootstrap/bpftool is never cross-compiled (by design) Make sure that a native/cross-compiled version of bpftool is built, and if CROSS_COMPILE is set, symlink the native/non-bootstrap version. Acked-by: Quentin Monnet Signed-off-by: Björn Töpel Link: https://lore.kernel.org/r/20230214161253.183458-1-bjorn@kernel.org Signed-off-by: Alexei Starovoitov commit 213aacb8a27b1a550edc7641aed818cffa8354b9 Author: David Vernet Date: Tue Feb 14 16:35:53 2023 -0600 bpf, docs: Add myself to BPF docs MAINTAINERS entry In commit 7e2a9ebe8126 ("docs, bpf: Ensure IETF's BPF mailing list gets copied for ISA doc changes"), a new MAINTAINERS entry was added for any BPF IETF documentation updates for the ongoing standardization process. I've been making it a point to try and review as many BPF documentation patches as possible, and have made a committment to Alexei to consistently review BPF standardization patches going forward. This patch adds my name as a reviewer to the MAINTAINERS entry for the standardization effort. Signed-off-by: David Vernet Link: https://lore.kernel.org/r/20230214223553.78353-1-void@manifault.com Signed-off-by: Alexei Starovoitov commit 524581d1216411a807d34181cb880d991fcb4b96 Author: Tiezhu Yang Date: Wed Feb 15 19:01:07 2023 +0800 selftests/bpf: Fix build error for LoongArch There exists build error when make -C tools/testing/selftests/bpf/ on LoongArch: BINARY test_verifier In file included from test_verifier.c:27: tools/include/uapi/linux/bpf_perf_event.h:14:28: error: field 'regs' has incomplete type 14 | bpf_user_pt_regs_t regs; | ^~~~ make: *** [Makefile:577: tools/testing/selftests/bpf/test_verifier] Error 1 make: Leaving directory 'tools/testing/selftests/bpf' Add missing uapi header for LoongArch to use the following definition: typedef struct user_pt_regs bpf_user_pt_regs_t; Signed-off-by: Tiezhu Yang Link: https://lore.kernel.org/r/1676458867-22052-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Alexei Starovoitov commit e2d323a1f009cbeb4fbc0bad81bf44d6401bd359 Author: Bagas Sanjaya Date: Wed Feb 15 19:32:52 2023 +0700 Documentation: bpf: Add missing line break separator in node_data struct code block Stephen Rothwell reported htmldocs warning when merging bpf-next tree, which was the same warning as reported by kernel test robot: Documentation/bpf/graph_ds_impl.rst:62: ERROR: Error in "code-block" directive: maximum 1 argument(s) allowed, 12 supplied. The error is due to Sphinx confuses node_data struct declaration with code-block directive option. Fix the warning by separating the code-block marker with node_data struct declaration. Link: https://lore.kernel.org/linux-next/20230215144505.4751d823@canb.auug.org.au/ Link: https://lore.kernel.org/linux-doc/202302151123.wUE5FYFx-lkp@intel.com/ Fixes: c31315c3aa0929 ("bpf, documentation: Add graph documentation for non-owning refs") Reported-by: Stephen Rothwell Reported-by: kernel test robot Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20230215123253.41552-3-bagasdotme@gmail.com Signed-off-by: Alexei Starovoitov commit 6828e402d06f7c574430b61c05db784cd847b19f Author: Alain Volmat Date: Thu Feb 9 10:16:54 2023 +0100 thermal/drivers/st: Remove syscfg based driver The syscfg based thermal driver is only supporting STiH415 STiH416 and STiD127 platforms which are all no more supported. We can thus safely remove this driver since the remaining STi platform STiH407/STiH410 and STiH418 are all using the memmap based thermal driver. Signed-off-by: Alain Volmat Link: https://lore.kernel.org/r/20230209091659.1409-7-avolmat@me.com Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 9272d2d43b6e532d0c0b6d3a597cf75c9ca1e183 Author: Daniel Lezcano Date: Mon Feb 6 16:34:29 2023 +0100 thermal: Remove core header inclusion from drivers As the name states "thermal_core.h" is the header file for the core components of the thermal framework. Too many drivers are including it. Hopefully the recent cleanups helped to self encapsulate the code a bit more and prevented the drivers to need this header. Remove this inclusion in every place where it is possible. Some other drivers did a confusion with the core header and the one exported in linux/thermal.h. They include the former instead of the latter. The changes also fix this. The tegra/soctherm driver still remains as it uses an internal function which need to be replaced. The Intel HFI driver uses the netlink internal framework core and should be changed to prevent to deal with the internals. No functional changes intended. Signed-off-by: Daniel Lezcano Reviewed-by: Miquel Raynal # armada_thermal.c Reviewed-by: Kunihiko Hayashi # uniphier_thermal.c Reviewed-by: Niklas Söderlund # rcar_gen3_thermal.c Reviewed-by: Neil Armstrong # amlogic_thermal.c Acked-by: Florian Fainelli # bcm2835_thermal.c Acked-by: Thierry Reding # tegra30-tsensor.c Link: https://lore.kernel.org/r/20230206153432.1017282-1-daniel.lezcano@linaro.org Signed-off-by: Rafael J. Wysocki commit ef1ab1657fda1fd38a082b5652a2bbc6d510ffff Author: Vibhav Pant Date: Sat Feb 11 13:49:35 2023 +0530 tools/lib/thermal: Fix include path for libnl3 in pkg-config file. Fixes pkg-config returning malformed CFLAGS for libthermal. Signed-off-by: Vibhav Pant Link: https://lore.kernel.org/r/20230211081935.62690-1-vibhavp@gmail.com Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 15cc25829a97c3957e520e971868aacc84341317 Author: Yongqin Liu Date: Fri Feb 10 22:15:07 2023 +0800 thermal/drivers/hisi: Drop second sensor hi3660 The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm allocators") exposes a panic "BRK handler: Fatal exception" on the hi3660_thermal_probe funciton. This is because the function allocates memory for only one sensors array entry, but tries to fill up a second one. Fix this by removing the unneeded second access. Fixes: 7d3a2a2bbadb ("thermal/drivers/hisi: Fix number of sensors on hi3660") Signed-off-by: Yongqin Liu Link: https://lore.kernel.org/linux-mm/20221101223321.1326815-5-keescook@chromium.org/ Link: https://lore.kernel.org/r/20230210141507.71014-1-yongqin.liu@linaro.org Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 47b2d3d2ed6c5c20f3521d5b615ffc92ed18b974 Author: Niklas Söderlund Date: Wed Feb 8 20:03:33 2023 +0100 thermal/drivers/rcar_gen3_thermal: Fix device initialization The thermal zone is registered before the device is register and the thermal coefficients are calculated, providing a window for very incorrect readings. The reason why the zone was register before the device was fully initialized was that the presence of the set_trips() callback is used to determine if the driver supports interrupt or not, as it is not defined if the device is incapable of interrupts. Fix this by using the operations structure in the private data instead of the zone to determine if interrupts are available or not, and initialize the device before registering the zone. Signed-off-by: Niklas Söderlund Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20230208190333.3159879-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit aef43e04937ea819c6c1b35030b48f06f73488e0 Author: Niklas Söderlund Date: Wed Feb 8 20:03:32 2023 +0100 thermal/drivers/rcar_gen3_thermal: Create device local ops struct The callback operations are modified on a driver global level. If one device tree description do not define interrupts, the set_trips() operation was disabled globally for all users of the driver. Fix this by creating a device local copy of the operations structure and modify the copy depending on what the device can do. Signed-off-by: Niklas Söderlund Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20230208190333.3159879-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 1c63f8cd018db726e6cddcbb5abd069fab0e9cea Author: Niklas Söderlund Date: Wed Feb 8 20:03:31 2023 +0100 thermal/drivers/rcar_gen3_thermal: Do not call set_trips() when resuming There is no need to explicitly call set_trips() when resuming from suspend. The thermal framework calls thermal_zone_device_update() that restores the trip points. Suggested-by: Daniel Lezcano Signed-off-by: Niklas Söderlund Link: https://lore.kernel.org/r/20230208190333.3159879-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 883d1552997bedcf6e8eca3c65aa2dc5b28d160f Author: Geert Uytterhoeven Date: Thu Feb 9 17:11:54 2023 +0100 thermal/drivers/rcar_gen3: Add support for R-Car V4H Add support for the Thermal Sensor/Chip Internal Voltage Monitor/Core Voltage Monitor (THS/CIVM/CVM) on the Renesas R-Car V4H (R8A779G0) SoC. According to the R-Car V4H Hardware User's Manual Rev. 0.70, the (preliminary) conversion formula for the thermal sensor is the same as for most other R-Car Gen3 and Gen4 SoCs, while the (preliminary) conversion formula for the chip internal voltage monitor differs. As the driver only uses the former, no further changes are needed. Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/852048eb5f4cc001be7a97744f4c5caea912d071.1675958665.git.geert+renesas@glider.be Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 4c27a32c67e11fbc4356f4107c9ca33abcf2af3b Author: Geert Uytterhoeven Date: Thu Feb 9 17:11:53 2023 +0100 dt-bindings: thermal: rcar-gen3-thermal: Add r8a779g0 support Document support for the Thermal Sensor/Chip Internal Voltage Monitor/Core Voltage Monitor (THS/CIVM/CVM) on the Renesas R-Car V4H (R8A779G0) SoC. Unlike most other R-Car Gen3 and Gen4 SoCs, it has 4 instead of 3 sensors, so increase the maximum number of reg tuples. Just like other R-Car Gen4 SoCs, interrupts are not routed to the INTC-AP but to the ECM. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/11f740522ec479011cc8eef6bb450603be394def.1675958665.git.geert+renesas@glider.be Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit f5f633b18234cecb0e6ee6e5fbb358807dda15c3 Author: Balsam CHIHI Date: Thu Feb 9 11:56:26 2023 +0100 thermal/drivers/mediatek: Add the Low Voltage Thermal Sensor driver The Low Voltage Thermal Sensor (LVTS) is a multiple sensors, multi controllers contained in a thermal domain. A thermal domains can be the MCU or the AP. Each thermal domains contain up to seven controllers, each thermal controller handle up to four thermal sensors. The LVTS has two Finite State Machines (FSM), one to handle the functionin temperatures range like hot or cold temperature and another one to handle monitoring trip point. The FSM notifies via interrupts when a trip point is crossed. The interrupt is managed at the thermal controller level, so when an interrupt occurs, the driver has to find out which sensor triggered such an interrupt. The sampling of the thermal can be filtered or immediate. For the former, the LVTS measures several points and applies a low pass filter. Signed-off-by: Balsam CHIHI Reviewed-by: AngeloGioacchino Del Regno On MT8195 Tomato Chromebook: Tested-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230209105628.50294-5-bchihi@baylibre.com Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 498e2f7a6e69dcbca24715de2b4b97569fdfeff4 Author: Balsam CHIHI Date: Thu Feb 9 11:56:24 2023 +0100 dt-bindings: thermal: mediatek: Add LVTS thermal controllers Add LVTS thermal controllers dt-binding definition for mt8192 and mt8195. Signed-off-by: Balsam CHIHI Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230209105628.50294-3-bchihi@baylibre.com Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit fad399ebdd67f602f306b524e6f62c3570943a48 Author: Balsam CHIHI Date: Thu Feb 9 11:56:23 2023 +0100 thermal/drivers/mediatek: Relocate driver to mediatek folder Add MediaTek proprietary folder to upstream more thermal zone and cooler drivers, relocate the original thermal controller driver to it, and rename it as "auxadc_thermal.c" to show its purpose more clearly. Signed-off-by: Balsam CHIHI Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230209105628.50294-2-bchihi@baylibre.com Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit a29cbd76aaf63f5493e962aa2fbaadcdc4615143 Author: Vincent Guittot Date: Thu Feb 2 11:28:12 2023 +0100 tools/lib/thermal: Fix thermal_sampling_exit() thermal_sampling_init() suscribes to THERMAL_GENL_SAMPLING_GROUP_NAME group so thermal_sampling_exit() should unsubscribe from the same group. Fixes: 47c4b0de080a ("tools/lib/thermal: Add a thermal library") Signed-off-by: Vincent Guittot Link: https://lore.kernel.org/r/20230202102812.453357-1-vincent.guittot@linaro.org Signed-off-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit badf1f90502d3fc627a18880dfafd8c636699baf Merge: c3bd6d539f347 fef1f0be10c61 Author: Rafael J. Wysocki Date: Wed Feb 15 17:18:08 2023 +0100 Merge branch 'thermal-intel' Merge thermal control changes related to Intel platforms for 6.3-rc1: - Rework ACPI helper functions for thermal control to retrieve a trip point temperature instead of initializing a trip point objetc (Rafael Wysocki). - Clean up and improve the int340x thermal driver ((Rafael Wysocki). - Simplify and clean up the intel_pch thermal driver ((Rafael Wysocki). - Fix the Intel powerclamp thermal driver and make it use the common idle injection framework (Srinivas Pandruvada). - Add two module parameters, cpumask and max_idle, to the Intel powerclamp thermal driver to allow it to affect only a specific subset of CPUs instead of all of them (Srinivas Pandruvada). - Make the Intel quark_dts thermal driver Use generic trip point objects instead of its own trip point representation (Daniel Lezcano). - Add toctree entry for thermal documents and fix two issues in the Intel powerclamp driver documentation (Bagas Sanjaya). * thermal-intel: (25 commits) Documentation: powerclamp: Fix numbered lists formatting Documentation: powerclamp: Escape wildcard in cpumask description Documentation: admin-guide: Add toctree entry for thermal docs thermal: intel: powerclamp: Add two module parameters Documentation: admin-guide: Move intel_powerclamp documentation thermal: intel: powerclamp: Fix duration module parameter thermal: intel: powerclamp: Return last requested state as cur_state thermal: intel: quark_dts: Use generic trip points thermal: intel: powerclamp: Use powercap idle-inject feature powercap: idle_inject: Add update callback powercap: idle_inject: Export symbols thermal: intel: powerclamp: Fix cur_state for multi package system thermal: intel: intel_pch: Drop struct board_info thermal: intel: intel_pch: Rename board ID symbols thermal: intel: intel_pch: Fold suspend and resume routines into their callers thermal: intel: intel_pch: Fold two functions into their callers thermal: intel: intel_pch: Eliminate device operations object thermal: intel: intel_pch: Rename device operations callbacks thermal: intel: intel_pch: Eliminate redundant return pointers thermal: intel: intel_pch: Make pch_wpt_add_acpi_psv_trip() return int ... commit 1683ed16ff1a51705f58e8083ed93a7428a543f2 Author: Fabio M. De Francesco Date: Fri Jan 27 22:54:52 2023 +0100 fs/nfs: Replace kmap_atomic() with kmap_local_page() in dir.c kmap_atomic() is deprecated in favor of kmap_local_page(). With kmap_local_page() the mappings are per thread, CPU local, can take page-faults, and can be called from any context (including interrupts). Furthermore, the tasks can be preempted and, when they are scheduled to run again, the kernel virtual addresses are restored and still valid. kmap_atomic() is implemented like a kmap_local_page() which also disables page-faults and preemption (the latter only for !PREEMPT_RT kernels, otherwise it only disables migration). The code within the mappings/un-mappings in the functions of dir.c don't depend on the above-mentioned side effects of kmap_atomic(), so that mere replacements of the old API with the new one is all that is required (i.e., there is no need to explicitly add calls to pagefault_disable() and/or preempt_disable()). Therefore, replace kmap_atomic() with kmap_local_page() in fs/nfs/dir.c. Tested in a QEMU/KVM x86_32 VM, 6GB RAM, booting a kernel with HIGHMEM64GB enabled. Suggested-by: Ira Weiny Signed-off-by: Fabio M. De Francesco Reviewed-by: Luis Chamberlain Signed-off-by: Anna Schumaker commit 76f5aaabce492aa6991c28c96bb78b00b05d06c5 Author: Andy Shevchenko Date: Wed Feb 15 15:23:43 2023 +0200 ASoC: soc-ac97: Return correct error codes With the switching to dev_err_probe(), during the conversion of GPIO calls, the return code is passed is a paratemer to it. At the same time a copy'n'paste mistake was made, so the wrong variable has been taken for the error reporting. Fix this. Fixes: 3ee0d39c50dc ("ASoC: soc-ac97: Convert to agnostic GPIO API") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230215132343.35547-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b Author: Lucas Tanure Date: Wed Feb 15 13:28:51 2023 +0000 ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared Add struct snd_pcm_substream forward declaration Fixes: 078a85f2806f ("ASoC: dapm: Only power up active channels from a DAI") Signed-off-by: Lucas Tanure Reviewed-by: Charles Keepax Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230215132851.1626881-1-lucas.tanure@collabora.com Signed-off-by: Mark Brown commit c3bd6d539f34784b235c7070edba978f67516372 Merge: f364beb5b6734 5bbafd4362661 Author: Rafael J. Wysocki Date: Wed Feb 15 17:08:30 2023 +0100 Merge branch 'thermal-core' Merge thermal control core changes for 6.3-rc1: - Clean up thermal device unregistration code (Viresh Kumar). - Fix and clean up thermal control core initialization error code paths (Daniel Lezcano). - Relocate the trip points handling code into a separate file (Daniel Lezcano). - Make the thermal core fail registration of thermal zones and cooling devices if the thermal class has not been registered (Rafael Wysocki). - Make the core thermal control code use sysfs_emit_at() instead of scnprintf() where applicable (ye xingchen). * thermal-core: thermal: core: Use sysfs_emit_at() instead of scnprintf() thermal: Fail object registration if thermal class is not registered thermal/core: Move the thermal trip code to a dedicated file thermal/core: Remove unneeded ida_destroy() thermal/core: Fix unregistering netlink at thermal init time thermal: core: Use device_unregister() instead of device_del/put() thermal: core: Move cdev cleanup to thermal_release() commit 28d4411fc3b58d7ef2cd00060c068a5d90ee9700 Author: Olga Kornievskaia Date: Fri Jan 20 13:40:20 2023 -0500 pNFS/filelayout: treat GETDEVICEINFO errors as layout failure When GETDEVICEINFO call fails, return the layout and fall back to MDS. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker commit e6a0b671880207566e1ece983bf989dde60bc1d7 Author: Christophe JAILLET Date: Wed Feb 15 14:01:28 2023 +0100 spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() wait_for_completion_timeout() never returns a <0 value. It returns either on timeout or a positive value (at least 1, or number of jiffies left till timeout) So, fix the error handling path and return -ETIMEDOUT should a timeout occur. Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform") Signed-off-by: Christophe JAILLET Acked-by: Jassi Brar Link: https://lore.kernel.org/r/c2040bf3cfa201fd8890cfab14fa5a701ffeca14.1676466072.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit 3e2a036827ccb33e93bc6faa66ca40991963593c Author: Dave Wysochanski Date: Mon Jan 23 11:58:47 2023 -0500 Documentation: Fix sysfs path for the NFSv4 client identifier The sysfs path for the NFS4 client identfier should start with the path component of 'nfs' for the kset, and then the 'net' path component for the netns object, followed by the 'nfs_client' path component for the NFS client kobject, and ending with 'identifier' for the netns_client_id kobj_attribute. Fixes: a28faaddb2be ("Documentation: Add an explanation of NFSv4 client identifiers") Link: https://bugzilla.redhat.com/show_bug.cgi?id=1801326 Reviewed-by: Chuck Lever Signed-off-by: Dave Wysochanski Signed-off-by: Anna Schumaker commit fb80ef67e8ff6a00d3faad4cb348dafdb8eccfd8 Author: Bjorn Andersson Date: Mon Jan 9 14:39:31 2023 -0800 rpmsg: glink: Release driver_override Upon termination of the rpmsg_device, driver_override needs to be freed to avoid leaking the potentially assigned string. Fixes: 42cd402b8fd4 ("rpmsg: Fix kfree() of static memory on setting driver_override") Fixes: 39e47767ec9b ("rpmsg: Add driver_override device attribute for rpmsg_device") Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230109223931.1706429-1-quic_bjorande@quicinc.com commit 4730515378a70064581b27ed112fcfc6f2a379ca Author: Tigran Mkrtchyan Date: Tue Feb 7 18:46:35 2023 +0100 nfs42: do not fail with EIO if ssc returns NFS4ERR_OFFLOAD_DENIED The NFSv4.2 server even if supports intra-SSC might prefer that for a particular file a classic copy is performed. As returning ENOTSUPP will clear the SSC capability of the server by the client, server might return NFS4ERR_OFFLOAD_DENIED (well, spec talks about remote servers there). Update nfs42_proc_copy to handle NFS4ERR_OFFLOAD_DENIED as ENOTSUPP, but without clearing NFS_CAP_COPY bit. Signed-off-by: Tigran Mkrtchyan Signed-off-by: Anna Schumaker commit 8038510b1fe443ffbc0e356db5f47cbb8678a594 Author: Imre Deak Date: Wed Feb 8 13:42:57 2023 +0200 drm/i915: Fix system suspend without fbdev being initialized If fbdev is not initialized for some reason - in practice on platforms without display - suspending fbdev should be skipped during system suspend, fix this up. While at it add an assert that suspending fbdev only happens with the display present. This fixes the following: [ 91.227923] PM: suspend entry (s2idle) [ 91.254598] Filesystems sync: 0.025 seconds [ 91.270518] Freezing user space processes [ 91.272266] Freezing user space processes completed (elapsed 0.001 seconds) [ 91.272686] OOM killer disabled. [ 91.272872] Freezing remaining freezable tasks [ 91.274295] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [ 91.659622] BUG: kernel NULL pointer dereference, address: 00000000000001c8 [ 91.659981] #PF: supervisor write access in kernel mode [ 91.660252] #PF: error_code(0x0002) - not-present page [ 91.660511] PGD 0 P4D 0 [ 91.660647] Oops: 0002 [#1] PREEMPT SMP NOPTI [ 91.660875] CPU: 4 PID: 917 Comm: bash Not tainted 6.2.0-rc7+ #54 [ 91.661185] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20221117gitfff6d81270b5-9.fc37 unknown [ 91.661680] RIP: 0010:mutex_lock+0x19/0x30 [ 91.661914] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 53 48 89 fb e8 62 d3 ff ff 31 c0 65 48 8b 14 25 00 15 03 00 48 0f b1 13 75 06 5b c3 cc cc cc cc 48 89 df 5b eb b4 0f 1f 40 [ 91.662840] RSP: 0018:ffffa1e8011ffc08 EFLAGS: 00010246 [ 91.663087] RAX: 0000000000000000 RBX: 00000000000001c8 RCX: 0000000000000000 [ 91.663440] RDX: ffff8be455eb0000 RSI: 0000000000000001 RDI: 00000000000001c8 [ 91.663802] RBP: ffff8be459440000 R08: ffff8be459441f08 R09: ffffffff8e1432c0 [ 91.664167] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 91.664532] R13: 00000000000001c8 R14: 0000000000000000 R15: ffff8be442f4fb20 [ 91.664905] FS: 00007f28ffc16740(0000) GS:ffff8be4bb900000(0000) knlGS:0000000000000000 [ 91.665334] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 91.665626] CR2: 00000000000001c8 CR3: 0000000114926006 CR4: 0000000000770ee0 [ 91.665988] PKRU: 55555554 [ 91.666131] Call Trace: [ 91.666265] [ 91.666381] intel_fbdev_set_suspend+0x97/0x1b0 [i915] [ 91.666738] i915_drm_suspend+0xb9/0x100 [i915] [ 91.667029] pci_pm_suspend+0x78/0x170 [ 91.667234] ? __pfx_pci_pm_suspend+0x10/0x10 [ 91.667461] dpm_run_callback+0x47/0x150 [ 91.667673] __device_suspend+0x10a/0x4e0 [ 91.667880] dpm_suspend+0x134/0x270 [ 91.668069] dpm_suspend_start+0x79/0x80 [ 91.668272] suspend_devices_and_enter+0x11b/0x890 [ 91.668526] pm_suspend.cold+0x270/0x2fc [ 91.668737] state_store+0x46/0x90 [ 91.668916] kernfs_fop_write_iter+0x11b/0x200 [ 91.669153] vfs_write+0x1e1/0x3a0 [ 91.669336] ksys_write+0x53/0xd0 [ 91.669510] do_syscall_64+0x58/0xc0 [ 91.669699] ? syscall_exit_to_user_mode_prepare+0x18e/0x1c0 [ 91.669980] ? syscall_exit_to_user_mode_prepare+0x18e/0x1c0 [ 91.670278] ? syscall_exit_to_user_mode+0x17/0x40 [ 91.670524] ? do_syscall_64+0x67/0xc0 [ 91.670717] ? __irq_exit_rcu+0x3d/0x140 [ 91.670931] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 91.671202] RIP: 0033:0x7f28ffd14284 v2: CC stable. (Jani) Fixes: f8cc091e0530 ("drm/i915/fbdev: suspend HPD before fbdev unregistration") References: https://gitlab.freedesktop.org/drm/intel/-/issues/8015 Reported-and-tested-by: iczero Cc: Andrzej Hajda Cc: iczero Cc: # v6.1+ Reviewed-by: Jani Nikula Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230208114300.3123934-2-imre.deak@intel.com (cherry picked from commit 9542d708409a41449e99c9a464deb5e062c4bee2) Signed-off-by: Jani Nikula commit 6a8b2e4984f73f8d00c8c16b87a8b115d34088e4 Author: Lucas De Marchi Date: Mon Feb 6 08:54:09 2023 -0800 drm/i915: Fix GEN8_MISCCPCTL Register 0x9424 is not replicated on any platform, so it shouldn't be declared with REG_MCR(). Declaring it with _MMIO() is basically duplicate of the GEN7 version, so just remove the GEN8 and change all the callers to use the right functions. Old versions of the gen8 bspec page used to contain a table with MCR registers, apparently implying 0x9400 - 0x94ff registers were replicated. However that table went away and there is no information related to the ranges for gen8 anymore. Moreover the current behavior of the driver wouldn't do anything special for 0x9424 since there is no equivalent table in intel_gt_mcr.c: the driver would just fallback to intel_uncore_{read,write}(). Therefore, do not care about the possible special case for gen8 and just use the register as non-MCR for all the platforms. One place doing read + write is also converted to intel_uncore_rmw(). v2: Reword commit message adding the justification wrt gen8 Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly") Cc: Balasubramani Vivekanandan Cc: Rodrigo Vivi Cc: Gustavo Sousa Cc: Matt Atwood Cc: Ashutosh Dixit Signed-off-by: Lucas De Marchi Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230206165410.3056073-1-lucas.demarchi@intel.com (cherry picked from commit 869bace73ae2b4227e57ee3fd994bfa7d4808938) Signed-off-by: Jani Nikula commit effc0905d741b4138806747407baf8de98390c72 Author: Matt Roper Date: Wed Feb 1 14:28:28 2023 -0800 drm/i915/pvc: Annotate two more workaround/tuning registers as MCR XEHPC_LNCFMISCCFGREG0 and XEHPC_L3SCRUB are both in MCR register ranges on PVC (with HALFBSLICE and L3BANK replication respectively), so they should be explicitly declared as MCR registers and use MCR-aware workaround handlers. The workarounds/tuning settings should still be applied properly on PVC even without the MCR annotation, but readback verification on CONFIG_DRM_I915_DEBUG_GEM builds could potentitally give false positive "workaround lost on load" warnings on parts fused such that a unicast read targets a terminated register instance. Fixes: a9e69428b1b4 ("drm/i915: Define MCR registers explicitly") Signed-off-by: Matt Roper Reviewed-by: Gustavo Sousa Link: https://patchwork.freedesktop.org/patch/msgid/20230201222831.608281-1-matthew.d.roper@intel.com (cherry picked from commit 4039e44237e8ebb06f0e4af549fbedf7c41df9db) Signed-off-by: Jani Nikula commit eb66553d356b44c08db56fd5ecea162cfe4bf8fd Author: Jani Nikula Date: Tue Feb 7 13:16:26 2023 +0200 drm/i915/bios: set default backlight controller index With backlight controller set to -1 in intel_panel_init_alloc() to distinguish uninitialized values, and controller later being set only if it's present in VBT, we can end up with -1 for the controller: [drm:intel_bios_init_panel [i915]] VBT backlight PWM modulation frequency 200 Hz, active high, min brightness 0, level 255, controller 4294967295 There's no harm if it happens on platforms that ignore controller due to only one backlight controller being present, like on VLV above, but play it safe. Fixes: bf38bba3e7d6 ("drm/i915: Try to use the correct power sequencer intiially on bxt/glk") Cc: Ville Syrjälä Signed-off-by: Jani Nikula Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230207111626.1839645-1-jani.nikula@intel.com (cherry picked from commit a0dcb06d29d9e477e1984dc3859e61568361fc1a) Signed-off-by: Jani Nikula commit c90b155148e9632ae46e6778ee958c319457415f Author: Ville Syrjälä Date: Tue Feb 7 08:43:37 2023 +0200 drm/i915: Pick the backlight controller based on VBT on ICP+ Use the second backlight controller on ICP+ if the VBT asks us to do so. On pre-MTP we also check the chicken bit to make sure the pins have been correctly muxed by the firmware. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8016 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230207064337.18697-4-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit b33771546309b46b681388b3540b69a75a0e2e69) Signed-off-by: Jani Nikula commit 14e591a1930c2790fe862af5b01ee3ca587f752f Author: Ville Syrjälä Date: Tue Feb 7 08:43:36 2023 +0200 drm/i915: Populate encoder->devdata for DSI on icl+ We now have some eDP+DSI dual panel systems floating around where the DSI panel is the secondary LFP and thus needs to consult "panel type 2" in VBT in order to locate all the other panel type dependant stuff correctly. To that end we need to pass in the devdata to intel_bios_init_panel_late(), otherwise it'll just assume we want the primary panel type. So let's try to just populate the vbt.ports[] stuff and encoder->devdata for icl+ DSI panels as well. We can't do this on older platforms as there we risk a DSI port aliasing with a HDMI/DP port, which is a totally legal thing as the DSI ports live in their own little parallel universe. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8016 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230207064337.18697-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit ba00eb6a4bfbe5194ddda50730aba063951f8ce0) Signed-off-by: Jani Nikula commit 8f9f5fb94dbea843621740e6b25b3b430a83cf29 Author: Ville Syrjälä Date: Tue Feb 7 08:43:35 2023 +0200 drm/i915: Fix VBT DSI DVO port handling Turns out modern (icl+) VBTs still declare their DSI ports as MIPI-A and MIPI-C despite the PHYs now being A and B. Remap appropriately to allow the panels declared as MIPI-C to work. Cc: stable@vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8016 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230207064337.18697-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula (cherry picked from commit 118b5c136c04da705b274b0d39982bb8b7430fc5) Signed-off-by: Jani Nikula commit 679caae16175d17467ee1ad1f05dd72d8d4b0973 Author: Matt Atwood Date: Wed Feb 1 15:28:01 2023 -0800 drm/i915: Fix memory leaks in scatterlist This patch fixes memory leaks on error escapes in i915_scatterlist.c Fixes: c3bfba9a2225 ("drm/i915: Check for integer truncation on scatterlist creation") Cc: Chris Wilson Signed-off-by: Matt Atwood Reviewed-by: Harish Chegondi Signed-off-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230201232801.123684-1-matthew.s.atwood@intel.com (cherry picked from commit 389b9d91dd57fd2d4428bd0c19ed1cacf2fe918d) Signed-off-by: Jani Nikula commit fe7f56a7adfbb17bba2454fd97fd97caf9dbddd5 Author: Bagas Sanjaya Date: Fri Feb 3 17:02:13 2023 +0700 drm/i915/doc: Escape wildcard in method names Stephen Rothwell reported htmldocs warnings: Documentation/gpu/i915:64: drivers/gpu/drm/i915/gt/intel_workarounds.c:32: WARNING: Inline emphasis start-string without end-string. Documentation/gpu/i915:64: drivers/gpu/drm/i915/gt/intel_workarounds.c:57: WARNING: Inline emphasis start-string without end-string. Documentation/gpu/i915:64: drivers/gpu/drm/i915/gt/intel_workarounds.c:66: WARNING: Inline emphasis start-string without end-string. Escape wildcards in *_ctx_workarounds_init(), *_gt_workarounds_init(), and *_whitelist_build() to fix above warnings. Link: https://lore.kernel.org/linux-next/20230203134622.0b6315b9@canb.auug.org.au/ Fixes: 0c3064cf33fbfa ("drm/i915/doc: Document where to implement register workarounds") Reported-by: Stephen Rothwell Signed-off-by: Bagas Sanjaya Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/20230203100215.31852-2-bagasdotme@gmail.com (cherry picked from commit ec852e3c88d5caa457557406c0c787b56c36dffb) Signed-off-by: Jani Nikula commit 5bab56fff53ce161ed859d9559a10361d4f79578 Author: NeilBrown Date: Wed Feb 8 15:45:38 2023 +1100 NFS: fix disabling of swap When swap is activated to a file on an NFSv4 mount we arrange that the state manager thread is always present as starting a new thread requires memory allocations that might block waiting for swap. Unfortunately the code for allowing the state manager thread to exit when swap is disabled was not tested properly and does not work. This can be seen by examining /proc/fs/nfsfs/servers after disabling swap and unmounting the filesystem. The servers file will still list one entry. Also a "ps" listing will show the state manager thread is still present. There are two problems. 1/ rpc_clnt_swap_deactivate() doesn't walk up the ->cl_parent list to find the primary client on which the state manager runs. 2/ The thread is not woken up properly and it immediately goes back to sleep without checking whether it is really needed. Using nfs4_schedule_state_manager() ensures a proper wake-up. Reported-by: Olga Kornievskaia Fixes: 4dc73c679114 ("NFSv4: keep state manager thread active if swap is enabled") Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker commit 7e71a13353ff7a3838416992197aa3f2eb0549ea Merge: 73dd3206811af f9901f64536c3 41a337b40e983 52e0452b413d8 Author: Rafael J. Wysocki Date: Wed Feb 15 15:59:48 2023 +0100 Merge branches 'pm-cpuidle', 'pm-core' and 'pm-sleep' Merge cpuidle updates, PM core updates and changes related to system sleep handling for 6.3-rc1: - Make the TEO cpuidle governor check CPU utilization in order to refine idle state selection (Kajetan Puchalski). - Make Kconfig select the haltpoll cpuidle governor when the haltpoll cpuidle driver is selected and replace a default_idle() call in that driver with arch_cpu_idle() which allows MWAIT to be used (Li RongQing). - Add Emerald Rapids Xeon support to the intel_idle driver (Artem Bityutskiy). - Add ARCH_SUSPEND_POSSIBLE dependencies for ARMv4 cpuidle drivers to avoid randconfig build failures (Arnd Bergmann). - Make kobj_type structures used in the cpuidle sysfs interface constant (Thomas Weißschuh). - Make the cpuidle driver registration code update microsecond values of idle state parameters in accordance with their nanosecond values if they are provided (Rafael Wysocki). - Make the PSCI cpuidle driver prevent topology CPUs from being suspended on PREEMPT_RT (Krzysztof Kozlowski). - Document that pm_runtime_force_suspend() cannot be used with DPM_FLAG_SMART_SUSPEND (Richard Fitzgerald). - Add EXPORT macros for exporting PM functions from drivers (Richard Fitzgerald). - Drop "select SRCU" from system sleep Kconfig (Paul E. McKenney). - Remove /** from non-kernel-doc comments in hibernation code (Randy Dunlap). * pm-cpuidle: cpuidle: psci: Do not suspend topology CPUs on PREEMPT_RT cpuidle: driver: Update microsecond values of state parameters as needed cpuidle: sysfs: make kobj_type structures constant cpuidle: add ARCH_SUSPEND_POSSIBLE dependencies intel_idle: add Emerald Rapids Xeon support cpuidle-haltpoll: Replace default_idle() with arch_cpu_idle() cpuidle-haltpoll: select haltpoll governor cpuidle: teo: Introduce util-awareness cpuidle: teo: Optionally skip polling states in teo_find_shallower_state() * pm-core: PM: Add EXPORT macros for exporting PM functions PM: runtime: Document that force_suspend() is incompatible with SMART_SUSPEND * pm-sleep: PM: sleep: Remove "select SRCU" PM: hibernate: swap: don't use /** for non-kernel-doc comments commit 73dd3206811af32695e46ca71e2b0da5dac81ad9 Author: Bagas Sanjaya Date: Wed Feb 15 19:32:53 2023 +0700 Documentation: amd-pstate: disambiguate user space sections kernel test robot reported htmldocs warning: Documentation/admin-guide/pm/amd-pstate.rst:343: WARNING: duplicate label admin-guide/pm/amd-pstate:user space interface in ``sysfs``, other instance in Documentation/admin-guide/pm/amd-pstate.rst The documentation contains two sections with the same "User Space Interface in ``sysfs``" title. The first one deals with per-policy sysfs and the second one is about general attributes (currently only global attributes are documented). Disambiguate title text of both sections to fix the warning. Link: https://lore.kernel.org/linux-doc/202302151041.0SWs1RHK-lkp@intel.com/ Fixes: b9e6a2d47b2565 ("Documentation: amd-pstate: introduce new global sysfs attributes") Reported-by: kernel test robot Signed-off-by: Bagas Sanjaya Reviewed-by: Wyes Karny Acked-by: Huang Rui Signed-off-by: Rafael J. Wysocki commit 6e9d12125fcac048c78f497044370c1da85b552a Author: Wyes Karny Date: Tue Feb 14 07:58:11 2023 +0000 cpufreq: amd-pstate: Fix invalid write to MSR_AMD_CPPC_REQ `amd_pstate_set_epp` function uses `cppc_req_cached` and `epp` variable to update the MSR_AMD_CPPC_REQ register for AMD MSR systems. The recent commit 7cca9a9851a5 ("cpufreq: amd-pstate: avoid uninitialized variable use") changed the sequence of updating cppc_req_cached and writing the MSR_AMD_CPPC_REQ. Therefore while switching from powersave to performance governor and vice-versa in active mode MSR_AMD_CPPC_REQ is set with the previous cached value. To fix this: first update the `cppc_req_cached` variable and then call `amd_pstate_set_epp` function. - Before commit 7cca9a9851a5 ("cpufreq: amd-pstate: avoid uninitialized variable use"): With powersave governor: [ 1.652743] amd_pstate_epp_init: writing to cppc_req_cached = 0x1eff [ 1.652744] amd_pstate_set_epp: writing cppc_req_cached = 0x1eff [ 1.652746] amd_pstate_set_epp: writing min_perf = 30, des_perf = 0, max_perf = 255, epp = 0 Changing to performance governor: [ 300.493842] amd_pstate_epp_init: writing to cppc_req_cached = 0xffff [ 300.493846] amd_pstate_set_epp: writing cppc_req_cached = 0xffff [ 300.493847] amd_pstate_set_epp: writing min_perf = 255, des_perf = 0, max_perf = 255, epp = 0 - After commit 7cca9a9851a5 ("cpufreq: amd-pstate: avoid uninitialized variable use"): With powersave governor: [ 1.646037] amd_pstate_set_epp: writing cppc_req_cached = 0xffff [ 1.646038] amd_pstate_set_epp: writing min_perf = 255, des_perf = 0, max_perf = 255, epp = 0 [ 1.646042] amd_pstate_epp_init: writing to cppc_req_cached = 0x1eff Changing to performance governor: [ 687.117401] amd_pstate_set_epp: writing cppc_req_cached = 0x1eff [ 687.117405] amd_pstate_set_epp: writing min_perf = 30, des_perf = 0, max_perf = 255, epp = 0 [ 687.117419] amd_pstate_epp_init: writing to cppc_req_cached = 0xffff - After this fix: With powersave governor: [ 2.525717] amd_pstate_epp_init: writing to cppc_req_cached = 0x1eff [ 2.525720] amd_pstate_set_epp: writing cppc_req_cached = 0x1eff [ 2.525722] amd_pstate_set_epp: writing min_perf = 30, des_perf = 0, max_perf = 255, epp = 0 Changing to performance governor: [ 3440.152468] amd_pstate_epp_init: writing to cppc_req_cached = 0xffff [ 3440.152473] amd_pstate_set_epp: writing cppc_req_cached = 0xffff [ 3440.152474] amd_pstate_set_epp: writing min_perf = 255, des_perf = 0, max_perf = 255, epp = 0 Fixes: 7cca9a9851a5 ("cpufreq: amd-pstate: avoid uninitialized variable use") Signed-off-by: Wyes Karny Acked-by: Huang Rui Signed-off-by: Rafael J. Wysocki commit 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 Author: Arnd Bergmann Date: Mon Feb 6 20:40:57 2023 +0100 printf: fix errname.c list On most architectures, gcc -Wextra warns about the list of error numbers containing both EDEADLK and EDEADLOCK: lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init] 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err | ^~~ lib/errname.c:172:2: note: in expansion of macro 'E' 172 | E(EDEADLK), /* EDEADLOCK */ | ^ On parisc, a similar error happens with -ECANCELLED, which is an alias for ECANCELED. Make the EDEADLK printing conditional on the number being distinct from EDEADLOCK, and remove the -ECANCELLED bit completely as it can never be hit. To ensure these are correct, add static_assert lines that verify all the remaining aliases are in fact identical to the canonical name. Fixes: 57f5677e535b ("printf: add support for printing symbolic error names") Cc: Petr Mladek Suggested-by: Rasmus Villemoes Acked-by: Uwe Kleine-König Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/ Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann Reviewed-by: Sergey Senozhatsky Acked-by: Rasmus Villemoes Reviewed-by: Petr Mladek Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org commit f32309c4d08dbac74d3253ac8310bfcad4e21606 Merge: b7ab6b91b9e7b 2d11eae42d52a a527b0111798e 3082d7efd76a5 Author: Rafael J. Wysocki Date: Wed Feb 15 15:42:59 2023 +0100 Merge branches 'acpi-video', 'acpi-misc' and 'acpi-docs' Merge ACPI backlight driver changes, miscellaneous ACPI-related changes and ACPI-related documentation updates for 6.3-rc1: - Fix Lenovo Ideapad Z570 DMI match in the ACPI backlight driver (Hans de Goede). - Silence missing prototype warnings in some places in the ACPI-related code (Ammar Faizi). - Make kobj_type structures used in the ACPI code constant (Thomas Weißschuh). - Correct spelling in firmware-guide/ACPI (Randy Dunlap). - Clarify the meaning of Explicit and Implicit in the _DSD GPIO properties documentation (Andy Shevchenko). * acpi-video: ACPI: video: Fix Lenovo Ideapad Z570 DMI match * acpi-misc: ACPI: make kobj_type structures constant ACPI: Silence missing prototype warnings * acpi-docs: Documentation: firmware-guide: gpio-properties: Clarify Explicit and Implicit Documentation: firmware-guide/ACPI: correct spelling commit b7ab6b91b9e7b98ce746b22893e45edfc458c231 Merge: 9f4512c2aeca0 17bb7046e7ce0 7de6c3fb6dfbf 91507d25a67c5 53fc7e80f3aa9 Author: Rafael J. Wysocki Date: Wed Feb 15 15:34:12 2023 +0100 Merge branches 'acpi-resource', 'acpi-pmic', 'acpi-battery' and 'acpi-apei' Merge ACPI resources handling changes, ACPI PMIC and battery drivers changes and ACPI APEI changes for 6.3-rc1: - Add two more entries to the ACPI IRQ override quirk list (Adam Niederer, Werner Sembach). - Add a pmic_i2c_address entry for Intel Bay Trail Crystal Cove to allow intel_soc_pmic_exec_mipi_pmic_seq_element() to be used with the Bay Trail Crystal Cove PMIC OpRegion driver (Hans de Goede). - Add comments with DSDT power OpRegion field names to the ACPI PMIC driver (Hans de Goede). - Fix string termination handling in the ACPI battery driver (Armin Wolf). - Limit error type to 32-bit width in the ACPI APEI error injection code (Shuai Xue). * acpi-resource: ACPI: resource: Do IRQ override on all TongFang GMxRGxx ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models * acpi-pmic: ACPI: PMIC: Add comments with DSDT power opregion field names ACPI: PMIC: Add pmic_i2c_address to BYT Crystal Cove support * acpi-battery: ACPI: battery: Increase maximum string length ACPI: battery: Fix buffer overread if not NUL-terminated ACPI: battery: Fix missing NUL-termination with large strings * acpi-apei: ACPI: APEI: EINJ: Limit error type to 32-bit width commit 9f4512c2aeca02d75b246fe456e7540043c5e81b Merge: 391712d7536dd e8a0e30b742f7 6ad90f7112921 28a35ac2f5f87 36b20f82b699a Author: Rafael J. Wysocki Date: Wed Feb 15 15:25:26 2023 +0100 Merge branches 'acpi-processor', 'acpi-tables', 'acpi-pnp' and 'acpi-maintainers' Merge ACPI processor driver changes, ACPI table parser changes, ACPI device enumeration changes related to PNP and a MAINTAINERS update related to ACPI for 6.3-rc1: - Drop an unnecessary (void *) conversion from the ACPI processor driver (Zhou jie). - Modify the ACPI processor performance library code to use the "no limit" frequency QoS as appropriate and adjust the intel_pstate driver accordingly (Rafael Wysocki). - Add support for NBFT to the ACPI table parser (Stuart Hayes). - Introduce list of known non-PNP devices to avoid enumerating some of them as PNP devices (Rafael Wysocki). - Add x86 ACPI paths to the ACPI entry in MAINTAINERS to allow scripts to report the actual maintainers information (Rafael Wysocki). * acpi-processor: cpufreq: intel_pstate: Drop ACPI _PSS states table patching ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily ACPI: processor: perflib: Use the "no limit" frequency QoS ACPI: processor: idle: Drop unnecessary (void *) conversion * acpi-tables: ACPI: tables: Add support for NBFT * acpi-pnp: ACPI: PNP: Introduce list of known non-PNP devices * acpi-maintainers: MAINTAINERS: Add x86 ACPI paths to the ACPI entry commit 391712d7536ddba783b10ed4e67447970c3827ae Merge: fda7be2068973 5a9e358f1d1f5 Author: Rafael J. Wysocki Date: Wed Feb 15 15:14:19 2023 +0100 Merge branch 'acpica' Merge ACPICA changes for 6.3-rc1: - Drop port I/O validation for some regions to avoid AML failures due to rejections of legitimate port I/O writes (Mario Limonciello). - Constify acpi_get_handle() pathname argument to allow its callers to pass conts pathnames to it (Sakari Ailus). - Prevent acpi_ns_simple_repair() from crashing in some cases when AE_AML_NO_RETURN_VALUE should be returned (Daniil Tatianin). - Fix typo in CDAT DSMAS struct definition (Lukas Wunner). * acpica: ACPICA: Fix typo in CDAT DSMAS struct definition ACPICA: nsrepair: handle cases without a return value correctly ACPICA: Constify pathname argument for acpi_get_handle() ACPICA: Drop port I/O validation for some regions commit af16544d4abe283e4a1ead6563ae883b9bb35429 Merge: c6cd63f5af392 687bcd03a047e Author: Arnd Bergmann Date: Wed Feb 15 15:05:53 2023 +0100 Merge tag 'qcom-arm64-defconfig-for-6.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Few more Qualcomm ARM64 defconfig updates for v6.3 This enables the drivers needed to support USB Type-C based external display on the SC8280XP laptops. It also enables a couple of core drivers for the Qualcomm SA8775P platform. * tag 'qcom-arm64-defconfig-for-6.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: enable drivers required by the Qualcomm SA8775P platform arm64: defconfig: Enable DisplayPort on SC8280XP laptops Link: https://lore.kernel.org/r/20230215051757.1166709-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 18b68c695ca6f35c24a016c5751bfdefda1d3a3a Merge: 7dbdc16fc85bc 407ef897bd027 Author: Arnd Bergmann Date: Wed Feb 15 15:02:26 2023 +0100 Merge tag 'qcom-arm64-for-6.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/dt Last set of Qualcomm ARM64 DTS updates for v6.3 This introduces additional DisplayPort controllers and pmic_glink on SC8280XP (8cx Gen3), which provides support for USB Type-C-based displays on the the Lenovo ThinkPad X13s and the compute reference device. The pmic_glink also provides battery and power supply status. Interrupt-parents are corrected across the SC8280XP PMICs, to allow non-Linux OSs to properly handle interrupts in the various blocks therein. It cleans up the SM8350 base dtsi and introduces GPU support on this platform, as well as enable this for the Hardware Development Kit (HDK). It enables i2c busses on the Fairphone FP4 Lastly it aligns glink node names with bindings across a few platforms, and corrects the compatible for the PON block in the pmk8350 PMIC. * tag 'qcom-arm64-for-6.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: msm8996: align RPM G-Link clock-controller node with bindings arm64: dts: qcom: qcs404: align RPM G-Link node with bindings arm64: dts: qcom: ipq6018: align RPM G-Link node with bindings arm64: dts: qcom: sm8550: remove invalid interconnect property from cryptobam arm64: dts: qcom: sc7280: Adjust zombie PWM frequency arm64: dts: qcom: sc8280xp-pmics: Specify interrupt parent explicitly arm64: dts: qcom: sm7225-fairphone-fp4: enable remaining i2c busses arm64: dts: qcom: sm7225-fairphone-fp4: move status property down arm64: dts: qcom: pmk8350: Use the correct PON compatible arm64: dts: qcom: sc8280xp-x13s: Enable external display arm64: dts: qcom: sc8280xp-crd: Introduce pmic_glink arm64: dts: qcom: sc8280xp: Add USB-C-related DP blocks arm64: dts: qcom: sm8350-hdk: enable GPU arm64: dts: qcom: sm8350: add GPU, GMU, GPU CC and SMMU nodes arm64: dts: qcom: sm8350: finish reordering nodes arm64: dts: qcom: sm8350: move more nodes to correct place arm64: dts: qcom: sm8350: reorder device nodes Link: https://lore.kernel.org/r/20230215051530.1165953-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 524af30c931382726b6a46ee4f392fb6e60f8a03 Merge: 4ec98e6db9f24 29e8142b5623b Author: Arnd Bergmann Date: Wed Feb 15 15:00:54 2023 +0100 Merge tag 'qcom-drivers-for-6.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers One more Qualcomm driver update for 6.3 This introduces the power-supply driver providing battery and power supply status on many recent Qualcomm platforms, including the Qualcomm SC8180X and SC8280XP laptop platforms and the SM8350 mobile platform. It's introduced through the Qualcomm tree due to its dependencies on the pmic_glink driver, which was merged already for v6.3. * tag 'qcom-drivers-for-6.3-3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: power: supply: Introduce Qualcomm PMIC GLINK power supply Link: https://lore.kernel.org/r/20230215043658.1156472-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit e84183f68edb72e70e232b842d47058cba3476ec Merge: 157ed9cb04306 695fa5a64cf52 Author: Paolo Bonzini Date: Wed Feb 15 08:34:32 2023 -0500 Merge tag 'kvm-x86-selftests-6.3' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.3: - Cache the CPU vendor (AMD vs. Intel) and use the info to emit the correct hypercall instruction instead of relying on KVM to patch in VMMCALL - A variety of one-off cleanups and fixes commit 157ed9cb04306eae813b7598cf672834cd295b8e Merge: 1c5ec0d433b4b 13738a3647368 Author: Paolo Bonzini Date: Wed Feb 15 08:23:24 2023 -0500 Merge tag 'kvm-x86-pmu-6.3' of https://github.com/kvm-x86/linux into HEAD KVM x86 PMU changes for 6.3: - Add support for created masked events for the PMU filter to allow userspace to heavily restrict what events the guest can use without needing to create an absurd number of events - Clean up KVM's handling of "PMU MSRs to save", especially when vPMU support is disabled - Add PEBS support for Intel SPR commit 1c5ec0d433b4b2af15e7f54366411fd27d7c40b2 Merge: 4f2a5a6b96a00 11b36fe7d4500 Author: Paolo Bonzini Date: Wed Feb 15 08:22:44 2023 -0500 Merge tag 'kvm-x86-mmu-6.3' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.3: - Fix and cleanup the range-based TLB flushing code, used when KVM is running on Hyper-V - A few one-off cleanups commit 4f2a5a6b96a00544a0d9e40863f492552fd953e7 Merge: cf8e6cf6e7d61 e73ba25fdc241 Author: Paolo Bonzini Date: Wed Feb 15 08:22:09 2023 -0500 Merge tag 'kvm-x86-misc-6.3' of https://github.com/kvm-x86/linux into HEAD KVM x86 changes for 6.3: - Advertise support for Intel's fancy new fast REP string features - Fix a double-shootdown issue in the emergency reboot code - Ensure GIF=1 and disable SVM during an emergency reboot, i.e. give SVM similar treatment to VMX - Update Xen's TSC info CPUID sub-leaves as appropriate - Add support for Hyper-V's extended hypercalls, where "support" at this point is just forwarding the hypercalls to userspace - Clean up the kvm->lock vs. kvm->srcu sequences when updating the PMU and MSR filters - One-off fixes and cleanups commit f9bb7f6a7eb0efd282f7364115f97e652677a29b Author: Arnd Bergmann Date: Wed Feb 15 10:16:56 2023 +0100 x86/build: Make 64-bit defconfig the default Running 'make ARCH=x86 defconfig' on anything other than an x86_64 machine currently results in a 32-bit build, which is rarely what anyone wants these days. Change the default so that the 64-bit config gets used unless the user asks for i386_defconfig, uses ARCH=i386 or runs on a system that "uname -m" identifies as i386/i486/i586/i686. Signed-off-by: Arnd Bergmann Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20230215091706.1623070-1-arnd@kernel.org commit 926505cf14258376c3cd244e891c7d739a2a049a Author: Charles Keepax Date: Wed Feb 15 10:58:18 2023 +0000 ASoC: cs35l45: Remove separate namespace for tables Now tables isn't a separate module, definitely no need to have a separate namespace for it. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20230215105818.3315925-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 4dac6f5abc02ffeeb10459c575aba2343363d4ee Author: Charles Keepax Date: Wed Feb 15 10:58:17 2023 +0000 ASoC: cs35l45: Remove separate tables module There is no reason to have a separate module for the tables file it just holds regmap callbacks and register patches used by the main part of the driver. Remove the separate module and merge it into the main driver module. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20230215105818.3315925-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 574fbb95cd9d88bdc9c9c4c64223a38a61d7de9a Author: Mika Westerberg Date: Wed Feb 15 13:00:40 2023 +0200 spi: intel: Check number of chip selects after reading the descriptor The flash decriptor contains the number of flash components that we use to figure out how many flash chips there are connected. Therefore we need to read it first before deciding how many chip selects the controller has. Reported-by: Marcin Witkowski Fixes: 3f03c618bebb ("spi: intel: Add support for second flash chip") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg Link: https://lore.kernel.org/r/20230215110040.42186-1-mika.westerberg@linux.intel.com Signed-off-by: Mark Brown commit 91621be65d6812cd74b2ea09573ff9ee0cbf5666 Author: Yang Jihong Date: Wed Feb 15 12:23:24 2023 +0000 perf record: Fix segfault with --overwrite and --max-size When --overwrite and --max-size options of perf record are used together, a segmentation fault occurs. The following is an example: # perf record -e sched:sched* --overwrite --max-size 1K -a -- sleep 1 [ perf record: Woken up 1 times to write data ] perf: Segmentation fault Obtained 12 stack frames. ./perf/perf(+0x197673) [0x55f99710b673] /lib/x86_64-linux-gnu/libc.so.6(+0x3ef0f) [0x7fa45f3cff0f] ./perf/perf(+0x8eb40) [0x55f997002b40] ./perf/perf(+0x1f6882) [0x55f99716a882] ./perf/perf(+0x794c2) [0x55f996fed4c2] ./perf/perf(+0x7b7c7) [0x55f996fef7c7] ./perf/perf(+0x9074b) [0x55f99700474b] ./perf/perf(+0x12e23c) [0x55f9970a223c] ./perf/perf(+0x12e54a) [0x55f9970a254a] ./perf/perf(+0x7db60) [0x55f996ff1b60] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe6) [0x7fa45f3b2c86] ./perf/perf(+0x7dfe9) [0x55f996ff1fe9] Segmentation fault (core dumped) backtrace of the core file is as follows: (gdb) bt #0 record__bytes_written (rec=0x55f99755a200 ) at builtin-record.c:234 #1 record__output_max_size_exceeded (rec=0x55f99755a200 ) at builtin-record.c:242 #2 record__write (map=0x0, size=12816, bf=0x55f9978da2e0, rec=0x55f99755a200 ) at builtin-record.c:263 #3 process_synthesized_event (tool=tool@entry=0x55f99755a200 , event=event@entry=0x55f9978da2e0, sample=sample@entry=0x0, machine=machine@entry=0x55f997893658) at builtin-record.c:618 #4 0x000055f99716a883 in __perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 , process=process@entry=0x55f997002aa0 , evlist=0x55f9978928b0, machine=machine@entry=0x55f997893658, from=from@entry=0) at util/synthetic-events.c:1895 #5 0x000055f99716a91f in perf_event__synthesize_id_index (tool=tool@entry=0x55f99755a200 , process=process@entry=0x55f997002aa0 , evlist=, machine=machine@entry=0x55f997893658) at util/synthetic-events.c:1905 #6 0x000055f996fed4c3 in record__synthesize (tail=tail@entry=true, rec=0x55f99755a200 ) at builtin-record.c:1997 #7 0x000055f996fef7c8 in __cmd_record (argc=argc@entry=2, argv=argv@entry=0x7ffc67551260, rec=0x55f99755a200 ) at builtin-record.c:2802 #8 0x000055f99700474c in cmd_record (argc=, argv=0x7ffc67551260) at builtin-record.c:4258 #9 0x000055f9970a223d in run_builtin (p=0x55f997564d88 , argc=10, argv=0x7ffc67551260) at perf.c:330 #10 0x000055f9970a254b in handle_internal_command (argc=10, argv=0x7ffc67551260) at perf.c:384 #11 0x000055f996ff1b61 in run_argv (argcp=, argv=) at perf.c:428 #12 main (argc=, argv=0x7ffc67551260) at perf.c:562 The reason is that record__bytes_written accesses the freed memory rec->thread_data, The process is as follows: __cmd_record -> record__free_thread_data -> zfree(&rec->thread_data) // free rec->thread_data -> record__synthesize -> perf_event__synthesize_id_index -> process_synthesized_event -> record__write -> record__bytes_written // access rec->thread_data We add a member variable "thread_bytes_written" in the struct "record" to save the data size written by the threads. Fixes: 6d57581659f72299 ("perf record: Add support for limit perf output file size") Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Jiwei Sun Cc: Mark Rutland Cc: Peter Zijlstra Link: https://lore.kernel.org/r/CAM9d7ci_TRrqBQVQNW8=GwakUr7SsZpYxaaty-S4bxF8zJWyqw@mail.gmail.com Signed-off-by: Arnaldo Carvalho de Melo commit a543f7024e35ea548dd483f06d4c871243663622 Author: Heiner Kallweit Date: Tue Feb 14 22:44:03 2023 +0100 mmc: meson-gx: support platform interrupt as card detect interrupt Use a new mmc core feature and support specifying the card detect gpio interrupt in device tree. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/2bb70611-5dea-1144-51bd-93c46b455392@gmail.com Signed-off-by: Ulf Hansson commit 09b31a6103283577ee407c5c22a9be19fd7f7284 Author: Heiner Kallweit Date: Tue Feb 14 22:42:54 2023 +0100 dt-bindings: mmc: meson-gx: support specifying cd interrupt Support passing a second interrupt as card detect interrupt. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/1c5996a5-491f-39d6-b120-bbef86473729@gmail.com Signed-off-by: Ulf Hansson commit 88f94c782b0ee2297685764f942e7c176d6b89aa Author: Heiner Kallweit Date: Tue Feb 14 22:41:19 2023 +0100 mmc: core: support setting card detect interrupt from drivers On certain platforms like Amlogic Meson gpiod_to_irq() isn't supported due to the design of gpio / interrupt controller. Therefore provide an option for drivers to pass the card detect interrupt number (retrieved e.g. from device tree) to mmc core. Suggested-by refers to the mechanism to pass and store the interrupt. Suggested-by: Ulf Hansson Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/5777f38b-465f-ce48-a87f-5eb8b3c57b0a@gmail.com Signed-off-by: Ulf Hansson commit 9e622229bbf4f2204f7a4bc47f9dffb2307e4949 Author: William Qiu Date: Wed Feb 15 19:32:47 2023 +0800 mmc: starfive: Add sdio/emmc driver support Add sdio/emmc driver support for StarFive JH7110 soc. Tested-by: Conor Dooley Signed-off-by: William Qiu Link: https://lore.kernel.org/r/20230215113249.47727-3-william.qiu@starfivetech.com Signed-off-by: Ulf Hansson commit cf8e6cf6e7d61e5c034f4f7bf94263e133a4955d Merge: 7cb79f433e75b 5bad5d55d884d Author: Paolo Bonzini Date: Wed Feb 15 07:30:43 2023 -0500 Merge tag 'kvm-x86-generic-6.3' of https://github.com/kvm-x86/linux into HEAD Common KVM changes for 6.3: - Account allocations in generic kvm_arch_alloc_vm() - Fix a typo and a stale comment - Fix a memory leak if coalesced MMIO unregistration fails commit 28eb8b5c994881e7fc62b7f15e6bf4a4510bb9be Author: William Qiu Date: Wed Feb 15 19:32:46 2023 +0800 dt-bindings: mmc: Add StarFive MMC module Add documentation to describe StarFive designware mobile storage host controller driver. Signed-off-by: William Qiu Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230215113249.47727-2-william.qiu@starfivetech.com Signed-off-by: Ulf Hansson commit 09e8f154fac2a5e9f2c2dfb98f2a64128b259872 Author: Konrad Dybcio Date: Mon Feb 13 21:55:29 2023 +0100 dt-bindings: mmc: sdhci-msm: Allow 1 icc path Some SoCs (like msm8998) only have a SDHC<->DDR path. Allow this case. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230213205529.2104120-1-konrad.dybcio@linaro.org Signed-off-by: Ulf Hansson commit f613feec700f25231e4cfe515c710b9b7c2d1ad1 Author: Lucas Tanure Date: Mon Feb 13 15:27:39 2023 +0000 dt-bindings: mmc: rockchip-dw-mshc: Add RK3588 compatible string Add RK3588 compatible string for SD interface. Co-developed-by: Shawn Lin Signed-off-by: Shawn Lin Signed-off-by: Lucas Tanure Acked-by: Krzysztof Kozlowski Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20230213152740.359055-1-lucas.tanure@collabora.com Signed-off-by: Ulf Hansson commit 51f5b3056790bc0518e49587996f1e6f3058cca9 Author: Ulf Hansson Date: Mon Feb 13 14:37:07 2023 +0100 mmc: core: Align to common busy polling behaviour for mmc ioctls Let's align to the common busy polling behaviour for mmc ioctls, by updating the below two corresponding parts, that comes into play when using an R1B response for a command. *) A command with an R1B response should be prepared by calling mmc_prepare_busy_cmd(), which make us respects the host's busy timeout constraints. **) When an R1B response is being used and the host also supports HW busy detection, we should skip to poll for busy completion. Suggested-by: Christian Loehle Signed-off-by: Ulf Hansson Reviewed-by: Christian Loehle Link: https://lore.kernel.org/r/20230213133707.27857-1-ulf.hansson@linaro.org commit cb7f0901713930896362c2085a04a840b8ddb572 Author: Kunihiko Hayashi Date: Mon Feb 13 13:52:33 2023 +0900 dt-bindings: mmc: Add resets property to cadence SDHCI binding Cadence SDHCI controller allows reset control support on UniPhier SoC. Add resets property to cadence SDHCI binding. Signed-off-by: Kunihiko Hayashi Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230213045233.32470-1-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit 91a3cba783f11c09b11476e64f432b39c933d7e8 Author: Heiner Kallweit Date: Sun Feb 12 22:43:32 2023 +0100 mmc: meson-gx: remove meson_mmc_get_cd MMC core only checks whether return value of .get_cd() equals zero. Therefore -ENOSYS and 1 are effectively the same and the function can be removed. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/16502040-3beb-a3cc-b28d-28184fba0f10@gmail.com Signed-off-by: Ulf Hansson commit 16b492ce0a55735ed6f4c19ee9fb767badb3f19a Author: Sergei Antonov Date: Fri Feb 10 17:38:43 2023 +0300 mmc: moxart: set maximum request/block/segment sizes Per datasheet: maximum block length is 2048 bytes, data length field is in bits 0-23 of the Data Length Register. Also for DMA mode we have to take into account rx/tx buffers' sizes. In my tests this change doubles SD card I/O performance on big files. Before the change Linux used default request size of 4 KB. Signed-off-by: Sergei Antonov Link: https://lore.kernel.org/r/20230210143843.369943-1-saproj@gmail.com Signed-off-by: Ulf Hansson commit 08623d741e94dc9ca033ecb8d04312960a105377 Author: Ye Xingchen Date: Fri Feb 10 16:28:32 2023 +0800 mmc: sdhci-brcmstb: Use devm_platform_get_and_ioremap_resource() Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does. Signed-off-by: Ye Xingchen Link: https://lore.kernel.org/r/202302101628321403257@zte.com.cn Signed-off-by: Ulf Hansson commit b0ae5b6f3c298a005b73556740526c0e24a5633c Author: Sourabh Jain Date: Fri Dec 16 17:57:08 2022 +0530 powerpc/kexec_file: print error string on usable memory property update failure Print the FDT error description along with the error message if failed to set the "linux,drconf-usable-memory" property in the kdump kernel's FDT. Signed-off-by: Sourabh Jain Acked-by: Hari Bathini Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20221216122708.182154-1-sourabhjain@linux.ibm.com commit b16a1756c716235891e298beabd68f3cd6bb5952 Author: Michael S. Tsirkin Date: Thu Dec 22 14:30:13 2022 -0500 virtio_blk: mark all zone fields LE zone is a virtio 1.x feature so all fields are LE, they are handled as such, but have mistakenly been labeled __virtioXX in the header. This results in a bunch of sparse warnings. Use the __leXX tags to make sparse happy. Message-Id: <20221222193214.55146-1-mst@redhat.com> Signed-off-by: Michael S. Tsirkin commit 2a9c844e896b2895cde9fc0276f6243c68d82e70 Author: Michael S. Tsirkin Date: Tue Dec 20 07:37:49 2022 -0500 virtio_blk: zone append in header type tweak virtio blk returns a 64 bit append_sector in an input buffer, in LE format. This field is not tagged as LE correctly, so even though the generated code is ok, we get warnings from sparse: drivers/block/virtio_blk.c:332:33: sparse: sparse: cast to restricted __le64 Make sparse happy by using the correct type. Message-Id: <20221220125154.564265-1-mst@redhat.com> Signed-off-by: Michael S. Tsirkin commit 04e5421e6f61538f510aae9329e77d010159863f Author: Michael S. Tsirkin Date: Tue Dec 20 07:37:49 2022 -0500 virtio_blk: temporary variable type tweak virtblk_result returns blk_status_t which is a bitwise restricted type, so we are not supposed to stuff it in a plain int temporary variable. All we do with it is pass it on to a function expecting blk_status_t so the generated code is ok, but we get warnings from sparse: drivers/block/virtio_blk.c:326:36: sparse: sparse: incorrect type in initializer (different base types) @@ expected int status @@ +got restricted blk_status_t @@ drivers/block/virtio_blk.c:334:33: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted +blk_status_t [usertype] error @@ got int status @@ Make sparse happy by using the correct type. Message-Id: <20221220124152.523531-1-mst@redhat.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi Reviewed-by: Chaitanya Kulkarni commit 95bfec41bd3d39b7659cba65b72080420bf5691e Author: Dmitry Fomichev Date: Sat Oct 15 23:41:27 2022 -0400 virtio-blk: add support for zoned block devices This patch adds support for Zoned Block Devices (ZBDs) to the kernel virtio-blk driver. The patch accompanies the virtio-blk ZBD support draft that is now being proposed for standardization. The latest version of the draft is linked at https://github.com/oasis-tcs/virtio-spec/issues/143 . The QEMU zoned device code that implements these protocol extensions has been developed by Sam Li and it is currently in review at the QEMU mailing list. A number of virtblk request structure changes has been introduced to accommodate the functionality that is specific to zoned block devices and, most importantly, make room for carrying the Zoned Append sector value from the device back to the driver along with the request status. The zone-specific code in the patch is heavily influenced by NVMe ZNS code in drivers/nvme/host/zns.c, but it is simpler because the proposed virtio ZBD draft only covers the zoned device features that are relevant to the zoned functionality provided by Linux block layer. includes the following fixup: virtio-blk: fix probe without CONFIG_BLK_DEV_ZONED When building without CONFIG_BLK_DEV_ZONED, VIRTIO_BLK_F_ZONED is excluded from array of driver features. As a result virtio_has_feature panics in virtio_check_driver_offered_feature since that by design verifies that a feature we are checking for is listed in the feature array. To fix, replace the call to virtio_has_feature with a stub. Message-Id: <20221016034127.330942-3-dmitry.fomichev@wdc.com> Co-developed-by: Stefan Hajnoczi Signed-off-by: Stefan Hajnoczi Signed-off-by: Dmitry Fomichev Message-Id: <20221220112340.518841-1-mst@redhat.com> Reported-by: Linux Kernel Functional Testing Tested-by: Linux Kernel Functional Testing Reported-by: Xuan Zhuo Debugged-by: Xuan Zhuo Tested-by: Anders Roxell Tested-by: Marek Szyprowski Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit d16c0cd27331179daa86a3a489f50ce409121c80 Author: Ricardo Cañuelo Date: Mon Oct 10 08:43:59 2022 +0200 docs: driver-api: virtio: virtio on Linux Basic doc about Virtio on Linux and a short tutorial on Virtio drivers. includes the following fixup: virtio: fix virtio_config_ops kerneldocs Fixes two warning messages when building htmldocs: warning: duplicate section name 'Note' warning: expecting prototype for virtio_config_ops(). Prototype was for vq_callback_t() instead Message-Id: <20221010064359.1324353-2-ricardo.canuelo@collabora.com> Signed-off-by: Ricardo Cañuelo Reviewed-by: Cornelia Huck Message-Id: <20221220100035.2712449-1-ricardo.canuelo@collabora.com> Reported-by: Stephen Rothwell Reviewed-by: Bagas Sanjaya Signed-off-by: Michael S. Tsirkin commit d5ff73bbb03e69bd92f1f7f134bbfa16624ad42b Author: Michael Sammler Date: Tue Nov 15 21:40:36 2022 +0000 virtio_pmem: populate numa information Compute the numa information for a virtio_pmem device from the memory range of the device. Previously, the target_node was always 0 since the ndr_desc.target_node field was never explicitly set. The code for computing the numa node is taken from cxl_pmem_region_probe in drivers/cxl/pmem.c. Signed-off-by: Michael Sammler Reviewed-by: Pasha Tatashin Reviewed-by: Pankaj Gupta Tested-by: Mina Almasry Message-Id: <20221115214036.1571015-1-sammler@google.com> Signed-off-by: Michael S. Tsirkin commit 388defd5e4180a48e068d7ba9b024ce0ca957968 Author: Nathan Lynch Date: Mon Feb 13 13:23:51 2023 -0600 powerpc/machdep: warn when machine_is() used too early machine_is() can't provide correct results before probe_machine() has run. Warn when it's used too early in boot, placing the WARN_ON() in a helper function so the reported file:line indicates exactly what went wrong. checkpatch complains about __attribute__((weak)) in the patch, so change that to __weak, and align the line continuations as well. Signed-off-by: Nathan Lynch Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230210-warn-on-machine-is-before-probe-machine-v2-1-b57f8243c51c@linux.ibm.com commit 77e82fa1f9781a958a6ea4aed7aec41239a5a22f Author: Christophe Leroy Date: Mon Dec 19 19:45:58 2022 +0100 powerpc/64: Replace -mcpu=e500mc64 by -mcpu=e5500 E500MC64 is a processor pre-dating E5500 that has never been commercialised. Use -mcpu=e5500 for E5500 core. More details at https://gcc.gnu.org/PR108149 Signed-off-by: Christophe Leroy Acked-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/fa71ed20d22c156225436374f0ab847daac893bc.1671475543.git.christophe.leroy@csgroup.eu commit 9efcdaac36e1643a1b7f5337e6143ce142d381b1 Author: Ganesh Goudar Date: Thu Feb 9 16:26:49 2023 +0530 powerpc/eeh: Set channel state after notifying the drivers When a PCI error is encountered 6th time in an hour we set the channel state to perm_failure and notify the driver about the permanent failure. However, after upstream commit 38ddc011478e ("powerpc/eeh: Make permanently failed devices non-actionable"), EEH handler stops calling any routine once the device is marked as permanent failure. This issue can lead to fatal consequences like kernel hang with certain PCI devices. Following log is observed with lpfc driver, with and without this change, Without this change kernel hangs, If PCI error is encountered 6 times for a device in an hour. Without the change EEH: Beginning: 'error_detected(permanent failure)' PCI 0132:60:00.0#600000: EEH: not actionable (1,1,1) PCI 0132:60:00.1#600000: EEH: not actionable (1,1,1) EEH: Finished:'error_detected(permanent failure)' With the change EEH: Beginning: 'error_detected(permanent failure)' EEH: Invoking lpfc->error_detected(permanent failure) EEH: lpfc driver reports: 'disconnect' EEH: Invoking lpfc->error_detected(permanent failure) EEH: lpfc driver reports: 'disconnect' EEH: Finished:'error_detected(permanent failure)' To fix the issue, set channel state to permanent failure after notifying the drivers. Fixes: 38ddc011478e ("powerpc/eeh: Make permanently failed devices non-actionable") Suggested-by: Mahesh Salgaonkar Signed-off-by: Ganesh Goudar Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230209105649.127707-1-ganeshgr@linux.ibm.com commit 4f11410bf6da87defe8fd59b0413f0d9f71744da Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:42 2023 -0500 selftests/powerpc: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: Mathieu Desnoyers Acked-by: Shuah Khan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230127135755.79929-22-mathieu.desnoyers@efficios.com commit 83e0f265aa8d0e37cc8e15d318b64da0ec03ff41 Merge: 94817983fb2cc 05165248df655 Author: Mauro Carvalho Chehab Date: Wed Feb 15 12:40:21 2023 +0100 Merge git://git.linuxtv.org/media_stage into media_tree * git://git.linuxtv.org/media_stage: (216 commits) media: v4l2-ctrls-api.c: move ctrl->is_new = 1 to the correct line media: Revert "media: saa7146: deprecate hexium_gemini/orion, mxb and ttpci" media: Revert "media: av7110: move to staging/media/deprecated/saa7146" media: imx-pxp: convert to regmap media: imx-pxp: Use non-threaded IRQ media: imx-pxp: Introduce pxp_read() and pxp_write() wrappers media: imx-pxp: Implement frame size enumeration media: imx-pxp: Pass pixel format value to find_format() media: imx-pxp: Add media controller support media: imx-pxp: Don't set bus_info manually in .querycap() media: imx-pxp: Sort headers alphabetically media: imx-pxp: add support for i.MX7D media: imx-pxp: make data_path_ctrl0 platform dependent media: imx-pxp: disable LUT block media: imx-pxp: explicitly disable unused blocks media: imx-pxp: extract helper function to setup data path media: imx-pxp: detect PXP version media: dt-bindings: media: fsl-pxp: convert to yaml media: imx-mipi-csis: Implement .init_cfg() using .set_fmt() media: imx-mipi-csis: Use V4L2 subdev active state ... Signed-off-by: Mauro Carvalho Chehab commit 4ca446b127c568b59cb8d9748b6f70499624bb18 Author: Dan Carpenter Date: Tue Feb 14 18:43:38 2023 +0300 iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either "listen_ep" or "ep". The problem is that "epcp" has been re-assigned so just testing "if (epcp->state == LISTEN) {" a second time is not sufficient. Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Y+usKuWIKr4dimZh@kili Signed-off-by: Leon Romanovsky commit 19ac99072e679f1e3807603206e3f3b1a7c14729 Author: Jon Hunter Date: Thu Feb 9 12:53:19 2023 +0000 usb: gadget: u_ether: Don't warn in gether_setup_name_default() The function gether_setup_name_default() is called by various USB ethernet gadget drivers. Calling this function will select a random host and device MAC addresses. A properly working driver should be silent and not warn the user about default MAC addresses selection. Given that the MAC addresses are also printed when the function gether_register_netdev() is called, remove these unnecessary warnings. Signed-off-by: Jon Hunter Reviewed-by: Andrzej Pietrasiewicz Link: https://lore.kernel.org/r/20230209125319.18589-2-jonathanh@nvidia.com Signed-off-by: Greg Kroah-Hartman commit 938fc645317632d79c048608689683b5437496ea Author: Jon Hunter Date: Thu Feb 9 12:53:18 2023 +0000 usb: gadget: u_ether: Convert prints to device prints The USB ethernet gadget driver implements its own print macros which call printk. Device drivers should use the device prints that print the device name. Fortunately, the same macro names are defined in the header file 'linux/usb/composite.h' and these use the device prints. Therefore, remove the local definitions in the USB ethernet gadget driver and use those in 'linux/usb/composite.h'. The only difference is that now the device name is printed instead of the ethernet interface name. Tested using ethernet gadget on Jetson AGX Orin. Signed-off-by: Jon Hunter Tested-by: Jon Hunter Link: https://lore.kernel.org/r/20230209125319.18589-1-jonathanh@nvidia.com Signed-off-by: Greg Kroah-Hartman commit ade1229caed9433921b69e20bd6fadf1bba9558e Author: Greg Kroah-Hartman Date: Tue Feb 14 15:01:21 2023 +0100 dma-mapping: no need to pass a bus_type into get_arch_dma_ops() The get_arch_dma_ops() arch-specific function never does anything with the struct bus_type that is passed into it, so remove it entirely as it is not needed. Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: Thomas Bogendoerfer Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: x86@kernel.org Cc: "H. Peter Anvin" Cc: Marek Szyprowski Cc: Robin Murphy Cc: Konrad Rzeszutek Wilk Cc: linux-alpha@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-ia64@vger.kernel.org Cc: linux-mips@vger.kernel.org Cc: linux-parisc@vger.kernel.org Cc: sparclinux@vger.kernel.org Cc: iommu@lists.linux.dev Cc: linux-arch@vger.kernel.org Acked-by: Christoph Hellwig Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230214140121.131859-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 50a542a8accc12afd802488f95317155496692f1 Author: Jason Gunthorpe Date: Mon Feb 13 14:14:11 2023 -0400 RDMA/mlx5: Use rdma_umem_for_each_dma_block() Replace an open coding of rdma_umem_for_each_dma_block() with the proper function. Fixes: b3d47ebd4908 ("RDMA/mlx5: Use mlx5_umr_post_send_wait() to update MR pas") Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/0-v1-c13a5b88359b+556d0-mlx5_umem_block_jgg@nvidia.com Reviewed-by: Devesh Sharma Signed-off-by: Leon Romanovsky commit 1b136aeb3c4a122fcca014db09c4db9766403c86 Author: Bastien Nocera Date: Thu Feb 9 16:49:16 2023 +0100 HID: logitech-hidpp: Add myself to authors As discussed with HID maintainer Benjamin Tissoires, add myself to the authors list and MAINTAINERS file. Signed-off-by: Bastien Nocera Link: https://lore.kernel.org/r/20230209154916.462158-2-hadess@hadess.net Signed-off-by: Benjamin Tissoires commit 586e8fede7953b1695b5ccc6112eff9b052e79ac Author: Bastien Nocera Date: Thu Feb 9 16:49:15 2023 +0100 HID: logitech-hidpp: Retry commands when device is busy Handle the busy error coming from the device or receiver. The documentation says a busy error can be returned when: " Device (or receiver) cannot answer immediately to this request for any reason i.e: - already processing a request from the same or another SW - pipe full " Signed-off-by: Bastien Nocera Link: https://lore.kernel.org/r/20230209154916.462158-1-hadess@hadess.net Signed-off-by: Benjamin Tissoires commit 894341ad3ad7dfbced8556efe92a9ebfd5924bd6 Author: Ivan Bornyakov Date: Fri Feb 10 18:46:27 2023 +0300 net: phylink: support validated pause and autoneg in fixed-link In fixed-link setup phylink_parse_fixedlink() unconditionally sets Pause, Asym_Pause and Autoneg bits to "supported" bitmap, while MAC may not support these. This leads to ethtool reporting: > Supported pause frame use: Symmetric Receive-only > Supports auto-negotiation: Yes regardless of what is actually supported. Instead of unconditionally set Pause, Asym_Pause and Autoneg it is sensible to set them according to validated "supported" bitmap, i.e. the result of phylink_validate(). Signed-off-by: Ivan Bornyakov Signed-off-by: David S. Miller commit fe33311c3e371855c4f4c0ab8a5fce5b9a9fdafd Author: Jason Xing Date: Tue Feb 14 12:14:10 2023 +0800 net: no longer support SOCK_REFCNT_DEBUG feature Commit e48c414ee61f ("[INET]: Generalise the TCP sock ID lookup routines") commented out the definition of SOCK_REFCNT_DEBUG in 2005 and later another commit 463c84b97f24 ("[NET]: Introduce inet_connection_sock") removed it. Since we could track all of them through bpf and kprobe related tools and the feature could print loads of information which might not be that helpful even under a little bit pressure, the whole feature which has been inactive for many years is no longer supported. Link: https://lore.kernel.org/lkml/20230211065153.54116-1-kerneljasonxing@gmail.com/ Suggested-by: Kuniyuki Iwashima Signed-off-by: Jason Xing Reviewed-by: Kuniyuki Iwashima Acked-by: Wenjia Zhang Reviewed-by: Eric Dumazet Acked-by: Matthieu Baerts Signed-off-by: David S. Miller commit 6472a2dcc4274452bb46fb5a0d968a1c1ed772ee Author: Heiko Carstens Date: Mon Feb 13 12:35:19 2023 +0100 s390/irq,idle: simplify idle check Use the per-cpu CIF_ENABLED_WAIT flag to decide if an interrupt occurred while a cpu was idle, instead of checking two conditions within the old psw. Also move clearing of the CIF_ENABLED_WAIT bit to the early interrupt handler, which in turn makes arch_vcpu_is_preempted() also a bit more precise, since the flag is now cleared before interrupt handlers have been called. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit f96f41aae2b5bd34d32f462c7b45c0f4fad2b59e Author: Heiko Carstens Date: Mon Feb 13 12:35:18 2023 +0100 s390/processor: add test_and_set_cpu_flag() and test_and_clear_cpu_flag() Add test_and_set_cpu_flag() and test_and_clear_cpu_flag() helper functions. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit b977f03ec44aef7f6728bfe1a48f3ee5b0776001 Author: Heiko Carstens Date: Mon Feb 13 12:35:17 2023 +0100 s390/processor: let cpu helper functions return boolean values Let cpu helper functions return boolean values. This also allows to make the code a bit simpler by getting rid of the "!!" construct. Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens commit d9c2cf67b9cfd643ba85d51bc865a89a92e4f979 Author: Heiko Carstens Date: Mon Feb 13 19:38:58 2023 +0100 s390/kfence: fix page fault reporting Baoquan He reported lots of KFENCE reports when /proc/kcore is read, e.g. with crash or even simpler with dd: BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x5e/0x120 Invalid read at 0x00000000f4f5149f: copy_from_kernel_nofault+0x5e/0x120 read_kcore+0x6b2/0x870 proc_reg_read+0x9a/0xf0 vfs_read+0x94/0x270 ksys_read+0x70/0x100 __do_syscall+0x1d0/0x200 system_call+0x82/0xb0 The reason for this is that read_kcore() simply reads memory that might have been unmapped by KFENCE with copy_from_kernel_nofault(). Any fault due to pages being unmapped by KFENCE would be handled gracefully by the fault handler (exception table fixup). However the s390 fault handler first reports the fault, and only afterwards would perform the exception table fixup. Most architectures have this in reversed order, which also avoids the false positive KFENCE reports when an unmapped page is accessed. Therefore change the s390 fault handler so it handles exception table fixups before KFENCE page faults are reported. Reported-by: Baoquan He Tested-by: Baoquan He Acked-by: Alexander Potapenko Link: https://lore.kernel.org/r/20230213183858.1473681-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit ad0faae6ceab7d138dddf9a58eab7151c519e0d3 Author: Harald Freudenberger Date: Tue Feb 8 16:59:47 2022 +0100 s390/zcrypt: introduce ctfm field in struct CPRBX Modify the CPRBX struct to expose a new field ctfm for use with hardware command filtering within a CEX8 crypto card in CCA coprocessor mode. The field replaces a reserved byte padding field so that the layout of the struct and the size does not change. The new field is used only by user space applications which may use this to expose the HW filtering facilities in the crypto firmware layers. Signed-off-by: Harald Freudenberger Signed-off-by: Heiko Carstens commit 38b2d8efd03d2e56431b611e3523f0158306451d Author: Darrell Kavanagh Date: Tue Feb 14 16:46:59 2023 +0000 drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5 Another Lenovo convertable where the panel is installed landscape but is reported to the kernel as portrait. Signed-off-by: Darrell Kavanagh Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Link: https://patchwork.freedesktop.org/patch/msgid/20230214164659.3583-1-darrell.kavanagh@gmail.com commit 22551e77e5507a06114c0af2b92bbf1a66ec33c5 Author: Mark Zhang Date: Wed Jan 4 20:17:56 2023 -0800 net/mlx5: Configure IPsec steering for egress RoCEv2 traffic Add steering table/rule in RDMA_TX domain, to forward all traffic to IPsec crypto table in NIC domain. Signed-off-by: Mark Zhang Signed-off-by: Patrisious Haddad Reviewed-by: Raed Salem Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 899577600b25b338072095009d4c578fbd936177 Author: Mark Zhang Date: Wed Jan 4 20:17:55 2023 -0800 net/mlx5: Configure IPsec steering for ingress RoCEv2 traffic Add steering tables/rules to check if the decrypted traffic is RoCEv2, if so then forward it to RDMA_RX domain. Signed-off-by: Mark Zhang Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Reviewed-by: Raed Salem Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit f91ddd3aa4b313aa4b792d1588ccb63c3e4ace0b Author: Mark Zhang Date: Wed Jan 4 20:17:54 2023 -0800 net/mlx5: Add IPSec priorities in RDMA namespaces Add IPSec flow steering priorities in RDMA namespaces. This allows adding tables/rules to forward RoCEv2 traffic to the IPSec crypto tables in NIC_TX domain, and accept RoCEv2 traffic from NIC_RX domain. Signed-off-by: Mark Zhang Signed-off-by: Patrisious Haddad Reviewed-by: Maor Gottlieb Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 4f226b71f5edc33843e21f92ebe97b1561804d52 Author: Mark Zhang Date: Wed Jan 4 20:17:53 2023 -0800 net/mlx5: Implement new destination type TABLE_TYPE Implement new destination type to support flow transition between different table types. e.g. from NIC_RX to RDMA_RX or from RDMA_TX to NIC_TX. The new destination is described in the tracepoint as follows: "mlx5_fs_add_rule: rule=00000000d53cd0ed fte=0000000048a8a6ed index=0 sw_action=<> [dst] flow_table_type=7 id:262152" Signed-off-by: Mark Zhang Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit 7368f221e09eac116050475bec5a292a85c5ea8a Author: Patrisious Haddad Date: Wed Jan 4 20:17:52 2023 -0800 net/mlx5: Introduce new destination type TABLE_TYPE This new destination type supports flow transition between different table types, e.g. from NIC_RX to RDMA_RX or from RDMA_TX to NIC_TX. Signed-off-by: Patrisious Haddad Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky commit ce1ba4d782d94fc8ed9116c774e2e5885626836b Author: Chin-Yen Lee Date: Tue Feb 14 19:43:14 2023 +0800 wifi: rtw89: move H2C of del_pkt_offload before polling FW status ready The H2C of del_pkt_offload must be called before polling FW status ready, otherwise the following downloading normal FW will fail. Fixes: 5c12bb66b79d ("wifi: rtw89: refine packet offload flow") Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230214114314.5268-1-pkshih@realtek.com commit 210871887208d1098d65b9bb597e7f9aa1c66900 Author: Ping-Ke Shih Date: Mon Feb 13 17:13:28 2023 +0800 wifi: rtw89: use readable return 0 in rtw89_mac_cfg_ppdu_status() For normal (successful) flow, it must return 0. The original code uses 'return ret', and then we need to backward reference to initial value to know 'ret = 0'. Changing them to 'return 0', because it will be more readable and intuitive. This patch doesn't change logic at all. Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202302101023.ctlih5q0-lkp@intel.com/ Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230213091328.25481-1-pkshih@realtek.com commit 462c8db6a01160836c68e262d25566f2447148d9 Author: Sascha Hauer Date: Fri Feb 10 12:16:32 2023 +0100 wifi: rtw88: usb: drop now unnecessary URB size check Now that we send URBs with the URB_ZERO_PACKET flag set we no longer need to make sure that the URB sizes are not multiple of the bulkout_size. Drop the check. Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230210111632.1985205-4-s.hauer@pengutronix.de commit 07ce9fa6ab0e5e4cb5516a1f7c754ab2758fe5cd Author: Sascha Hauer Date: Fri Feb 10 12:16:31 2023 +0100 wifi: rtw88: usb: send Zero length packets if necessary Zero length packets are necessary when sending URBs with size multiple of bulkout_size, otherwise the hardware just stalls. Fixes: a82dfd33d1237 ("wifi: rtw88: Add common USB chip support") Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230210111632.1985205-3-s.hauer@pengutronix.de commit 7869b834fb07c79933229840c98b02bbb7bd0d75 Author: Sascha Hauer Date: Fri Feb 10 12:16:30 2023 +0100 wifi: rtw88: usb: Set qsel correctly We have to extract qsel from the skb before doing skb_push() on it, otherwise qsel will always be 0. Fixes: a82dfd33d1237 ("wifi: rtw88: Add common USB chip support") Signed-off-by: Sascha Hauer Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230210111632.1985205-2-s.hauer@pengutronix.de commit fb533473d1595fe79ecb528fda1de33552b07178 Author: Namjae Jeon Date: Sat Feb 11 00:27:34 2023 +0900 ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length ksmbd allowed the actual frame length to be smaller than the rfc1002 length. If allowed, it is possible to allocates a large amount of memory that can be limited by credit management and can eventually cause memory exhaustion problem. This patch do not allow it except SMB2 Negotiate request which will be validated when message handling proceeds. Also, Allow a message that padded to 8byte boundary. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 8f8c43b125882ac14372f8dca0c8e50a59e78d79 Author: Namjae Jeon Date: Wed Feb 8 09:50:46 2023 +0900 ksmbd: fix wrong data area length for smb2 lock request When turning debug mode on, The following error message from ksmbd_smb2_check_message() is coming. ksmbd: cli req padded more than expected. Length 112 not 88 for cmd:10 mid:14 data area length calculation for smb2 lock request in smb2_get_data_area_len() is incorrect. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 63f09a9986eb58578ed6ad0e27a6e2c54e49f797 Author: Jiapeng Chong Date: Wed Feb 8 09:30:30 2023 +0900 ksmbd: Fix parameter name and comment mismatch fs/ksmbd/vfs.c:965: warning: Function parameter or member 'attr_value' not described in 'ksmbd_vfs_setxattr'. Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3946 Signed-off-by: Jiapeng Chong Acked-by: Namjae Jeon Reviewed-by: Sergey Senozhatsky Signed-off-by: Steve French commit 9a5c09dd97014e7f3dc3a440d2ee67fdb33dcc6e Merge: 3863f2a431f9b 75c53905f8738 Author: Palmer Dabbelt Date: Tue Feb 14 21:33:27 2023 -0800 Merge patch series "Remove toolchain dependencies for Zicbom" Conor Dooley says: From: Conor Dooley I've yoinked patch 1 from Drew's series adding support for Zicboz & attached two more patches here that remove the need for, and then drop the toolchain support checks for Zicbom. The goal is to remove the need for checking the presence of toolchain Zicbom support in the work being done to support non instruction based CMOs [1]. I've tested compliation on a number of different configurations with the Zicbom config option enabled. The important ones to call out I guess are: - clang/llvm 14 w/ LLVM=1 which doesn't support Zicbom atm. - gcc 11 w/ binutils 2.37 which doesn't support Zicbom atm either. - clang/llvm 15 w/ LLVM=1 BUT with binutils 2.37's ld. This is the configuration that prompted adding the LD checks as cc/as supports Zicbom, but ld doesn't [2]. - gcc 12 w/ binutils 2.39 & clang 15 w/ LLVM=1, both of these supported Zicbom before and still do. I also checked building the THEAD errata etc with CONFIG_RISCV_ISA_ZICBOM disabled, and there were no build issues there either. * b4-shazam-merge: RISC-V: remove toolchain version checks for Zicbom RISC-V: replace cbom instructions with an insn-def RISC-V: insn-def: Add I-type insn-def Link: https://lore.kernel.org/r/20230108163356.3063839-1-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 75c53905f8738fecf691a78de401250e298900f9 Author: Conor Dooley Date: Sun Jan 8 16:33:56 2023 +0000 RISC-V: remove toolchain version checks for Zicbom Commit b8c86872d1dc ("riscv: fix detection of toolchain Zicbom support") fixed building on systems where Zicbom was supported by the compiler/assembler but not by the linker in an easily backportable manner. Now that the we have insn-defs for the 3 instructions, toolchain support is no longer required for Zicbom. Stop emitting "_zicbom" in -march when Zicbom is enabled & drop the version checks entirely. Signed-off-by: Conor Dooley Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230108163356.3063839-4-conor@kernel.org Signed-off-by: Palmer Dabbelt commit dd23e9535889c8b8d7ea7d6064ad16be903f4270 Author: Conor Dooley Date: Sun Jan 8 16:33:55 2023 +0000 RISC-V: replace cbom instructions with an insn-def Using the cbom instructions directly in ALT_CMO_OP, requires toolchain support for the instructions. Using an insn-def will allow for removal of toolchain version checks in the build system & simplification of the proposed [1] function-based CMO scheme. Link: https://lore.kernel.org/linux-riscv/fb3b34ae-e35e-4dc2-a8f4-19984a2f58a8@app.fastmail.com/ [1] Signed-off-by: Conor Dooley Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230108163356.3063839-3-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 6067c3aae52f14b025d0a4de5d4d1eb16eb8fe51 Author: Andrew Jones Date: Sun Jan 8 16:33:54 2023 +0000 RISC-V: insn-def: Add I-type insn-def CBO instructions use the I-type of instruction format where the immediate is used to identify the CBO instruction type. Add I-type instruction encoding support to insn-def. Signed-off-by: Andrew Jones Reviewed-by: Conor Dooley Reviewed-by: Heiko Stuebner Signed-off-by: Conor Dooley Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230108163356.3063839-2-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 1ed32ad4a3cb7c6a8764510565e15ab46b5fdd19 Author: Jakub Kicinski Date: Mon Feb 13 20:32:46 2023 -0800 netlink-specs: add rx-push to ethtool family Commit 5b4e9a7a71ab ("net: ethtool: extend ringparam set/get APIs for rx_push") added a new attr for configuring rx-push, right after tx-push. Add it to the spec, the ring param operation is covered by the otherwise sparse ethtool spec. Reviewed-by: Shannon Nelson Link: https://lore.kernel.org/r/20230214043246.230518-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1daa8e25ed971eca8cd8c8dfd4d6d6541b1d62a2 Merge: 56193cf96f00e b2793517052d9 Author: Jakub Kicinski Date: Tue Feb 14 20:48:10 2023 -0800 Merge branch 'net-make-kobj_type-structures-constant' Thomas Weißschuh says: ==================== net: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. ==================== Link: https://lore.kernel.org/r/20230211-kobj_type-net-v2-0-013b59e59bf3@weissschuh.net Signed-off-by: Jakub Kicinski commit b2793517052d9771fbc0bc3db09693aa850eb3de Author: Thomas Weißschuh Date: Tue Feb 14 04:23:12 2023 +0000 net-sysfs: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Signed-off-by: Jakub Kicinski commit e8c6cbd7656e4cea9e2336a3a85bd609dd76eb3d Author: Thomas Weißschuh Date: Tue Feb 14 04:23:11 2023 +0000 net: bridge: make kobj_type structure constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definition to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Acked-by: Nikolay Aleksandrov Signed-off-by: Jakub Kicinski commit 56193cf96f00e9ae4fc95d31c9725c3642ef1e99 Merge: 2edd92570441d 3f3741c9039fe Author: Jakub Kicinski Date: Tue Feb 14 20:39:40 2023 -0800 Merge branch 'net-ipa-define-gsi-register-fields-differently' Alex Elder says: ==================== net: ipa: define GSI register fields differently Now that we have "reg" definitions in place to define GSI register offsets, add the definitions for the fields of GSI registers that have them. There aren't many differences between versions, but a few fields are present only in some versions of IPA, so additional "gsi_reg-vX.Y.c" files are created to capture such differences. As in the previous series, these files are created as near-copies of existing files just before they're needed to represent these differences. The first patch adds files for IPA v4.0, v4.5, and v4.9; the fifth patch adds a file for IPA v4.11. Note that the first and fifth patch cause some checkpatch warnings because they align some continued lines with an open parenthesis that at the fourth column. ==================== Link: https://lore.kernel.org/r/20230213162229.604438-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit 3f3741c9039fe20ff2512301af05c83c06f06165 Author: Alex Elder Date: Mon Feb 13 10:22:29 2023 -0600 net: ipa: define fields for remaining GSI registers Define field IDs for the remaining GSI registers, and populate the register definition files accordingly. Use the reg_*() functions to access field values for those regiters, and get rid of the previous field definition constants. Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit aa07fd4358f53bc627c504a669408c23158dbdb9 Author: Alex Elder Date: Mon Feb 13 10:22:28 2023 -0600 net: ipa: add "gsi_v4.11.c" The next patch adds a GSI register field that is only valid starting at IPA v4.11. Create "gsi_v4.11.c" from "gsi_v4.9.c", changing only the name of the public regs structure it defines. Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit edc6158b18af81e6f48268479996a16ca7599a4e Author: Alex Elder Date: Mon Feb 13 10:22:27 2023 -0600 net: ipa: define fields for event-ring related registers Define field IDs for the EV_CH_E_CNTXT_0 and EV_CH_E_CNTXT_8 GSI registers, and populate the register definition files accordingly. Use the reg_*() functions to access field values for those regiters, and get rid of the previous field definition constants. The remaining EV_CH_E_CNTXT_* registers are written with full 32-bit values (and have no fields). Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 330ce9d3462e825c44368f58c32d2e2fcf819128 Author: Alex Elder Date: Mon Feb 13 10:22:26 2023 -0600 net: ipa: define more fields for GSI registers Beyond the CH_C_QOS register, two other registers whose offset is related to channel number have fields within them. Define the fields within the CH_C_CNTXT_0 GSI register, using an enumerated type to identify the register's fields, and define an array of field masks to use for that register's reg structure. For the CH_C_CNTXT_1 GSI register, ch_c_cntxt_1_length_encode() previously hid the difference in bit width in the channel ring length field. Instead, define a new field CH_R_LENGTH and encode the ring size with reg_encode(). Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit f50ca7cef7c7ceff2b66b610ac5ab17aac36df6a Author: Alex Elder Date: Mon Feb 13 10:22:25 2023 -0600 net: ipa: define GSI CH_C_QOS register fields Define the fields within the CH_C_QOS GSI register using an array of field masks in that register's reg structure. Use the reg functions for encoding values in those fields. One field in the register is present for IPA v4.0-4.2 only, two others are present starting at IPA v4.5, and one more is there starting at IPA v4.9. Drop the "GSI_" prefix in symbols defined in the gsi_prefetch_mode enumerated type, and define their values using decimal rather than hexidecimal values. Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 4a4270cff65f4e566b56814d37a1a4f8d49adeb1 Author: Alex Elder Date: Mon Feb 13 10:22:24 2023 -0600 net: ipa: populate more GSI register files Create "gsi_v4.0.c", "gsi_v4.5.c", and "gsi_v4.9.c" as essentially identical copies of "gsi_v3.5.1.c". The only difference is the name of the exported "gsi_regs_vX_Y" structure. The next patch will start differentiating them. Signed-off-by: Alex Elder Signed-off-by: Jakub Kicinski commit 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 Author: Bjorn Andersson Date: Tue Feb 14 15:42:31 2023 -0800 rpmsg: glink: Avoid infinite loop on intent for missing channel In the event that an intent advertisement arrives on an unknown channel the fifo is not advanced, resulting in the same message being handled over and over. Fixes: dacbb35e930f ("rpmsg: glink: Receive and store the remote intent buffers") Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230214234231.2069751-1-quic_bjorande@quicinc.com commit 4e816d0318fdfe8932da80dbf04ba318b13e4b3a Author: Bjorn Andersson Date: Tue Feb 14 14:59:33 2023 -0800 rpmsg: glink: Fix GLINK command prefix The upstream GLINK driver was first introduced to communicate with the RPM on MSM8996, presumably as an artifact from that era the command defines was prefixed RPM_CMD, while they actually are GLINK_CMDs. Let's rename these, to keep things tidy. No functional change. Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230214225933.2025595-1-quic_bjorande@quicinc.com commit a8f500c68673d385b437da678aaf9ebba0ab9db0 Author: Bjorn Andersson Date: Tue Feb 14 14:47:46 2023 -0800 rpmsg: glink: Fix spelling of peek The code is peeking into the buffers, not peaking. Fix this throughout the glink drivers. Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230214224746.1996130-1-quic_bjorande@quicinc.com commit 3863f2a431f9bc01053f92f8b56852c121bf54e0 Merge: d5a7fab7859dc 991994509ee93 Author: Palmer Dabbelt Date: Tue Feb 14 19:25:10 2023 -0800 Merge patch series "dt-bindings: Add a cpu-capacity property for RISC-V" Conor Dooley says: From: Conor Dooley Ever since RISC-V starting using generic arch topology code, the code paths for cpu-capacity have been there but there's no binding defined to actually convey the information. Defining the same property as used on arm seems to be the only logical thing to do, so do it. [Palmer: This is on top of the fix required to make it work, which itself wasn't merged until late in the 6.2 cycle and thus pulls in various other fixes.] * b4-shazam-merge: dt-bindings: riscv: add a capacity-dmips-mhz cpu property dt-bindings: arm: move cpu-capacity to a shared loation riscv: Move call to init_cpu_topology() to later initialization stage riscv/kprobe: Fix instruction simulation of JALR riscv: fix -Wundef warning for CONFIG_RISCV_BOOT_SPINWAIT MAINTAINERS: add an IRC entry for RISC-V RISC-V: fix compile error from deduplicated __ALTERNATIVE_CFG_2 dt-bindings: riscv: fix single letter canonical order dt-bindings: riscv: fix underscore requirement for multi-letter extensions riscv: uaccess: fix type of 0 variable on error in get_user() riscv, kprobes: Stricter c.jr/c.jalr decoding Link: https://lore.kernel.org/r/20230104180513.1379453-1-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 991994509ee93f7698251e696b8e5591e01b7f68 Author: Conor Dooley Date: Wed Jan 4 18:05:14 2023 +0000 dt-bindings: riscv: add a capacity-dmips-mhz cpu property Since commit 03f11f03dbfe ("RISC-V: Parse cpu topology during boot.") RISC-V has used the generic arch topology code, which provides for disparate CPU capacities. We never defined a binding to acquire this information from the DT though, so document the one already used by the generic arch topology code: "capacity-dmips-mhz". Signed-off-by: Conor Dooley Reviewed-by: Ley Foon Tan Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230104180513.1379453-3-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 7d2078310cbf0fa7fb4323d595fe093c418dcd37 Author: Conor Dooley Date: Wed Jan 4 18:05:13 2023 +0000 dt-bindings: arm: move cpu-capacity to a shared loation RISC-V uses the same generic topology code as arm64 & while there currently exists no binding for cpu-capacity on RISC-V, the code paths can be hit if the property is present. Move the documentation of cpu-capacity to a shared location, ahead of defining a binding for capacity-dmips-mhz on RISC-V. Update some references to this document in the process. Signed-off-by: Conor Dooley Reviewed-by: Ley Foon Tan Acked-by: Rob Herring Reviewed-by: Yanteng Si Link: https://lore.kernel.org/r/20230104180513.1379453-2-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 3ef6d9b31af2668bb50cc8b53caa39f53fc2106d Merge: 65b07ecfaba9b b1dec4e78599a Author: Stephen Boyd Date: Tue Feb 14 18:43:54 2023 -0800 Merge tag 'renesas-clk-for-v6.3-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull one more Renesas clk driver update from Geert Uytterhoeven: - Disable R-Car H3 ES1.*, as it was only available to an internal development group and needed a lot of quirks and workarounds. * tag 'renesas-clk-for-v6.3-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: rcar-gen3: Disable R-Car H3 ES1.* commit 240930fb7e6b52229bdee5b1423bfeab0002fed2 Author: Zhang Yi Date: Mon Dec 26 14:20:15 2022 +0800 ext4: dio take shared inode lock when overwriting preallocated blocks In the dio write path, we only take shared inode lock for the case of aligned overwriting initialized blocks inside EOF. But for overwriting preallocated blocks, it may only need to split unwritten extents, this procedure has been protected under i_data_sem lock, it's safe to release the exclusive inode lock and take shared inode lock. This could give a significant speed up for multi-threaded writes. Test on Intel Xeon Gold 6140 and nvme SSD with below fio parameters. direct=1 ioengine=libaio iodepth=10 numjobs=10 runtime=60 rw=randwrite size=100G And the test result are: Before: bs=4k IOPS=11.1k, BW=43.2MiB/s bs=16k IOPS=11.1k, BW=173MiB/s bs=64k IOPS=11.2k, BW=697MiB/s After: bs=4k IOPS=41.4k, BW=162MiB/s bs=16k IOPS=41.3k, BW=646MiB/s bs=64k IOPS=13.5k, BW=843MiB/s Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20221226062015.3479416-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 60b730a40c43fbcc034970d3e77eb0f25b8cc1cf Author: Darrick J. Wong Date: Tue Feb 14 17:51:35 2023 -0800 xfs: fix uninitialized variable access If the end position of a GETFSMAP query overlaps an allocated space and we're using the free space info to generate fsmap info, the akeys information gets fed into the fsmap formatter with bad results. Zero-init the space. Reported-by: syzbot+090ae72d552e6bd93cfe@syzkaller.appspotmail.com Signed-off-by: Darrick J. Wong commit 571dc9ae4eefb452d32cfb3761a87089e8f37ca7 Merge: dd07bb8b6baf2 bd4f5d09cc93c Author: Darrick J. Wong Date: Tue Feb 14 17:50:48 2023 -0800 Merge tag 'xfs-alloc-perag-conversion' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs into xfs-6.3-merge-A xfs: per-ag centric allocation alogrithms This series continues the work towards making shrinking a filesystem possible. We need to be able to stop operations from taking place on AGs that need to be removed by a shrink, so before shrink can be implemented we need to have the infrastructure in place to prevent incursion into AGs that are going to be, or are in the process, of being removed from active duty. The focus of this is making operations that depend on access to AGs use the perag to access and pin the AG in active use, thereby creating a barrier we can use to delay shrink until all active uses of an AG have been drained and new uses are prevented. This series starts by fixing some existing issues that are exposed by changes later in the series. They stand alone, so can be picked up independently of the rest of this patchset. The most complex of these fixes is cleaning up the mess that is the AGF deadlock avoidance algorithm. This algorithm stores the first block that is allocated in a transaction in tp->t_firstblock, then uses this to try to limit future allocations within the transaction to AGs at or higher than the filesystem block stored in tp->t_firstblock. This depends on one of the initial bug fixes in the series to move the deadlock avoidance checks to xfs_alloc_vextent(), and then builds on it to relax the constraints of the avoidance algorithm to only be active when a deadlock is possible. We also update the algorithm to record allocations from higher AGs that are allocated from, because we when we need to lock more than two AGs we still have to ensure lock order is correct. Therefore we can't lock AGs in the order 1, 3, 2, even though tp->t_firstblock indicates that we've allocated from AG 1 and so AG is valid to lock. It's not valid, because we already hold AG 3 locked, and so tp->t-first_block should actually point at AG 3, not AG 1 in this situation. It should now be obvious that the deadlock avoidance algorithm should record AGs, not filesystem blocks. So the series then changes the transaction to store the highest AG we've allocated in rather than a filesystem block we allocated. This makes it obvious what the constraints are, and trivial to update as we lock and allocate from various AGs. With all the bug fixes out of the way, the series then starts converting the code to use active references. Active reference counts are used by high level code that needs to prevent the AG from being taken out from under it by a shrink operation. The high level code needs to be able to handle not getting an active reference gracefully, and the shrink code will need to wait for active references to drain before continuing. Active references are implemented just as reference counts right now - an active reference is taken at perag init during mount, and all other active references are dependent on the active reference count being greater than zero. This gives us an initial method of stopping new active references without needing other infrastructure; just drop the reference taken at filesystem mount time and when the refcount then falls to zero no new references can be taken. In future, this will need to take into account AG control state (e.g. offline, no alloc, etc) as well as the reference count, but right now we can implement a basic barrier for shrink with just reference count manipulations. As such, patches to convert the perag state to atomic opstate fields similar to the xfs_mount and xlog opstate fields follow the initial active perag reference counting patches. The first target for active reference conversion is the for_each_perag*() iterators. This captures a lot of high level code that should skip offline AGs, and introduces the ability to differentiate between a lookup that didn't have an online AG and the end of the AG iteration range. From there, the inode allocation AG selection is converted to active references, and the perag is driven deeper into the inode allocation and btree code to replace the xfs_mount. Most of the inode allocation code operates on a single AG once it is selected, hence it should pass the perag as the primary referenced object around for allocation, not the xfs_mount. There is a bit of churn here, but it emphasises that inode allocation is inherently an allocation group based operation. Next the bmap/alloc interface undergoes a major untangling, reworking xfs_bmap_btalloc() into separate allocation operations for different contexts and failure handling behaviours. This then allows us to completely remove the xfs_alloc_vextent() layer via restructuring the xfs_alloc_vextent/xfs_alloc_ag_vextent() into a set of realtively simple helper function that describe the allocation that they are doing. e.g. xfs_alloc_vextent_exact_bno(). This allows the requirements for accessing AGs to be allocation context dependent. The allocations that require operation on a single AG generally can't tolerate failure after the allocation method and AG has been decided on, and hence the caller needs to manage the active references to ensure the allocation does not race with shrink removing the selected AG for the duration of the operation that requires access to that allocation group. Other allocations iterate AGs and so the first AG is just a hint - these do not need to pin a perag first as they can tolerate not being able to access an AG by simply skipping over it. These require new perag iteration functions that can start at arbitrary AGs and wrap around at arbitrary AGs, hence a new set for for_each_perag_wrap*() helpers to do this. Next is the rework of the filestreams allocator. This doesn't change any functionality, but gets rid of the unnecessary multi-pass selection algorithm when the selected AG is not available. It currently does a lookup pass which might iterate all AGs to select an AG, then checks if the AG is acceptible and if not does a "new AG" pass that is essentially identical to the lookup pass. Both of these scans also do the same "longest extent in AG" check before selecting an AG as is done after the AG is selected. IOWs, the filestreams algorithm can be greatly simplified into a single new AG selection pass if the there is no current association or the currently associated AG doesn't have enough contiguous free space for the allocation to proceed. With this simplification of the filestreams allocator, it's then trivial to convert it to use for_each_perag_wrap() for the AG scan algorithm. Signed-off-by: Dave Chinner Signed-off-by: Darrick J. Wong * tag 'xfs-alloc-perag-conversion' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs: (42 commits) xfs: refactor the filestreams allocator pick functions xfs: return a referenced perag from filestreams allocator xfs: pass perag to filestreams tracing xfs: use for_each_perag_wrap in xfs_filestream_pick_ag xfs: track an active perag reference in filestreams xfs: factor out MRU hit case in xfs_filestream_select_ag xfs: remove xfs_filestream_select_ag() longest extent check xfs: merge new filestream AG selection into xfs_filestream_select_ag() xfs: merge filestream AG lookup into xfs_filestream_select_ag() xfs: move xfs_bmap_btalloc_filestreams() to xfs_filestreams.c xfs: use xfs_bmap_longest_free_extent() in filestreams xfs: get rid of notinit from xfs_bmap_longest_free_extent xfs: factor out filestreams from xfs_bmap_btalloc_nullfb xfs: convert trim to use for_each_perag_range xfs: convert xfs_alloc_vextent_iterate_ags() to use perag walker xfs: move the minimum agno checks into xfs_alloc_vextent_check_args xfs: fold xfs_alloc_ag_vextent() into callers xfs: move allocation accounting to xfs_alloc_vextent_set_fsbno() xfs: introduce xfs_alloc_vextent_prepare() xfs: introduce xfs_alloc_vextent_exact_bno() ... commit 61fef98945d0b2fea522ef958f57a783e2a072a9 Author: Jingbo Xu Date: Thu Feb 9 14:39:13 2023 +0800 erofs: unify anonymous inodes for blob Currently there're two anonymous inodes (inode and anon_inode in struct erofs_fscache) for each blob. The former was introduced as the address_space of page cache for bootstrap. The latter was initially introduced as both the address_space of page cache and also a sentinel in the shared domain. Since now the management of cookies in share domain has been decoupled with the anonymous inode, there's no need to maintain an extra anonymous inode. Let's unify these two anonymous inodes. Besides, in non-share-domain mode only bootstrap will allocate anonymous inode. To simplify the implementation, always allocate anonymous inode for both bootstrap and data blobs. Similarly release anonymous inodes for data blobs when .put_super() is called, or we'll get "VFS: Busy inodes after unmount." warning. Also remove the redundant set_nlink() when initializing the anonymous inode, since i_nlink has already been initialized to 1 when the inode gets allocated. Signed-off-by: Jingbo Xu Reviewed-by: Jia Zhu Link: https://lore.kernel.org/r/20230209063913.46341-5-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 7032809a44d752b9e2275833787e0aa88a7540af Author: Jingbo Xu Date: Thu Feb 9 14:39:12 2023 +0800 erofs: relinquish volume with mutex held Relinquish fscache volume with mutex held. Otherwise if a new domain is registered when the old domain with the same name gets removed from the list but not relinquished yet, fscache may complain the collision. Fixes: 8b7adf1dff3d ("erofs: introduce fscache-based domain") Signed-off-by: Jingbo Xu Reviewed-by: Jia Zhu Link: https://lore.kernel.org/r/20230209063913.46341-4-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 2dfb8c3b122fad4504a92c34ba68f2fe4444b3f6 Author: Jingbo Xu Date: Thu Feb 9 14:39:11 2023 +0800 erofs: maintain cookies of share domain in self-contained list We'd better not touch sb->s_inodes list and inode->i_count directly. Let's maintain cookies of share domain in a self-contained list in erofs. Besides, relinquish cookie with the mutex held. Otherwise if a cookie is registered when the old cookie with the same name in the same domain has been removed from the list but not relinquished yet, fscache may complain "Duplicate cookie detected". Signed-off-by: Jingbo Xu Reviewed-by: Jia Zhu Link: https://lore.kernel.org/r/20230209063913.46341-3-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit bdfa90142eb1f1272d2efc00dda6c0f35814e36a Author: Jingbo Xu Date: Thu Feb 9 14:39:10 2023 +0800 erofs: remove unused device mapping in meta routine Currently metadata is always on bootstrap, and thus device mapping is not needed so far. Remove the redundant device mapping in the meta routine. Signed-off-by: Jingbo Xu Reviewed-by: Jia Zhu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230209063913.46341-2-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit b7fa1de09f92671ac30424765d655873fb606f89 Author: Yangtao Li Date: Thu Feb 9 13:20:13 2023 +0800 MAINTAINERS: erofs: Add Documentation/ABI/testing/sysfs-fs-erofs Add this doc to the erofs maintainers entry. Signed-off-by: Yangtao Li Reviewed-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230209052013.34952-1-frank.li@vivo.com Signed-off-by: Gao Xiang commit 6967f6cbcae552c9f3405bd70681c6283d41c315 Author: Yue Hu Date: Thu Feb 9 13:11:28 2023 +0800 Documentation/ABI: sysfs-fs-erofs: update supported features Add missing feaures for sysfs-fs-erofs feature doc. Signed-off-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230209051128.10571-1-zbestahu@gmail.com Signed-off-by: Gao Xiang commit 8b58f9f02162124c2149779af401c8115c70b649 Author: Jingbo Xu Date: Thu Feb 9 10:48:25 2023 +0800 erofs: remove unused EROFS_GET_BLOCKS_RAW flag For erofs_map_blocks() and erofs_map_blocks_flatmode(), the flags argument is always EROFS_GET_BLOCKS_RAW. Thus remove the unused flags parameter for these two functions. Besides EROFS_GET_BLOCKS_RAW is originally introduced for reading compressed (raw) data for compressed files. However it's never used actually and let's remove it now. Signed-off-by: Jingbo Xu Reviewed-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230209024825.17335-2-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit d60b87600d134d1b76436e555546ff5403f1a2f9 Author: Jingbo Xu Date: Thu Feb 9 10:48:24 2023 +0800 erofs: update print symbols for various flags in trace As new flags introduced, the corresponding print symbols for trace are not added accordingly. Add these missing print symbols for these flags. Signed-off-by: Jingbo Xu Reviewed-by: Yue Hu Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230209024825.17335-1-jefflexu@linux.alibaba.com Signed-off-by: Gao Xiang commit 339bc4d3cd251e8d05e44abebadba5ff9baa1d68 Author: Thomas Weißschuh Date: Thu Feb 9 03:21:13 2023 +0000 erofs: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Acked-by: Gao Xiang Reviewed-by: Jingbo Xu Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230209-kobj_type-erofs-v1-1-078c945e2c4b@weissschuh.net Signed-off-by: Gao Xiang commit 3fffb589b9a6e331e39cb75373ee7691acd7b109 Author: Sandeep Dhavale Date: Wed Feb 8 17:33:22 2023 +0800 erofs: add per-cpu threads for decompression as an option Using per-cpu thread pool we can reduce the scheduling latency compared to workqueue implementation. With this patch scheduling latency and variation is reduced as per-cpu threads are high priority kthread_workers. The results were evaluated on arm64 Android devices running 5.10 kernel. The table below shows resulting improvements of total scheduling latency for the same app launch benchmark runs with 50 iterations. Scheduling latency is the latency between when the task (workqueue kworker vs kthread_worker) became eligible to run to when it actually started running. +-------------------------+-----------+----------------+---------+ | | workqueue | kthread_worker | diff | +-------------------------+-----------+----------------+---------+ | Average (us) | 15253 | 2914 | -80.89% | | Median (us) | 14001 | 2912 | -79.20% | | Minimum (us) | 3117 | 1027 | -67.05% | | Maximum (us) | 30170 | 3805 | -87.39% | | Standard deviation (us) | 7166 | 359 | | +-------------------------+-----------+----------------+---------+ Background: Boot times and cold app launch benchmarks are very important to the Android ecosystem as they directly translate to responsiveness from user point of view. While EROFS provides a lot of important features like space savings, we saw some performance penalty in cold app launch benchmarks in few scenarios. Analysis showed that the significant variance was coming from the scheduling cost while decompression cost was more or less the same. Having per-cpu thread pool we can see from the above table that this variation is reduced by ~80% on average. This problem was discussed at LPC 2022. Link to LPC 2022 slides and talk at [1] [1] https://lpc.events/event/16/contributions/1338/ [ Gao Xiang: At least, we have to add this until WQ_UNBOUND workqueue issue [2] on many arm64 devices is resolved. ] [2] https://lore.kernel.org/r/CAJkfWY490-m6wNubkxiTPsW59sfsQs37Wey279LmiRxKt7aQYg@mail.gmail.com Signed-off-by: Sandeep Dhavale Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230208093322.75816-1-hsiangkao@linux.alibaba.com commit 557afdd94cf853885ac3b5c218bdf49c021f7323 Author: Gao Xiang Date: Sat Feb 4 17:30:40 2023 +0800 erofs: tidy up internal.h Reorder internal.h code so that removing unneeded macros and more. No logic changes. Reviewed-by: Yue Hu Reviewed-by: Jingbo Xu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230204093040.97967-6-hsiangkao@linux.alibaba.com commit 999f2f9a63f475192d837a2b8595eb0962984d21 Author: Gao Xiang Date: Sat Feb 4 17:30:39 2023 +0800 erofs: get rid of z_erofs_do_map_blocks() forward declaration The code can be neater without forward declarations. Let's get rid of z_erofs_do_map_blocks() forward declaration. Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230204093040.97967-5-hsiangkao@linux.alibaba.com commit a9a94d9373349e1a53f149d2015eb6f03a8517cf Author: Gao Xiang Date: Sat Feb 4 17:30:38 2023 +0800 erofs: move zdata.h into zdata.c Definitions in zdata.h are only used in zdata.c and for internal use only. No logic changes. Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230204093040.97967-4-hsiangkao@linux.alibaba.com commit b1ed220c6262bff63cdcb53692e492be0b05206c Author: Gao Xiang Date: Sat Feb 4 17:30:37 2023 +0800 erofs: remove tagged pointer helpers Just open-code the remaining one to simplify the code. Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230204093040.97967-3-hsiangkao@linux.alibaba.com commit cdba55067f2f9fdc7870ffcb6aef912d3468cff8 Author: Gao Xiang Date: Sat Feb 4 17:30:36 2023 +0800 erofs: avoid tagged pointers to mark sync decompression We could just use a boolean in z_erofs_decompressqueue for sync decompression to simplify the code. Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230204093040.97967-2-hsiangkao@linux.alibaba.com commit 4efdec36dc9907628e590a68193d6d8e5e74d032 Author: Gao Xiang Date: Sat Feb 4 17:30:35 2023 +0800 erofs: get rid of erofs_inode_datablocks() erofs_inode_datablocks() has the only one caller, let's just get rid of it entirely. No logic changes. Reviewed-by: Yue Hu Reviewed-by: Jingbo Xu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230204093040.97967-1-hsiangkao@linux.alibaba.com commit b780d3fc6107464dcc43631a6208c43b6421f1e6 Author: Gao Xiang Date: Sat Jan 14 23:08:23 2023 +0800 erofs: simplify iloc() Actually we could pass in inodes directly to clean up all callers. Also rename iloc() as erofs_iloc(). Link: https://lore.kernel.org/r/20230114150823.432069-1-xiang@kernel.org Reviewed-by: Yue Hu Reviewed-by: Jingbo Xu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit e324eaa9790614577c93e819651e0a83963dac79 Author: Gao Xiang Date: Sat Jan 14 20:57:45 2023 +0800 erofs: get rid of debug_one_dentry() Since erofsdump is available, no need to keep this debugging functionality at all. Also drop a useless comment since it's the VFS behavior. Link: https://lore.kernel.org/r/20230114125746.399253-1-xiang@kernel.org Reviewed-by: Yue Hu Reviewed-by: Jingbo Xu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 768bb10afb99803d1ea3ae2f00afcf53a8e02e5f Author: Gao Xiang Date: Fri Jan 13 14:52:26 2023 +0800 erofs: remove linux/buffer_head.h dependency EROFS actually never uses buffer heads, therefore just get rid of BH_xxx definitions and linux/buffer_head.h inclusive. Link: https://lore.kernel.org/r/20230113065226.68801-2-hsiangkao@linux.alibaba.com Reviewed-by: Yue Hu Reviewed-by: Jingbo Xu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit 7c3511a2c82005642265a254e6dd578cb38684b2 Author: Gao Xiang Date: Fri Jan 13 14:52:25 2023 +0800 erofs: clean up erofs_iget() Move inode hash function into inode.c and simplify erofs_iget(). Link: https://lore.kernel.org/r/20230113065226.68801-1-hsiangkao@linux.alibaba.com Reviewed-by: Yue Hu Reviewed-by: Jingbo Xu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang commit d5a7fab7859dc88657372a448b78babcf134114e Author: Samuel Holland Date: Sat Feb 11 20:15:33 2023 -0600 riscv: Fix Zbb alternative IDs Commit 4bf8860760d9 ("riscv: cpufeature: extend riscv_cpufeature_patch_func to all ISA extensions") switched ISA extension alternatives to use the RISCV_ISA_EXT_* macros instead of CPUFEATURE_*. This was mismerged when applied on top of the Zbb series, so the Zbb alternatives referenced the wrong errata ID values. Fixes: 9daca9a5b9ac ("Merge patch series "riscv: improve boot time isa extensions handling"") Signed-off-by: Samuel Holland Reviewed-by: Conor Dooley Reviewed-by: Andrew Jones Reviewed-by: Guo Ren Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230212021534.59121-3-samuel@sholland.org Signed-off-by: Palmer Dabbelt commit bfd6fc5d80145e12d0ffa144c4bad89b8f9ddc5a Author: Samuel Holland Date: Sat Feb 11 20:15:32 2023 -0600 riscv: Fix early alternative patching Now that the text to patch is located using a relative offset from the alternative entry, the text address should be computed without applying the kernel mapping offset, both before and after VM setup. Fixes: 8d23e94a4433 ("riscv: switch to relative alternative entries") Signed-off-by: Samuel Holland Reviewed-by: Conor Dooley Reviewed-by: Guo Ren Reviewed-by: Jisheng Zhang Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230212021534.59121-2-samuel@sholland.org Signed-off-by: Palmer Dabbelt commit a5fcd228ca1db9810ba1ed461c90b6ee933b9daf Merge: 5a6fe61facdb7 6980daaa3ed59 Author: Dan Williams Date: Tue Feb 14 16:06:10 2023 -0800 Merge branch 'for-6.3/cxl-rr-emu' into cxl/next Pick up the CXL DVSEC range register emulation for v6.3, and resolve conflicts with the cxl_port_probe() split (from for-6.3/cxl-ram-region) and event handling (from for-6.3/cxl-events). commit 5f365c133b83a584953179fc771cf131668e82ee Author: Conor Dooley Date: Mon Dec 19 17:28:37 2022 +0000 RISC-V: re-order Kconfig selects alphanumerically Selects should be sorted alphanumerically, and were tidied up originally by Palmer in commit e8c7ef7d5819 ("RISC-V: Sort select statements alphanumerically") since then, things have gotten out of order again. Fish RMK's original script out of commit b1b3f49ce460 ("ARM: config: sort select statements alphanumerically") and do some spring cleaning. Signed-off-by: Conor Dooley Acked-by: Björn Töpel Link: https://lore.kernel.org/r/20221219172836.134709-1-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 2a5303b499b18de7179ee1b4ab759880fb02ec9c Author: Conor Dooley Date: Sun Jan 29 23:57:01 2023 +0000 Documentation: riscv: fix insufficient list item indent When adding the ISA string ordering rules, I didn't sufficiently indent one of the list items. Reported-by: kernel test robot Link: https://lore.kernel.org/linux-doc/202301300743.bp7Dpazv-lkp@intel.com/ Fixes: f07b2b3f9d47 ("Documentation: riscv: add a section about ISA string ordering in /proc/cpuinfo") Signed-off-by: Conor Dooley Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20230129235701.2393241-1-conor@kernel.org Signed-off-by: Palmer Dabbelt commit 6980daaa3ed5959bf4fe2719d96b1da437026b58 Author: Dave Jiang Date: Tue Feb 14 11:41:40 2023 -0800 cxl/pci: Remove locked check for dvsec_range_allowed() Remove the CXL_DECODER_F_LOCK check to be permissive of platform BIOSes that allow CXL.mem to be remapped. Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167640370085.935665.13128321011001358077.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit d7a2153762c7369534c432ac7e86996063e246df Author: Dave Jiang Date: Tue Feb 14 11:41:35 2023 -0800 cxl/hdm: Add emulation when HDM decoders are not committed For the case where DVSEC range register(s) are active and HDM decoders are not committed, use RR to provide emulation. A first pass is done to note whether any decoders are committed. If there are no committed endpoint decoders, then DVSEC ranges will be used for emulation. Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167640369536.935665.611974113442400127.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 4474ce565ee4490fb4e6d8443b617a9d98ae10ff Author: Dave Jiang Date: Tue Feb 14 11:41:30 2023 -0800 cxl/hdm: Create emulated cxl_hdm for devices that do not have HDM decoders CXL rev3 spec 8.1.3 RCDs may not have HDM register blocks. Create a fake HDM with information from the CXL PCIe DVSEC registers. The decoder count will be set to the HDM count retrieved from the DVSEC cap register. Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167640368994.935665.15831225724059704620.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit b777e9bec960a29374dc486d47784c73b7ac4cef Author: Dave Jiang Date: Tue Feb 14 11:41:24 2023 -0800 cxl/hdm: Emulate HDM decoder from DVSEC range registers In the case where HDM decoder register block exists but is not programmed and at the same time the DVSEC range register range is active, populate the CXL decoder object 'cxl_decoder' with info from DVSEC range registers. Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167640368454.935665.13806415120298330717.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 9de321e93c3b3fd7fd2621a2557c42fa7d43e314 Author: Dave Jiang Date: Tue Feb 14 11:41:19 2023 -0800 cxl/pci: Refactor cxl_hdm_decode_init() With the previous refactoring of DVSEC range registers out of cxl_hdm_decode_init(), it basically becomes a skeleton function. Squash __cxl_hdm_decode_init() with cxl_hdm_decode_init() to simplify the code. cxl_hdm_decode_init() now returns more error codes than just -EBUSY. Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167640367916.935665.12898404758336059003.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 59c3368b2e69eb7da7f271286a0bd80930dfc070 Author: Dave Jiang Date: Tue Feb 14 11:41:13 2023 -0800 cxl/port: Export cxl_dvsec_rr_decode() to cxl_port Call cxl_dvsec_rr_decode() in the beginning of cxl_port_probe() and preserve the decoded information in a local 'struct cxl_endpoint_dvsec_info'. This info can be passed to various functions later on in order to support the HDM decoder emulation. The invocation of cxl_dvsec_rr_decode() in cxl_hdm_decode_init() is removed and a pointer to the 'struct cxl_endpoint_dvsec_info' is passed in. Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167640367377.935665.2848747799651019676.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 1acba6e9206c655f8eb6736c7cafbf022492f36d Author: Dave Jiang Date: Tue Feb 14 11:41:08 2023 -0800 cxl/pci: Break out range register decoding from cxl_hdm_decode_init() There are 2 scenarios that requires additional handling. 1. A device that has active ranges in DVSEC range registers (RR) but no HDM decoder register block. 2. A device that has both RR active and HDM, but the HDM decoders are not programmed. The goal is to create emulated decoder software structs based on the RR. Move the CXL DVSEC range register decoding code block from cxl_hdm_decode_init() to its own function. Refactor code in preparation for the HDM decoder emulation. There is no functionality change to the code. Name the new function to cxl_dvsec_rr_decode(). The only change is to set range->start and range->end to CXL_RESOURCE_NONE and skipping the reading of base registers if the range size is 0, which equates to range not active. Reviewed-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167640366839.935665.11816388524993234329.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 5a6fe61facdb7f830895712b31fb39f544ffc165 Merge: ee817acaa01d5 248529edc86f8 Author: Dan Williams Date: Tue Feb 14 15:06:08 2023 -0800 Merge branch 'for-6.3/cxl' into cxl/next Pick up the AER unmasking patches for v6.3. commit ee817acaa01d5c56e5fef396bea05c869b7e9351 Merge: f57aec443c24d 8a3d95ea42921 Author: Dan Williams Date: Tue Feb 14 14:58:26 2023 -0800 Merge branch 'for-6.3/cxl-ram-region' into cxl/next Pick up some fixes from exposure of for-6.3/cxl-ram-region in linux-next. commit 3ee0d39c50dca18c76941f46a6c57dc9cd2bfb9d Author: Andy Shevchenko Date: Mon Feb 13 18:17:13 2023 +0200 ASoC: soc-ac97: Convert to agnostic GPIO API The of_gpio.h is going to be removed. In preparation of that convert the driver to the agnostic API. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230213161713.1450-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit fcb3a81d221750d2a54b4e3a82b3efbbeab8780c Author: Srivatsa S. Bhat (VMware) Date: Fri Jan 27 16:37:51 2023 -0800 x86/hotplug: Remove incorrect comment about mwait_play_dead() The comment that says mwait_play_dead() returns only on failure is a bit misleading because mwait_play_dead() could actually return for valid reasons (such as mwait not being supported by the platform) that do not indicate a failure of the CPU offline operation. So, remove the comment. Suggested-by: Thomas Gleixner Signed-off-by: Srivatsa S. Bhat (VMware) Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230128003751.141317-1-srivatsa@csail.mit.edu commit 248529edc86f8d7d390a15a86bd1904951311665 Author: Dave Jiang Date: Tue Feb 14 10:00:24 2023 -0700 cxl: add RAS status unmasking for CXL By default the CXL RAS mask registers bits are defaulted to 1's and suppress all error reporting. If the kernel has negotiated ownership of error handling for CXL then unmask the mask registers by writing 0s. PCI_EXP_DEVCTL capability is checked to see uncorrectable or correctable errors bits are set before unmasking the respective errors. Acked-by: Bjorn Helgaas # pci_regs.h Reviewed-by: Jonathan Cameron Signed-off-by: Jonathan Cameron Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167639402301.778884.12556849214955646539.stgit@djiang5-mobl3.local Signed-off-by: Dan Williams commit 72ed5d5624af384eaf74d84915810d54486a75e2 Author: Jiri Pirko Date: Thu Jan 26 13:39:09 2023 +0100 net/mlx5: Suspend auxiliary devices only in case of PCI device suspend The original behavior introduced by commit c6acd629eec7 ("net/mlx5e: Add support for devlink-port in non-representors mode") correctly re-instantiated uplink devlink port and related netdevice during devlink reload. However with migration to auxiliary devices, this behaviour changed. Restore the original behaviour and tear down auxiliary devices completely during devlink reload. Signed-off-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit 5977ac3910f1cbaf44dca48179118b25c206ac29 Author: Jiri Pirko Date: Thu Jan 26 13:23:17 2023 +0100 net/mlx5: Remove "recovery" arg from mlx5_load_one() function mlx5_load_one() is always called with recovery==false, so remove the unneeded function arg. Signed-off-by: Jiri Pirko Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit de411a8226df165a8cab9a426ceaaaafa9304ab9 Author: Jiri Pirko Date: Thu Jan 26 10:46:49 2023 +0100 net/mlx5e: Create auxdev devlink instance in the same ns as parent devlink Commit cited in "fixes" tag moved the devlink port under separate devlink entity created for auxiliary device. Respect the network namespace of parent devlink entity and allocate the devlink there. Fixes: ee75f1fc44dd ("net/mlx5e: Create separate devlink instance for ethernet auxiliary device") Signed-off-by: Jiri Pirko Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit 6d6e71e6e5e3713d18c87b16af774b7db51a68c3 Author: Jiri Pirko Date: Wed Jan 18 15:52:33 2023 +0100 net/mlx5e: Move devlink port registration to be done before netdev alloc Move the devlink port registration to be done right after devlink instance registration. Signed-off-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit c30f3faa2a81bc6d7d05967eb07bbe3bd5b359e6 Author: Jiri Pirko Date: Tue Jan 17 14:44:54 2023 +0100 net/mlx5e: Move dl_port to struct mlx5e_dev No need to have dl_port which is tightly coupled with mlx5e code in mlx5 core code. Move it to struct mlx5e_dev and loose mlx5e_devlink_get_dl_port() helper. Signed-off-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit bc1536f369f043fa362a25d51f84bf59f2f48489 Author: Jiri Pirko Date: Wed Jan 18 15:44:48 2023 +0100 net/mlx5e: Replace usage of mlx5e_devlink_get_dl_port() by netdev->devlink_port On places where netdev pointer is available, access related devlink_port pointer by netdev->devlink_port instead of using mlx5e_devlink_get_dl_port() which is going to be removed. Move SET_NETDEV_DEVLINK_PORT() call right after devlink port registration to make sure netdev->devlink_port is valid. Signed-off-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit ccd672bcf3e53ecd666ed99d4901992ebd78fdd9 Author: Jiri Pirko Date: Wed Jan 18 15:39:24 2023 +0100 net/mlx5e: Pass mdev to mlx5e_devlink_port_register() Instead of accessing priv->mdev, pass mdev pointer to mlx5e_devlink_port_register() and access it directly. Signed-off-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit 29a299cb6b2051c1c7394da00c080df5cca7bfc3 Author: Jiri Pirko Date: Fri Jan 13 15:44:42 2023 +0100 net/mlx5: Remove outdated comment The comment is no longer applicable, as the devlink reload and instance cleanup are both protected with devlink instance lock, therefore no race can happen. Signed-off-by: Jiri Pirko Signed-off-by: Saeed Mahameed commit b97653d87bda09441d521a448c69cccd3dd6649d Author: Roi Dayan Date: Sun Jan 29 11:53:42 2023 +0200 net/mlx5e: TC, Remove redundant parse_attr argument The parse_attr argument is not being used in actions_match_supported_fdb(). remove it. Signed-off-by: Roi Dayan Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed commit 197c00029294528e35ba97e4b8b54155c6654261 Author: Roi Dayan Date: Mon Feb 6 14:40:24 2023 +0200 net/mlx5e: Use a simpler comparison for uplink rep get_route_and_out_devs() is uses the following condition mlx5e_eswitch_rep() && mlx5e_is_uplink_rep() to check if a given netdev is the uplink rep. Alternatively we can just use the straight forward version mlx5e_eswitch_uplink_rep() that only checks if a given netdev is uplink rep. Signed-off-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 27f9e0ccb6da0857a323c1d19a23b6666ddefe05 Author: Mark Bloch Date: Mon Dec 5 15:32:52 2022 +0200 net/mlx5: Lag, Add single RDMA device in multiport mode In MultiPort E-Switch mode a single RDMA is created. This device has multiple RDMA ports that represent the uplink ports that are connected to the E-Switch. Account for this when creating the RDMA device so it has an additional port for the non native uplink. As a side effect of this patch, use shared fdb in multiport eswitch mode. Signed-off-by: Mark Bloch Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 73af3711c7028286136bb7e9422b19f5a016626d Author: Roi Dayan Date: Wed Nov 30 15:12:50 2022 +0200 net/mlx5: Lag, set different uplink vport metadata in multiport eswitch mode In a follow-up commit multiport eswitch mode will use a shared fdb. In shared fdb there is a single eswitch fdb and traffic could come from any port. to distinguish between the ports set a different metadata per uplink port. Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit ab9fc405ffd9690266039662286ed69f98c11738 Author: Roi Dayan Date: Tue Nov 29 16:02:55 2022 +0200 net/mlx5: E-Switch, rename bond update function to be reused The vport bond update function is really updating the vport metadata and there is no direct relation to bond. Rename the function to vport metadata update to be used a followup commit. This commit doesn't change any functionality. Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 8ce81fc01b52a17073353e0d483a2434abd2e392 Author: Roi Dayan Date: Thu Dec 1 11:10:20 2022 +0200 net/mlx5e: TC, Add peer flow in mpesw mode While at it rename mlx5_lag_mpesw_is_activated() to mlx5_lag_is_mpesw() to be consistent with checking if other lag modes are activated. Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit a32327a3a02c6513feaeb122a6d8fb6e8d168365 Author: Roi Dayan Date: Mon Nov 28 13:33:03 2022 +0200 net/mlx5: Lag, Control MultiPort E-Switch single FDB mode MultiPort E-Switch builds on newer hardware's capabilities and introduces a mode where a single E-Switch is used and all the vports and physical ports on the NIC are connected to it. The new mode will allow in the future a decrease in the memory used by the driver and advanced features that aren't possible today. This represents a big change in the current E-Switch implantation in mlx5. Currently, by default, each E-Switch manager manages its E-Switch. Steering rules in each E-Switch can only forward traffic to the native physical port associated with that E-Switch. While there are ways to target non-native physical ports, for example using a bond or via special TC rules. None of the ways allows a user to configure the driver to operate by default in such a mode nor can the driver decide to move to this mode by default as it's user configuration-driven right now. While MultiPort E-Switch single FDB mode is the preferred mode, older generations of ConnectX hardware couldn't support this mode so it was never implemented. Now that there is capable hardware present, start the transition to having this mode by default. Introduce a devlink parameter to control MultiPort E-Switch single FDB mode. This will allow users to select this mode on their system right now and in the future will allow the driver to move to this mode by default. Example: $ devlink dev param set pci/0000:00:0b.0 name esw_multiport value 1 \ cmode runtime Signed-off-by: Roi Dayan Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed commit 1922a6dc0502ed3fd0786f57cc9e5f515c902009 Author: Dave Jiang Date: Mon Feb 13 13:28:42 2023 -0700 cxl: remove unnecessary calling of pci_enable_pcie_error_reporting() With this [1] commit upstream, pci_enable_pci_error_report() is no longer necessary for the driver to call. Remove call and related cleanups. [1]: f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is native") Signed-off-by: Dave Jiang Link: https://lore.kernel.org/r/167632012093.4153151.5360778069735064322.stgit@djiang5-mobl3.local Signed-off-by: Dan Williams commit cec3b46b8bda0cdc93d3ab2bdd14aae5d30ecfd9 Author: Neil Armstrong Date: Tue Feb 14 17:41:18 2023 +0100 power: reset: add Odroid Go Ultra poweroff driver The Hardkernel Odroid Go Ultra poweroff scheme requires requesting a poweroff to its two PMICs in order, this represents the poweroff scheme needed to complete a clean poweroff of the system. This implement this scheme by implementing a self registering driver to permit using probe defer until both pmics are finally probed. Signed-off-by: Neil Armstrong Signed-off-by: Sebastian Reichel commit a06377c5d01eeeaa52ad979b62c3c72efcc3eff0 Author: Christoph Hellwig Date: Tue Feb 14 19:33:08 2023 +0100 Revert "blk-cgroup: pin the gendisk in struct blkcg_gq" This reverts commit 84d7d462b16dd5f0bf7c7ca9254bf81db2c952a2. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230214183308.1658775-6-hch@lst.de Signed-off-by: Jens Axboe commit 9a9c261e6b5512e0b8d9ae9b1c1746c743a15a48 Author: Christoph Hellwig Date: Tue Feb 14 19:33:07 2023 +0100 Revert "blk-cgroup: pass a gendisk to blkg_lookup" This reverts commit 821e840c08ad83736eced4037cdad864e95e2584. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230214183308.1658775-5-hch@lst.de Signed-off-by: Jens Axboe commit b6553bef8cdc2983943f60edb8dc5e49361ebb3b Author: Christoph Hellwig Date: Tue Feb 14 19:33:06 2023 +0100 Revert "blk-cgroup: delay blk-cgroup initialization until add_disk" This reverts commit 178fa7d49815ea8001f43ade37a22072829fd8ab. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230214183308.1658775-4-hch@lst.de Signed-off-by: Jens Axboe commit b4e94f9c2c0822265a6942741d270aa16d229331 Author: Christoph Hellwig Date: Tue Feb 14 19:33:05 2023 +0100 Revert "blk-cgroup: delay calling blkcg_exit_disk until disk_release" This reverts commit c43332fe028c252a2a28e46be70a530f64fc3c9d as it is not needed without moving to disk references in the blkg. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230214183308.1658775-3-hch@lst.de Signed-off-by: Jens Axboe commit 1231039db31cf0703996d0b1797c2702e25a110a Author: Christoph Hellwig Date: Tue Feb 14 19:33:04 2023 +0100 Revert "blk-cgroup: move the cgroup information to struct gendisk" This reverts commit 3f13ab7c80fdb0ada86a8e3e818960bc1ccbaa59 as a patch it depends on caused a few problems. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230214183308.1658775-2-hch@lst.de Signed-off-by: Jens Axboe commit d67307b4147e51b00545e2e17c20bd2cc8e6c745 Author: Thomas Weißschuh Date: Tue Feb 14 04:21:24 2023 +0000 SUNRPC: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Signed-off-by: Anna Schumaker commit 0438499a7f098c35e83134fc04899fe2188e4ef2 Author: Kuninori Morimoto Date: Mon Feb 13 02:13:18 2023 +0000 ASoC: dt-bindings: renesas,rsnd.yaml: drop "dmas/dma-names" from "rcar_sound,ssi" SSI is supporting both "PIO mode" and "DMA mode", thus "dmas/dma-names" are not mandatory property. Drop these from rcar_sound,ssi's required:. This is prepare for Gen4 support. See more details on Link Link: https://lore.kernel.org/all/87zg9vk0ex.wl-kuninori.morimoto.gx@renesas.com/#r Link: https://lore.kernel.org/all/87r0v2uvm7.wl-kuninori.morimoto.gx@renesas.com/#r Link: https://lore.kernel.org/all/87r0v1t02h.wl-kuninori.morimoto.gx@renesas.com/#r Link: https://lore.kernel.org/all/87y1p7bpma.wl-kuninori.morimoto.gx@renesas.com/#r Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/87r0uu8g8x.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 13b599f15e1cb59d6cc907908532dc45bf048e3a Author: Zhu Yanjun Date: Mon Jan 16 13:51:31 2023 -0500 ice: Mention CEE DCBX in code comment From the function ice_parse_org_tlv, CEE DCBX TLV is also supported. So update the comment. Or else, it is confusing. Signed-off-by: Zhu Yanjun Signed-off-by: Tony Nguyen commit d8a23ff6a755eccbebfa1b5173a951cfdd088c8c Author: Tony Nguyen Date: Thu Jan 5 11:33:11 2023 -0800 ice: Change ice_vsi_realloc_stat_arrays() to void smatch reports: smatch warnings: drivers/net/ethernet/intel/ice/ice_lib.c:3612 ice_vsi_rebuild() warn: missing error code 'ret' If an error is encountered for ice_vsi_realloc_stat_arrays(), ret is not assigned an error value so the goto error path would return success. The function, however, only returns 0 so an error will never be reported; due to this, change the function to return void. Reported-by: kernel test robot Signed-off-by: Tony Nguyen Tested-by: Gurucharan G (A Contingent worker at Intel) commit fce92dbc611727525e03c31547c715c65960e5ce Author: Pawel Chmielewski Date: Tue Feb 7 17:23:03 2023 +0100 ice: add support BIG TCP on IPv6 Enable sending BIG TCP packets on IPv6 in the ice driver using generic ipv6_hopopt_jumbo_remove helper for stripping HBH header. Tested: netperf -t TCP_RR -H 2001:db8:0:f101::1 -- -r80000,80000 -O MIN_LATENCY,P90_LATENCY,P99_LATENCY,TRANSACTION_RATE Tested on two different setups. In both cases, the following settings were applied after loading the changed driver: ip link set dev enp175s0f1np1 gso_max_size 130000 ip link set dev enp175s0f1np1 gro_max_size 130000 ip link set dev enp175s0f1np1 mtu 9000 First setup: Before: Minimum 90th 99th Transaction Latency Percentile Percentile Rate Microseconds Latency Latency Tran/s Microseconds Microseconds 134 279 410 3961.584 After: Minimum 90th 99th Transaction Latency Percentile Percentile Rate Microseconds Latency Latency Tran/s Microseconds Microseconds 135 178 216 6093.404 The other setup: Before: Minimum 90th 99th Transaction Latency Percentile Percentile Rate Microseconds Latency Latency Tran/s Microseconds Microseconds 218 414 478 2944.765 After: Minimum 90th 99th Transaction Latency Percentile Percentile Rate Microseconds Latency Latency Tran/s Microseconds Microseconds 146 238 266 4700.596 Signed-off-by: Pawel Chmielewski Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fcc2cef37fed567564f5b94a9c0aba733bb159ab Author: Daniel Vacek Date: Thu Jan 19 21:23:16 2023 +0100 ice/ptp: fix the PTP worker retrying indefinitely if the link went down When the link goes down the ice_ptp_tx_tstamp() may loop re-trying to process the packets till the 2 seconds timeout finally drops them. In such a case it makes sense to just drop them right away. Signed-off-by: Daniel Vacek Reviewed-by: Jacob Keller Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 634d841dbfa7c530e54db936db05b8bc3a44f429 Author: Karol Kolacinski Date: Wed Sep 14 12:04:29 2022 +0200 ice: Add GPIO pin support for E823 products Add GPIO pin setup for E823, which is only 1PPS input and output. Signed-off-by: Karol Kolacinski Tested-by: Gurucharan G (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 35f33086b1b9cf5d85f55b36c75b92f8cccfbf12 Author: Bhawanpreet Lakha Date: Tue Jan 17 14:35:41 2023 -0500 drm/amd/display: Add support for multiple overlay planes [Why] We only allowed 1 overlay plane. But now some ASICS can support multiple overlay planes. [How] Use max_slave_planes as the number of overlays we can support. Also since we cannot draw cursor over a video plane, we need to make sure that we reject commits where the topmost plane is a video plane (overlay only). Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Bhawanpreet Lakha Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5ca38a18b5a47017d0e9a016661dad12322767fa Author: Wenjing Liu Date: Wed Feb 1 16:07:35 2023 -0500 drm/amd/display: move public dc link function implementation to dc_link_exports [why] Link is a subcomponent in dc. DM should be aware of dc link structure as one of the abstracted objects maintained by dc. However it should have no idea of the existence of a link component in dc dedicated to maintain the states of dc link structure. As such we are moving link interfaces out of dc_link.h and directly added to dc.h. We are grandually fading out the explicit inclusion of dc_link header and eventually delete it. On dc side, since link is a subcomponent behind dc interfaces, it is not a good idea to implement dc interfaces in each individual subcomponent of link which is already a subcomponent of dc. So we are decoupling it by implementing a dc_link_exports in dc. This file will be a thin translation layer that breaks the dependency so link is able to make interface changes without breaking DM. Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Wenjing Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9b0f51e8449f6f76170fda6a8dd9c417a43ce270 Author: Nicholas Kazlauskas Date: Wed Feb 1 13:38:05 2023 -0500 drm/amd/display: Update Z8 SR exit/enter latencies [Why] Request from HW team to update the latencies to the new measured values. [How] Update the values in the bounding box. Reviewed-by: Charlene Liu Acked-by: Qingqing Zhuo Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 6cfb6df2d645c00513ecf17832928e08979fa953 Author: Leo (Hanghong) Ma Date: Wed Feb 1 16:51:42 2023 -0500 drm/amd/display: Fix FreeSync active bit issue [Why] The FreeSync active bit unconditionally set in HDMI VSIF. [How] Set this bit to true when FAMS is enable on desktop. Reviewed-by: Felipe Clark Acked-by: Qingqing Zhuo Signed-off-by: Leo (Hanghong) Ma Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ba7606846579ce6b1eca25b196e0f88de7e3becf Author: Nasir Osman Date: Wed Feb 1 14:37:12 2023 -0500 drm/amd/display: Disable unbounded request mode during rotation [why] HUBP_UNBOUNDED_REQ_MODE being enabled while the display is rotated (eg. going from Portrait mode to Landscape mode) appears to be causing a p-state hang, specifically during full screen mode on the Tiktok PC app. Unbounded request mode doesn't appear to be supported with rotation configs, hence disabling it. [how] Within DML, modified unbounded request mode to be configured only when the rotation angle of the plane is 0. Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Nasir Osman Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fa9b4155c3d4e8441ea57ad10ec98504845e54bb Author: Yifan Zha Date: Wed Feb 8 16:47:35 2023 +0800 drm/amdgpu: Revert programming GRBM_GFX_* in RLCG interface to support GFX9 [Why] Regression of commit 72fef4980ddf ("drm/amdgpu: Remove writing GRBM_GFX_CNTL in RLCG interface under SRIOV") on GFX9. According to GFX9 VF using different method to access GC registers including MMIO(direct) and RLCG(indirect), removing GRBM_GFX_* writing would make PIPE/ME/VM/QUEUE selection chaos leading to some OCL benchmark failure. For example, using RLCG interface to program GRBM_GFX_CNTL/INDEX for selecting MEC(actually the value is only in scratch2/3), then using MMIO directly program a MEC register in VF driver. The register programming are invalid due to GC switched to incorrect ME. [How] With checking RLCG accessing flag, keep writing GRBM_GFX_* as a legacy way. But it is still skipped on GFX10+ to avoid violation occurrence. Signed-off-by: Yifan Zha Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 48e99fe4d3ba83d6b7bf288e90b360f83e1c6924 Author: Jiapeng Chong Date: Fri Feb 10 10:43:43 2023 +0800 drm/amd/display: Remove the unused variable pre_connection_type Variable pre_connection_type is not effectively used, so delete it. Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4031 Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit ee3916b45add7ba9fa59b0e9832a5d24d34047d7 Author: Jiapeng Chong Date: Fri Feb 10 10:28:39 2023 +0800 drm/amd/display: Remove the unused variable ds_port Variable ds_port is not effectively used, so delete it. drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_capability.c:280:35: warning: variable ‘ds_port’ set but not used. Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4030 Signed-off-by: Jiapeng Chong Signed-off-by: Alex Deucher commit 71c4ca2d3b079d0ba4d9b3033641fea906cebfb6 Author: Nasir Osman Date: Wed Feb 1 14:16:12 2023 -0500 drm/amd/display: Remove stutter only configurations [why] Newer ASICs such as DCN314 needs to allow for both self refresh and mem clk switching rather than just self refresh only. Otherwise, we can see some p-state hangs on ASICs that do support mem clk switching. [how] Added an allow_self_refresh_only flag for dcn30_internal_validate_bw and created a validate_bw method for DCN314 with the allow_self_refresh_only flag set to false (to support mem clk switching). Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Nasir Osman Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d6ed6d0d2aa8f238ca20ed03f24355336ff77dff Author: Tom Chung Date: Wed Feb 1 17:37:51 2023 +0800 drm/amd/display: Fix video glitch while drag window in PSR-SU [Why] Dmub will cache the video position data during PSR-SU enable. The dmub will use an outdated MPO video position if user try to drag the video window and it will cause video glitch. [How] Disable the PSR-SU temporarily while user drag the video window. The PSR-SU will be re-enabled after the video window is stable. Reviewed-by: Sun peng Li Acked-by: Qingqing Zhuo Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e54b214946136ba773fbce9a3b8b4d1ab9d0ad77 Author: Yang Li Date: Fri Feb 10 09:05:58 2023 +0800 drm/amd/display: clean up some inconsistent indentings drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c:145 get_ddc_line() warn: inconsistent indenting drivers/gpu/drm/amd/amdgpu/../display/dc/link/link_factory.c:201 dc_link_construct_phy() warn: inconsistent indenting Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4026 Signed-off-by: Yang Li Signed-off-by: Alex Deucher commit d2c40a2d750e53f871a732d1cc11b92239cd3405 Author: Yang Li Date: Fri Feb 10 08:58:59 2023 +0800 drm/amd/display: Simplify bool conversion ./drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c:1610:68-73: WARNING: conversion to bool not needed here Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4025 Signed-off-by: Yang Li Signed-off-by: Alex Deucher commit f0584be558719e0a7efc78613baa0eafcae05fbe Author: Charlene Liu Date: Tue Jan 31 12:51:40 2023 -0500 drm/amd/display: add NULL pointer check [Why] In virtual link use case, link->ddc could be NULL. [How] Add null pointer check to avoid undefined behavior. Reviewed-by: Martin Leung Reviewed-by: Hansen Dsouza Acked-by: Qingqing Zhuo Signed-off-by: Charlene Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ed6941b632100169aea453f60461ab79111af48c Author: Wenjing Liu Date: Fri Jan 27 19:16:05 2023 -0500 drm/amd/display: on dp link lost event toggle dpms for master pipe only [why] We mistakenly toggle dpms state for non master pipe when handling link lost. A non master pipe doesn't connect to a backend. So it is toggling dpms for non master is undefined and caused NULL pointer dereference. [how] Add helper functions to find an array of active master pipes for current link and only toggle DPMS for active master pipes connected to the link. Add assert in case we get called to program dpms with non master pipe. Reviewed-by: Alvin Lee Acked-by: Qingqing Zhuo Signed-off-by: Wenjing Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3d8fcc6740c9f959bc490cd4a084c5a55b572987 Author: Wenjing Liu Date: Thu Jan 26 15:51:14 2023 -0500 drm/amd/display: Extract temp drm mst deallocation wa into its own function [why] A recent change was made to implement temporary workaround due DRM update in MST interfaces. The workaround is added into our generic deallocation MST sequence. This ticket is to extract this temporary workaround into its own function so it is differentiated from our generic sequence. Reviewed-by: Jerry Zuo Acked-by: Qingqing Zhuo Signed-off-by: Wenjing Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d47d2f9392f69f069c31d60ac3088471b1e1c7d4 Author: Samson Tam Date: Fri Jan 27 18:30:08 2023 -0500 drm/amd/display: enable DPG when disabling plane for phantom pipe [Why] In disable_dangling_plane, for phantom pipes, we enable OTG so disable programming gets the double buffer update. But this causes an underflow to occur. [How] Enable DPG prior to enabling OTG. Reviewed-by: Alvin Lee Acked-by: Qingqing Zhuo Signed-off-by: Samson Tam Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ce05ca0a37e1f27465edee3d14a24ba2bd4bd3e9 Author: Daniel Miess Date: Thu Jan 26 16:54:29 2023 -0500 Revert "drm/amd/display: Correct bw_params population" This reverts commit f5df7725e38853b5b07b7ab41017916f1e5b4e57 [Why] This commit causes corruption when viewing a P010 video clip on a 300Hz eDP Reviewed-by: Nicholas Kazlauskas Acked-by: Qingqing Zhuo Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fbc0c790b1e274d2e1697df98e469cb982ada84e Author: Wenjing Liu Date: Mon Jan 30 18:21:29 2023 -0500 drm/amd/display: do not set RX back to SST mode for non 0 mst stream count [why] a recent regression has caused us to mistakenly switch RX back to SST mode when there are remaining mst stream enabled to the link. We are missing a condition check for stream count before setting RX back to SST mode. [how] Add stream count check condition back and do some further refactor so the logic is easier to understand to prevent future coding error in this sequence. Reviewed-by: Samson Tam Acked-by: Qingqing Zhuo Signed-off-by: Wenjing Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3a61570415690e9d5e7f10a288d25d49163f819d Author: Alvin Lee Date: Tue Jan 31 10:12:43 2023 -0500 drm/amd/display: Fix prefetch vratio check [Why & How] - For prefetch max vratio check, use the calculated prefetch bandwidth from dml32_CalculatePrefetchSchedule instead of max prefetch bandwidth - Also multiply prefetch bandwidth by VRatio since scaling is not considered one calculating require prefetch bw Reviewed-by: Jun Lei Acked-by: Qingqing Zhuo Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 37d184b548db0f64d4a878960b2c6988b38a3e7e Author: Nicholas Kazlauskas Date: Fri Jan 27 10:03:45 2023 -0500 drm/amd/display: Enable P-state validation checks for DCN314 [Why] To align with DCN31 behavior. This helps avoid p-state hangs in the case where underflow does occur. [How] Flip the bit to true. Reviewed-by: Hansen Dsouza Acked-by: Qingqing Zhuo Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3b214bb7185d8284d7d4c53e15127f69a375abf6 Author: Aurabindo Pillai Date: Mon Jan 30 13:07:59 2023 -0500 drm/amd/display: fix k1 k2 divider programming for phantom streams [Why & How] When k1 and k2 divider programming logic is executed for a phantom stream, the corresponding master stream should be used for the calculation. Fix the if condition to use the master stream for checking signal type instead of the phantom stream. Reviewed-by: Alvin Lee Acked-by: Qingqing Zhuo Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b3551ead616318ea155558cdbe7e91495b8d9b33 Author: Jason Gunthorpe Date: Mon Feb 13 10:32:21 2023 -0400 iommufd: Make sure to zero vfio_iommu_type1_info before copying to user Missed a zero initialization here. Most of the struct is filled with a copy_from_user(), however minsz for that copy is smaller than the actual struct by 8 bytes, thus we don't fill the padding. Cc: stable@vger.kernel.org # 6.1+ Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility") Link: https://lore.kernel.org/r/0-v1-a74499ece799+1a-iommufd_get_info_leak_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: syzbot+cb1e0978f6bf46b83a58@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe commit 7cd07d9de8711a0d3f361c84d402e3d6b89ccede Author: Alvin Lee Date: Wed Jan 25 12:33:43 2023 -0500 drm/amd/display: Set max vratio for prefetch to 7.9 for YUV420 MPO [Description] - Single 4K60 playing YUV420 MPO video blocks P-State because the required VRatio for prefetch is too high (luma plane for YUV420 is 1bpe, so swath height is 16 and prefetch requires more lines) - Allow max vratio per plane to be 7.9 for single display YUV420 MPO video cases - Ensure that global vratio prefetch (i.e. total prefetch BW vs. total active bandwidth) does not excited 4.0 Reviewed-by: Nevenko Stupar Acked-by: Qingqing Zhuo Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e383b12709e32d6494c948422070c2464b637e44 Author: Nicholas Kazlauskas Date: Mon Jan 23 14:59:28 2023 -0500 drm/amd/display: Move DCN314 DOMAIN power control to DMCUB [Why] DOMAIN power gating control is now required to be done via firmware due to interlock with other power features. This is to avoid intermittent issues in the LB memories. [How] If the firmware supports the command then use the new firmware as the sequence can avoid potential display corruption issues. The command will be ignored on firmware that does not support DOMAIN power control and the pipes will remain always on - frequent PG cycling can cause the issue to occur on the old sequence, so we should avoid it. Reviewed-by: Hansen Dsouza Acked-by: Qingqing Zhuo Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 230dd6bb61173acccdfbf855ba907286e850cd67 Author: Kenneth Feng Date: Fri Feb 10 13:04:17 2023 +0800 drm/amd/amdgpu: implement mode2 reset on smu_v13_0_10 implement mode2 reset on smu_v13_0_10 Signed-off-by: Kenneth Feng Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 677033b5c903e056d27bd58eccb48c79d92008a8 Author: Xiaogang Chen Date: Wed Feb 8 17:10:59 2023 -0600 drm/amdkfd: Prevent user space using both svm and kfd api to register same user buffer When xnack is on user space can use svm page restore to set a vm range without setup it first, then use regular api to register. Currently kfd api and svm are not interoperable. We already have check on that, but for user buffer the mapping address is not same as buffer cpu virtual address. Add checking on that to avoid error propagate to hmm. Signed-off-by: Xiaogang Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit be9f1daad7b4064474a6e5dd03c55b882c9cf928 Author: Ma Jun Date: Wed Feb 8 10:22:55 2023 +0800 drm/amdgpu: Fix the warning info when unload or remove amdgpu Checking INVOKE_CMD to fix the below warning info when unload or remove amdgpu driver [ 319.489809] Call Trace: [ 319.489810] [ 319.489812] psp_ta_unload+0x9a/0xd0 [amdgpu] [ 319.489926] ? smu_smc_hw_cleanup+0x2f6/0x360 [amdgpu] [ 319.490072] psp_hw_fini+0xea/0x170 [amdgpu] [ 319.490231] amdgpu_device_fini_hw+0x2fc/0x413 [amdgpu] [ 319.490398] ? blocking_notifier_chain_unregister+0x56/0xb0 [ 319.490401] amdgpu_driver_unload_kms+0x51/0x60 [amdgpu] [ 319.490493] amdgpu_pci_remove+0x5a/0x140 [amdgpu] [ 319.490583] ? __pm_runtime_resume+0x60/0x90 [ 319.490586] pci_device_remove+0x3b/0xb0 [ 319.490588] __device_release_driver+0x1a8/0x2a0 [ 319.490591] driver_detach+0xf3/0x140 [ 319.490593] bus_remove_driver+0x6c/0xf0 [ 319.490595] driver_unregister+0x31/0x60 [ 319.490597] pci_unregister_driver+0x40/0x90 [ 319.490599] amdgpu_exit+0x15/0x44e [amdgpu] Signed-off-by: Ma Jun Reviewed-by: Alex Deucher Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit b46d80bd2d6e7e063c625a20de54248afe8d4889 Author: Benjamin Coddington Date: Tue Feb 14 08:18:23 2023 -0500 nfs4trace: fix state manager flag printing __print_flags wants a mask, not the enum value. Add two more flags. Fixes: 511ba52e4c01 ("NFS4: Trace state recovery operation") Signed-off-by: Benjamin Coddington Signed-off-by: Anna Schumaker commit 0eb15a47bf437a268b69ab1a1a45fdf1f609b69f Author: Shuah Khan Date: Tue Feb 14 12:19:39 2023 -0700 selftests/user_events: add a note about user_events.h dependency This test depends on exported in uapi The following commit removed user_events.h out of uapi: commit 5cfff569cab8 ("tracing: Move user_events.h temporarily out of include/uapi") This test will not compile until user_events.h is added back to uapi. Signed-off-by: Shuah Khan commit b0bbd86a288ab35234edb704935982c20f74628d Author: Thomas Weißschuh Date: Tue Feb 14 03:20:55 2023 +0000 dm sysfs: make kobj_type structure constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definition to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Signed-off-by: Mike Snitzer commit a7e8f7fbe2adc132c0222fea96a18610337e2775 Author: Tetsuo Handa Date: Wed Apr 20 14:12:26 2022 +0900 dm: update targets using system workqueues to use a local workqueue Flushing system-wide workqueues is dangerous and will be forbidden. Use a local workqueue in dm-mpath.c, dm-raid1.c, and dm-stripe.c. Link: https://lkml.kernel.org/r/49925af7-78a8-a3dd-bce6-cfc02e1a9236@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Signed-off-by: Mike Snitzer commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 Author: Mike Snitzer Date: Tue Feb 14 13:06:05 2023 -0500 dm: remove flush_scheduled_work() during local_exit() Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") switched from using system workqueue to a single workqueue local to DM. But it didn't eliminate the call to flush_scheduled_work() that was introduced purely for the benefit of deferred device removal with commit 2c140a246dc ("dm: allow remove to be deferred"). Since DM core uses its own workqueue (and queue_work) there is no need to call flush_scheduled_work() from local_exit(). local_exit()'s destroy_workqueue(deferred_remove_workqueue) handles flushing work started with queue_work(). Fixes: acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") Signed-off-by: Mike Snitzer commit f0ac1598712ff0f7b985d58546449e232487ee0e Author: Heinz Mauelshagen Date: Tue Feb 7 23:29:02 2023 +0100 dm clone: prefer kvmalloc_array() Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 774f13ac2b567207f04eb34d25188f5daec57f9e Author: Heinz Mauelshagen Date: Tue Feb 7 23:15:36 2023 +0100 dm: declare variables static when sensible Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 23fda2effbb1f2f1d2fb0640a4729e6d08ad6e6e Author: Heinz Mauelshagen Date: Tue Feb 7 23:06:47 2023 +0100 dm: fix suspect indent whitespace Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 22a8b84945e9a5027174e06ec5c8ce3d978844d6 Author: Heinz Mauelshagen Date: Tue Feb 7 23:04:01 2023 +0100 dm ioctl: prefer strscpy() instead of strlcpy() Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit b39b73243dd40b8b55a80cce7520745c9559a08d Author: Heinz Mauelshagen Date: Tue Feb 7 22:27:11 2023 +0100 dm: avoid void function return statements Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit ba287d7ccb9b4afb69ce67743db5211c49b35d8b Author: Heinz Mauelshagen Date: Tue Feb 7 22:22:08 2023 +0100 dm integrity: change macros min/max() -> min_t/max_t where appropriate Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 8d1058fb2ac29644d8a427eb3d3eeff2fd88f0a7 Author: Heinz Mauelshagen Date: Tue Feb 7 22:16:53 2023 +0100 dm: fix use of sizeof() macro Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 6cc435fa76cc1786ef460c08c31b1d27c13e9cff Author: Heinz Mauelshagen Date: Tue Feb 7 22:07:22 2023 +0100 dm: avoid 'do {} while(0)' loop in single statement macros Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit dcdd467915de0435bbaf99396f20293166b3d3a4 Author: Heinz Mauelshagen Date: Tue Feb 7 22:02:17 2023 +0100 dm log: avoid multiple line dereference Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit fb99e87b44ff8e77fe1406796361db194c17aedd Author: Heinz Mauelshagen Date: Tue Feb 7 22:00:44 2023 +0100 dm log: avoid trailing semicolon in macro Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 5cae0aa77397015f530aeb34f3ced32db6ac2875 Author: Heinz Mauelshagen Date: Tue Feb 7 21:47:45 2023 +0100 dm ioctl: have constant on the right side of the test Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit a6ba79c0144f449fcf65aa829ca8d7341811f83a Author: Heinz Mauelshagen Date: Tue Feb 7 21:02:51 2023 +0100 dm: don't indent labels Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 9bfeac5d33d8500332d75e32abe32c0df4910add Author: Heinz Mauelshagen Date: Tue Feb 7 20:56:57 2023 +0100 dm: avoid inline filenames Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit b30f1607146c736684c069fe92dc39607d77d15f Author: Heinz Mauelshagen Date: Tue Feb 7 20:48:51 2023 +0100 dm: add missing blank line after declarations/fix those Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 1c3fe2fa946342a784a1375a63be6eb5a25acd76 Author: Heinz Mauelshagen Date: Tue Feb 7 20:35:25 2023 +0100 dm: avoid useless 'else' after 'break' or return' Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit ae99111ecf70c3003b4b1ba38b95fbe35410b2a6 Author: Heinz Mauelshagen Date: Tue Feb 7 18:38:28 2023 +0100 dm: favour __packed versus "__attribute__ ((packed))" Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit f8922a48291d40c4fb07d66ef88c69ea415d8cd9 Author: Heinz Mauelshagen Date: Tue Feb 7 18:35:43 2023 +0100 dm: favour __aligned(N) versus "__attribute__ (aligned(N))" Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 6a808034724b5a36f8e0b712427bfbe9e667d296 Author: Heinz Mauelshagen Date: Mon Feb 6 23:58:05 2023 +0100 dm: avoid using symbolic permissions Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 1c13188669282dac48f1e67d77f07a746a4899d7 Author: Heinz Mauelshagen Date: Mon Feb 6 23:42:32 2023 +0100 dm: prefer '"%s...", __func__' Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit aa07f9d806f994f7cf42494c2b99573e77cdae21 Author: Heinz Mauelshagen Date: Fri Feb 3 22:17:21 2023 +0100 dm: adjust EXPORT_SYMBOL() to follow functions immediately Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 2e84fecf19e1694338deec8bf6c90ff84f8f31fb Author: Heinz Mauelshagen Date: Fri Feb 3 18:55:47 2023 +0100 dm: avoid split of quoted strings where possible Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 2d0f25cbc0d948e01573cc8ff5967e81bd98a4a1 Author: Heinz Mauelshagen Date: Thu Feb 2 17:10:52 2023 +0100 dm: remove unnecessary braces from single statement blocks Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 0ef0b4717aa6849d251b23ae1efe93ca93af540b Author: Heinz Mauelshagen Date: Wed Feb 1 23:42:29 2023 +0100 dm: add missing empty lines Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 02f10ba178e7a43faf7107cd15111e0f81e6ac70 Author: Heinz Mauelshagen Date: Wed Feb 1 22:36:19 2023 +0100 dm: add argument identifier names Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 8ca817c43e12847be182e0bbff9b59398373a3b8 Author: Heinz Mauelshagen Date: Wed Feb 1 22:31:43 2023 +0100 dm: avoid spaces before function arguments or in favour of tabs Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit beecc8438c6c2089b0a1f82720530c82da5765bc Author: Heinz Mauelshagen Date: Wed Feb 1 21:57:45 2023 +0100 dm block-manager: avoid not required parentheses Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit ced6e475c3754dad3b63966d79f375d8f7193750 Author: Heinz Mauelshagen Date: Tue Jan 31 19:47:36 2023 +0100 dm crypt: correct 'foo*' to 'foo *' Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 03b18887703c5fa342896e52e873812ea33d964b Author: Heinz Mauelshagen Date: Mon Jan 30 22:13:54 2023 +0100 dm: fix trailing statements Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 43be9c743c2553519c2093d1798b542f28095a51 Author: Heinz Mauelshagen Date: Mon Jan 30 21:43:57 2023 +0100 dm: fix undue/missing spaces Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit a4a82ce3d24d4409143a7b7b980072ada6e20b2a Author: Heinz Mauelshagen Date: Thu Jan 26 15:48:30 2023 +0100 dm: correct block comments format. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 255e2646496fcbf836a3dfe1b535692f09f11b45 Author: Heinz Mauelshagen Date: Wed Jan 25 23:31:55 2023 +0100 dm: address indent/space issues Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 96422281baf57f4d9418581fdfaca9617bb805e1 Author: Heinz Mauelshagen Date: Wed Jan 25 22:57:42 2023 +0100 dm: address space issues relative to switch/while/for/... Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 2f06cd12e11422e4a44ad4cb856c3ef0be9bd208 Author: Heinz Mauelshagen Date: Mon Jan 30 21:28:24 2023 +0100 dm: avoid initializing static variables Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 44bc08ed63db7a852bd1ba16611b700ee666091c Author: Heinz Mauelshagen Date: Wed Feb 1 21:51:04 2023 +0100 dm: enclose complex macros into parentheses where possible Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit d715fa23577cd5d36830c4ecd7e2bfcb4750b351 Author: Heinz Mauelshagen Date: Wed Feb 1 21:17:44 2023 +0100 dm: avoid assignment in if conditions Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 86a3238c7b9b759cb864f4f768ab2e24687dc0e6 Author: Heinz Mauelshagen Date: Wed Jan 25 21:14:58 2023 +0100 dm: change "unsigned" to "unsigned int" Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 238d991f054a553e823d12b0ffd52aaeedd65f70 Author: Heinz Mauelshagen Date: Wed Jan 25 22:44:39 2023 +0100 dm: use fsleep() instead of msleep() for deterministic sleep duration Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 0d78954a2d80e648cfed1d306fffe52c6211c432 Author: Heinz Mauelshagen Date: Tue Feb 7 20:22:58 2023 +0100 dm: prefer kmap_local_page() instead of deprecated kmap_atomic() Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 3bd940030752a33ff665eefdd74a1cdb74a4f9b0 Author: Heinz Mauelshagen Date: Wed Jan 25 21:00:44 2023 +0100 dm: add missing SPDX-License-Indentifiers 'GPL-2.0-only' is used instead of 'GPL-2.0' because SPDX has deprecated its use. Suggested-by: John Wiele Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer commit 2de3d04b3bcba3ae0474373cbd0c85f4f09ed9d2 Author: Trond Myklebust Date: Thu Jan 19 16:33:51 2023 -0500 NFS: Remove unnecessary check in nfs_read_folio() All the callers are expected to supply a valid struct file argument, so there is no need for the NULL check. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 256093fec1f0ae2f10eb3aae5903ecb689c55ecc Author: Trond Myklebust Date: Thu Jan 19 16:33:50 2023 -0500 NFS: Improve tracing of nfs_wb_folio() Include info about which folio is being traced. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit eb5654b3b89d5e836312cea9f3fdb49457852e89 Author: Trond Myklebust Date: Thu Jan 19 16:33:49 2023 -0500 NFS: Enable tracing of nfs_invalidate_folio() and nfs_launder_folio() Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 96780ca55e3cbf4f150fd5a833a61492c9947b5b Author: Trond Myklebust Date: Thu Jan 19 16:33:48 2023 -0500 NFS: fix up nfs_release_folio() to try to release the page If the gfp context allows it, and we're not kswapd, then try to write out the folio that has private data. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 70e9db69f927bb378db9aaa807cc83ae550779a9 Author: Trond Myklebust Date: Thu Jan 19 16:33:47 2023 -0500 NFS: Clean up O_DIRECT request allocation Rather than adjusting the index+offset after the call to nfs_create_request(), add a function nfs_page_create_from_page() that takes an offset. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 4fa7a717b432c3311192aa85a34fedf5f8de4689 Author: Trond Myklebust Date: Thu Jan 19 16:33:46 2023 -0500 NFS: Fix up nfs_vm_page_mkwrite() for folios Mechanical conversion of struct page and functions into the folio equivalents. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 54d99381b7371d2999566d1fb4ea88d46cf9d865 Author: Trond Myklebust Date: Thu Jan 19 16:33:45 2023 -0500 NFS: Convert nfs_write_begin/end to use folios Add a helper nfs_folio_grab_cache_write_begin() that can call __filemap_get_folio() directly with the appropriate parameters. Since write_begin()/write_end() take struct page arguments, just pass the folio->page back for now. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 4cbf76948c457f0beb9f184ebb21341c8235846a Author: Trond Myklebust Date: Thu Jan 19 16:33:44 2023 -0500 NFS: Remove unused function nfs_wb_page() Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 0c493b5cf16e28d761b6e77c7c32aa0e7af70813 Author: Trond Myklebust Date: Thu Jan 19 16:33:43 2023 -0500 NFS: Convert buffered writes to use folios Mostly mechanical conversion of struct page and functions into struct folio equivalents. The lack of support for folios in write_cache_pages(), means we still only support order 0 folio allocations. However the rest of the writeback code should now be ready for order n > 0. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 5241060e8b4f09d63a004b7a735346442fd3ab2d Author: Trond Myklebust Date: Thu Jan 19 16:33:42 2023 -0500 NFS: Convert the function nfs_wb_page() to use folios Convert to use the folio functions, but pass the struct page to nfs_writepage_locked() for now. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit ab75bff1140733f1b43e81f055acd7d27af7ac05 Author: Trond Myklebust Date: Thu Jan 19 16:33:41 2023 -0500 NFS: Convert buffered reads to use folios Perform a largely mechanical conversion of references to struct page and page-specific functions to use the folio equivalents. Note that the fscache functionality remains untouched. Instead we just pass in the folio page. This should be OK, as long as we use order 0 folios together with fscache. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 4b27232a6e064f3d779cfa76cd251d6023949d22 Author: Trond Myklebust Date: Thu Jan 19 16:33:40 2023 -0500 NFS: Add a helper nfs_wb_folio() ...and use it in nfs_launder_folio(). Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit cbefa53cb1fe30ae4467be863afc3cf60238fd08 Author: Trond Myklebust Date: Thu Jan 19 16:33:39 2023 -0500 NFS: Convert the remaining pagelist helper functions to support folios Allow creation of subrequests from a request that is carrying a folio. Add helpers to set up and tear down requests carrying folios. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 6dd85e83f3f182b56770f8bb6dbed1f0dafb9117 Author: Trond Myklebust Date: Thu Jan 19 16:33:38 2023 -0500 NFS: Add a helper to convert a struct nfs_page into an inode Replace all the open coded calls to page_file_mapping(req->wb_page)->host. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 8e0bdc7021f713fdf3b985cda3ce715e41b06698 Author: Trond Myklebust Date: Thu Jan 19 16:33:37 2023 -0500 NFS: Fix nfs_coalesce_size() to work with folios Use the helper folio_size() where appropriate. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit eb9f2a5a5e85fd24949480d1d02c2a497f26e154 Author: Trond Myklebust Date: Thu Jan 19 16:33:36 2023 -0500 NFS: Support folios in nfs_generic_pgio() Add support for multi-page folios in the generic NFS i/o engine. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 35c5db0ec49f073e6a2d5236b5fcfb0a134a215a Author: Trond Myklebust Date: Thu Jan 19 16:33:35 2023 -0500 NFS: Add basic functionality for tracking folios in struct nfs_page Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 785207aa3d61ec1cb86e4441bff0a37c412ebd10 Author: Trond Myklebust Date: Thu Jan 19 16:33:34 2023 -0500 NFS: Fix for xfstests generic/208 If the same page and data is being used for multiple requests, then ignore that when the request indicates we're reading from the start of the page. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker commit 7533afa1d27ba1234146d31d2402c195cf195962 Author: Mikulas Patocka Date: Tue Feb 7 08:33:06 2023 -0500 dm: send just one event on resize, not two Device mapper sends an uevent when the device is suspended, using the function set_capacity_and_notify. However, this causes a race condition with udev. Udev skips scanning dm devices that are suspended. If we send an uevent while we are suspended, udev will be racing with device mapper resume code. If the device mapper resume code wins the race, udev will process the uevent after the device is resumed and it will properly scan the device. However, if udev wins the race, it will receive the uevent, find out that the dm device is suspended and skip scanning the device. This causes bugs such as systemd unmounting the device - see https://bugzilla.redhat.com/show_bug.cgi?id=2158628 This commit fixes this race. We replace the function set_capacity_and_notify with set_capacity, so that the uevent is not sent at this point. In do_resume, we detect if the capacity has changed and we pass a boolean variable need_resize_uevent to dm_kobject_uevent. dm_kobject_uevent adds "RESIZE=1" to the uevent if need_resize_uevent is set. Signed-off-by: Mikulas Patocka Tested-by: Peter Rajnoha Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer commit cf08e29db760b144bde51e2444f3430c75763e26 Author: Johannes Berg Date: Tue Feb 14 20:08:15 2023 +0100 wifi: mac80211: fix off-by-one link setting The convention for find_first_bit() is 0-based, while ffs() is 1-based, so this is now off-by-one. I cannot reproduce the gcc-9 problem, but since the -1 is now removed, I'm hoping it will still avoid the original issue. Reported-by: Alexander Lobakin Fixes: 1d8d4af43474 ("wifi: mac80211: avoid u32_encode_bits() warning") Signed-off-by: Johannes Berg commit a46bebd502fe1a3bd1d22f64cedd93e7e7702693 Author: Daeho Jeong Date: Thu Feb 9 10:18:19 2023 -0800 f2fs: synchronize atomic write aborts To fix a race condition between atomic write aborts, I use the inode lock and make COW inode to be re-usable thoroughout the whole atomic file inode lifetime. Reported-by: syzbot+823000d23b3400619f7c@syzkaller.appspotmail.com Fixes: 3db1de0e582c ("f2fs: change the current atomic write way") Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7e986855fe13de2c8290c1102292d8e5f29dd769 Author: Jaegeuk Kim Date: Mon Feb 13 09:41:33 2023 -0800 f2fs: fix wrong segment count MAIN_SEGS is for data area, while TOTAL_SEGS includes data and metadata. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit dda7d77bcd424ce5da80dd5a7ec92ead00279c02 Author: Yangtao Li Date: Mon Feb 13 22:18:25 2023 +0800 f2fs: replace si->sbi w/ sbi in stat_show() For each loop add a local f2fs_sb_info pointer insted of looking it up. Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f2e357893cb7d15994e4ec10838ebb4dccf7eb6e Author: Yangtao Li Date: Mon Feb 13 22:18:24 2023 +0800 f2fs: export ipu policy in debugfs Export ipu_policy as a string in debugfs for better readability and it can help us better understand some strategies of the file system. Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1dd46599f83ac5323a175d32955b1270e95cd11b Author: Vadim Fedorenko Date: Tue Feb 14 05:59:28 2023 -0800 spi: xilinx: add force_irq for QSPI mode Xilinx PG158 page 80 [1] states that master transaction inhibit bit must be set to properly setup the transaction in QSPI mode. Add the force_irq flag to follow this sequence. [1] https://docs.xilinx.com/r/en-US/pg153-axi-quad-spi/Dual/Quad-SPI-Mode-Transactions Signed-off-by: Vadim Fedorenko Link: https://lore.kernel.org/r/20230214135928.1253205-1-vadfed@meta.com Signed-off-by: Mark Brown commit e97622254420ce5f03f3f3e6ad6ecbf86da248d9 Merge: 7ec844a2c7535 d403fb6e76bf8 Author: Mark Brown Date: Tue Feb 14 18:04:11 2023 +0000 spi: STIG Mode Fixes for spi-cadence-qspi driver Merge series from Dhruva Gole : * Reset the CMD_CTRL Register, without which read/writes in STIG mode were failing in some cases. The issue came to light while using STIG Mode for small reads. * Also add a flag that can allow us to do direct reads but distinguish direct writes, thus enabling us to disable writes in DAC mode in some cases that require it. (Like to write to some connected Flash registers) * Fix register reads in STIG mode and also use STIG mode while reading flash registers. Currently if you try to read a register while in STIG mode there is no support for ADDR and thus naturally a register never gets read from the flash. This patch series has been tested on a TI AM625-SK-EVM with both a quad spi nor flash (s25hs) and OSPI NOR Flash (s28hs). Output of ltp-ddt test, "DD_RW_ERASESIZE_UBIFS" run with s25hs512t flash: ... [ 2.334068] spi-nor spi0.0: s25hs512t (65536 Kbytes) [ 2.339185] 7 fixed-partitions partitions found on MTD device fc40000.spi.0 [ 2.346158] Creating 7 MTD partitions on "fc40000.spi.0": [ 2.351555] 0x000000000000-0x000000080000 : "ospi.tiboot3" [ 2.358344] 0x000000080000-0x000000280000 : "ospi.tispl" [ 2.364788] 0x000000280000-0x000000680000 : "ospi.u-boot" [ 2.371311] 0x000000680000-0x0000006c0000 : "ospi.env" [ 2.377519] 0x0000006c0000-0x000000700000 : "ospi.env.backup" [ 2.384419] 0x000000800000-0x000003fc0000 : "ospi.rootfs" [ 2.390890] 0x000003fc0000-0x000004000000 : "ospi.phypattern" ..snip.. Test Start Time: Wed Jan 11 21:14:31 2023 ----------------------------------------- Testcase Result Exit Value -------- ------ ---------- OSPI_S_FUNC_DD_RW_ERASESIZE_UBIFS PASS 0 ----------------------------------------------- Total Tests: 1 Total Skipped Tests: 0 Total Failures: 0 Kernel Version: 6.2.0-rc1-00040-g700d796a94e0-dirty Machine Architecture: aarch64 Hostname: am62xx-evm commit f81dc982fde7f36bbf1de80cb4eb98586a76070b Merge: ec285cb999c14 6611b975eb87d Author: Mark Brown Date: Tue Feb 14 17:59:59 2023 +0000 ASoC: SOF: Intel/ipc4: Support for low power playback Merge series from Peter Ujfalusi : The following series will enable the the Low Power Audio (LPA) playback on Intel platforms when using IPC4. The support is closely follows how IPC3 supports similar use case. All depending patches are upstream and our CI have been testing this feature for some time without issues. commit 0aee6bec0f44dd344c2637632cb13828990524e2 Author: Nick Desaulniers Date: Thu Feb 2 10:05:48 2023 -0800 Documentation/llvm: add Chimera Linux, Google and Meta datacenters Chimera Linux is a Linux distribution from 2021 that builds its kernels with Clang. Google transitioned its data center fleet to run Clang built kernels in 2021, and Meta did so as well in 2022. Meta talked about this at LPC 2022 at a talk titled Kernel Live Patching at Scale. These were important milestones for building the kernel with Clang. Making note of them helps improve confidence in the project. Reviewed-by: Tom Rix Reviewed-by: Nathan Chancellor Reviewed-by: Sedat Dilek Co-developed-by: Yonghong Song Signed-off-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 6ab7e1f95e96f0c688ae132b0e9a16c0f206689d Author: Masahiro Yamada Date: Sun Feb 5 21:09:57 2023 +0900 setlocalversion: use only the correct release tag for git-describe Currently, setlocalversion uses any annotated tag for git-describe. If we are at a tagged commit, it will not append the commit hash. $ git checkout v6.2-rc1^ $ make -s defconfig kernelrelease 6.1.0-14595-g292a089d78d3 $ git tag -a foo -m foo $ make -s kernelrelease 6.1.0 If a local tag 'foo' exists, it pretends to be a released version '6.1.0', while there are many commits on top of it. The output should be consistent irrespective of such a local tag. Pass the correct release tag to --match option of git-describe. In the mainline kernel, the SUBLEVEL is always '0', which is omitted from the tag. KERNELVERSION annotated tag 6.1.0 -> v6.1 (mainline) 6.2.0-rc5 -> v6.2-rc5 (mainline, release candidate) 6.1.7 -> v6.1.7 (stable) To preserve the behavior in linux-next, use the tag derived from localversion* files if exists. In linux-next, the local version is specified by the localversion-next file. Signed-off-by: Masahiro Yamada commit 82b34b0800af8c9fc9988c290cdc813e0ca0df31 Author: Manivannan Sadhasivam Date: Mon Feb 13 20:19:22 2023 +0530 PCI: pciehp: Add Qualcomm quirk for Command Completed erratum The Qualcomm PCI bridge device (Device ID 0x010e) found in chipsets such as SC8280XP used in Lenovo Thinkpad X13s, does not set the Command Completed bit unless writes to the Slot Command register change "Control" bits. This results in timeouts like below during boot and resume from suspend: pcieport 0002:00:00.0: pciehp: Timeout on hotplug command 0x03c0 (issued 2020 msec ago) ... pcieport 0002:00:00.0: pciehp: Timeout on hotplug command 0x13f1 (issued 107724 msec ago) Add the device to the Command Completed quirk to mark commands "completed" immediately unless they change the "Control" bits. Link: https://lore.kernel.org/r/20230213144922.89982-1-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas commit f356132229b18ceef5d5ef9103bbaa9bdeb84c8d Author: Robert Marko Date: Fri Jan 13 17:44:47 2023 +0100 PCI: qcom: Add IPQ8074 Gen3 port support IPQ8074 has one Gen2 and one Gen3 port, with Gen2 port already supported. Add compatible for Gen3 port which uses the same controller as IPQ6018. Link: https://lore.kernel.org/r/20230113164449.906002-7-robimarko@gmail.com Signed-off-by: Robert Marko Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas commit 2b1c46ce137b66d38a08aff924137a6fc4e9700e Author: Robert Marko Date: Fri Jan 13 17:44:46 2023 +0100 dt-bindings: PCI: qcom: Add IPQ8074 Gen3 port IPQ8074 has one Gen2 and one Gen3 PCIe port, with Gen2 already supported. Document Gen3 port which uses the same controller as IPQ6018. Link: https://lore.kernel.org/r/20230113164449.906002-6-robimarko@gmail.com Signed-off-by: Robert Marko Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Krzysztof Kozlowski commit 371a6106b71aeda94a6fcdb8f7cb674dd3c34a96 Author: Robert Marko Date: Fri Jan 13 17:44:45 2023 +0100 dt-bindings: PCI: qcom: Sort compatibles alphabetically Sort the compatibles list alphabetically for maintenance. Link: https://lore.kernel.org/r/20230113164449.906002-5-robimarko@gmail.com Signed-off-by: Robert Marko Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Kozlowski commit 997e010de9134474dbfde52be03efd7d1bce902d Author: Johan Hovold Date: Mon Oct 17 13:47:04 2022 +0200 PCI: qcom: Fix host-init error handling Implement the new host_deinit() callback so that the PHY is powered off and regulators and clocks are disabled also on late host-init errors. Link: https://lore.kernel.org/r/20221017114705.8277-2-johan+linaro@kernel.org Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver") Signed-off-by: Johan Hovold Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 720e0d91c9772b60a87eb361da02deb3c0c628e4 Author: Dmitry Baryshkov Date: Sat Nov 19 01:32:37 2022 +0200 PCI: qcom: Add SM8350 support Add support for the PCIe host on Qualcomm SM8350 platform. Link: https://lore.kernel.org/r/20221118233242.2904088-4-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Bjorn Andersson commit 89a7adad3c0dfccf01643913bde7244feea85f59 Author: Dmitry Baryshkov Date: Sat Nov 19 01:32:35 2022 +0200 dt-bindings: PCI: qcom: Add SM8350 Add bindings for two PCIe hosts on SM8350 platform. The only difference between them is in the aggre0 clock, which warrants the oneOf clause for the clocks properties. Link: https://lore.kernel.org/r/20221118233242.2904088-2-dmitry.baryshkov@linaro.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring commit a0754633c32171be7b2a9b8717022f7848efd0c5 Author: Krzysztof Kozlowski Date: Wed Nov 9 12:32:02 2022 +0100 dt-bindings: PCI: qcom-ep: Correct qcom,perst-regs qcom,perst-regs is an phandle array of one item with a phandle and its arguments. Link: https://lore.kernel.org/r/20221109113202.74406-1-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring Reviewed-by: Dmitry Baryshkov Acked-by: Manivannan Sadhasivam commit 0b93acc60cf36b35132ee8d959e7779db2fcf35b Author: Krzysztof Kozlowski Date: Fri Jan 6 09:12:03 2023 +0100 dt-bindings: PCI: qcom: Unify MSM8996 and MSM8998 clock order MSM8996 and MSM8998 use the same clocks, so use one order to make the binding simpler. Link: https://lore.kernel.org/r/20230106081203.14118-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Helgaas Acked-by: Rob Herring commit ff0132f7cf11307deb79a37622b11a16c0a294ed Author: Krzysztof Kozlowski Date: Fri Jan 6 09:12:02 2023 +0100 dt-bindings: PCI: qcom: Add MSM8998 specific compatible Add new compatible for MSM8998 (compatible with MSM8996) to allow further customizing if needed and to accurately describe the hardware. Link: https://lore.kernel.org/r/20230106081203.14118-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Helgaas Acked-by: Rob Herring commit 75078afebb48a16d042717fe26d204cdd2743ff8 Author: Bjorn Helgaas Date: Fri Oct 21 15:18:38 2022 -0500 alpha: remove unused __SLOW_DOWN_IO and SLOW_DOWN_IO definitions Remove unused __SLOW_DOWN_IO and SLOW_DOWN_IO definitions. Signed-off-by: Bjorn Helgaas Signed-off-by: Matt Turner commit 9f416948706fd9831314e5747fad07b76916d471 Author: Lukas Bulwahn Date: Thu Sep 29 12:13:29 2022 +0200 alpha: update config files Clean up config files by: - removing configs that were deleted in the past - removing configs not in tree and without recently pending patches - adding new configs that are replacements for old configs in the file For some detailed information, see Link. Link: https://lore.kernel.org/kernel-janitors/20220929090645.1389-1-lukas.bulwahn@gmail.com/ Signed-off-by: Lukas Bulwahn Signed-off-by: Matt Turner commit b6b17a8b3ecd878d98d5472a9023ede9e669ca72 Author: Edward Humes Date: Sat Aug 27 02:49:39 2022 -0400 alpha: fix R_ALPHA_LITERAL reloc for large modules Previously, R_ALPHA_LITERAL relocations would overflow for large kernel modules. This was because the Alpha's apply_relocate_add was relying on the kernel's module loader to have sorted the GOT towards the very end of the module as it was mapped into memory in order to correctly assign the global pointer. While this behavior would mostly work fine for small kernel modules, this approach would overflow on kernel modules with large GOT's since the global pointer would be very far away from the GOT, and thus, certain entries would be out of range. This patch fixes this by instead using the Tru64 behavior of assigning the global pointer to be 32KB away from the start of the GOT. The change made in this patch won't work for multi-GOT kernel modules as it makes the assumption the module only has one GOT located at the beginning of .got, although for the vast majority kernel modules, this should be fine. Of the kernel modules that would previously result in a relocation error, none of them, even modules like nouveau, have even come close to filling up a single GOT, and they've all worked fine under this patch. Signed-off-by: Edward Humes Signed-off-by: Matt Turner commit 73c4f828ce6586b83f9d2a1824b5bf7a72acce62 Author: Zhang Jiaming Date: Tue Jun 21 16:15:06 2022 +0800 alpha: Add some spaces to ensure format specification Add a space after ','. Add spaces around the '=', '>' and '=='. Signed-off-by: Zhang Jiaming Signed-off-by: Matt Turner commit d6e595792fb6c02c220bf68b50cf7649b1f05e15 Author: Yang Yang Date: Tue Mar 29 02:57:38 2022 +0000 alpha: replace NR_SYSCALLS by NR_syscalls Reference to other arch likes x86_64 or arm64 to do this replacement. To solve compile error when using NR_syscalls in kernel[1]. [1] https://lore.kernel.org/all/202203270449.WBYQF9X3-lkp@intel.com/ Signed-off-by: Yang Yang Signed-off-by: Matt Turner commit 19fa21d74704a7ee1158337ccccf19f8f6d82719 Author: Maciej W. Rozycki Date: Sun Feb 13 20:01:21 2022 +0000 alpha: Remove redundant local asm header redirections Remove a number of asm headers locally redirected to the respective generic or generated versions. For asm-offsets.h all that is needed is a Kbuild entry for the generic version, and for div64.h, irq_regs.h and kdebug.h nothing is needed as in their absence they will be redirected automatically according to include/asm-generic/Kbuild. Signed-off-by: Maciej W. Rozycki Signed-off-by: Matt Turner commit bd1912de892ce30e1e2242e67716d25188fbfa44 Author: Kees Cook Date: Wed Feb 23 22:05:58 2022 -0800 alpha: Implement "current_stack_pointer" To follow the existing per-arch conventions replace open-coded use of asm "$30" as "current_stack_pointer". This will let it be used in non-arch places (like HARDENED_USERCOPY). Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: Geert Uytterhoeven Cc: Andrew Morton Cc: Mike Rapoport Cc: Mark Rutland Cc: "Peter Zijlstra (Intel)" Cc: Kefeng Wang Cc: "Alexander A. Klimov" Cc: linux-alpha@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Matt Turner commit d7cf43edebe577c58c7858cf61b03d618d4336cf Author: Minghao Chi Date: Mon Jan 10 01:29:54 2022 +0000 alpha: remove redundant err variable Return value from __hw_perf_event_init() directly instead of taking this in another redundant variable. Reported-by: Zeal Robot Signed-off-by: Minghao Chi Signed-off-by: CGEL ZTE Signed-off-by: Matt Turner commit 019f48dc8eba723d2201679b804f4600e816604a Author: Colin Ian King Date: Mon Dec 13 18:56:25 2021 +0000 alpha: osf_sys: reduce kernel log spamming on invalid osf_mount call typenr Calling the osf_mount system call with an invalid typenr value will spam the kernel log with error messages. Reduce the spamming by making it a ratelimited printk. Issue found when exercising with the stress-ng enosys system call stressor. Signed-off-by: Colin Ian King Signed-off-by: Matt Turner commit 25d10262ed8aae71cd2f0b3c0a90d06a6b79fba2 Author: Bastian Germann Date: Tue Feb 14 00:19:28 2023 +0100 dt-bindings: hwlock: sun6i: Add missing #hwlock-cells The allwinner,sun6i-a31-hwspinlock.yaml binding needs #hwlock-cells which is required by the hwlock type. Fixes: f9e784dcb63f ("dt-bindings: hwlock: add sun6i_hwspinlock") Signed-off-by: Bastian Germann Acked-by: Krzysztof Kozlowski Reviewed-by: Andre Przywara Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213231931.6546-2-bage@debian.org commit 6f9c2f19a8743c880903a031c7f3f3c534d4b813 Author: Krzysztof Kozlowski Date: Wed Feb 8 11:15:45 2023 +0100 dt-bindings: remoteproc: qcom,glink-edge: correct label description Correct the description of 'label' property. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230208101545.45711-7-krzysztof.kozlowski@linaro.org commit fdafdddf7b2f5cab8d233ef97f1fad8ec7d2e7a0 Author: Krzysztof Kozlowski Date: Wed Feb 8 11:15:44 2023 +0100 dt-bindings: remoteproc: qcom,glink-rpm-edge: convert to DT schema Convert Qualcomm G-Link RPM edge binding to DT schema. Move it to remoteproc as it better suits the purpose - communication channel with remote processor. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230208101545.45711-6-krzysztof.kozlowski@linaro.org commit 6f998eb2fd02a7a7a529abb4c7d8bbf44fc3ff13 Author: Krzysztof Kozlowski Date: Mon Feb 6 20:33:13 2023 +0100 dt-bindings: remoteproc: qcom,sm8550-pas: correct power domains Correct CDSP and MPSS power domains to match what is used in DTS and the Linux driver: sm8550-mtp.dtb: remoteproc@32300000: power-domain-names: ['cx', 'mxc', 'nsp'] is too long Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Acked-by: Neil Armstrong Fixes: 084258d60712 ("dt-bindings: remoteproc: qcom: adsp: document sm8550 adsp, cdsp & mpss compatible") Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230206193313.30667-1-krzysztof.kozlowski@linaro.org commit a8086bd9723ac8f1f795ab64f1de7dd0b9be889a Author: Neil Armstrong Date: Mon Feb 6 14:53:31 2023 +0100 remoteproc: qcom_q6v5_pas: enable sm8550 adsp & cdsp autoboot Set the SM8550 adsp & cdsp auto_boot to true to match the behavior of the previous platforms. Fixes: 7eddedc97563 ("remoteproc: qcom_q6v5_pas: add sm8550 adsp, cdsp & mpss compatible & data") Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230206-topic-sm8550-upstream-fix-remoteproc-autoboot-v1-1-11445a0c27c6@linaro.org commit 838c558bb8bc3a9a4de840fd25c6ad0ebc4d1ed7 Author: Bhupesh Sharma Date: Sat Jan 28 11:05:04 2023 +0530 dt-bindings: remoteproc: qcom: Add sm6115 pas yaml file This documents the aDSP, cDSP and MPSS DSPs present on the SM6115 SoC. Signed-off-by: Bhupesh Sharma Reviewed-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230128053504.2099620-2-bhupesh.sharma@linaro.org commit 3c7306589dddbcc0ac53ec6b2c3a14875879e20c Author: Bhupesh Sharma Date: Sat Jan 28 11:05:03 2023 +0530 remoteproc: qcom: pas: Add sm6115 remoteprocs Among the subsystems in the Qualcomm sm6115 platform we find audio, compute and modem DSPs. Add support for controlling these using the peripheral authentication service (PAS) remoteproc driver. Signed-off-by: Bhupesh Sharma Reviewed-by: Mukesh Ojha Acked-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230128053504.2099620-1-bhupesh.sharma@linaro.org commit a376c10d45a8e6ee5ea55791193f90625b35e156 Author: Yogesh Lal Date: Wed Nov 2 22:42:09 2022 +0530 remoteproc: qcom: pas: Adjust the phys addr wrt the mem region The minidump table in the toc contains physical addresses that may lie before the physical address of the first elf segment in relocatable images. This change adds a custom dump function for minidumps which calculates the offset into the carveout region using the start of the physical address instead of the start of the first elf segment. Signed-off-by: Yogesh Lal Reviewed-by: Sibi Sankar Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1667409129-6254-1-git-send-email-quic_ylal@quicinc.com commit 28980db94742f9f2fb0f68ea35f2171b38007bae Author: Yazen Ghannam Date: Tue Feb 14 10:42:22 2023 +0100 EDAC/amd64: Shut up an -Werror,-Wsometimes-uninitialized clang false positive Reportedly, clang cannot do interprocedural analysis: https://lore.kernel.org/r/20230213-amd64_edac-wsometimes-uninitialized-v1-1-5bde32b89e02@kernel.org and see that those arguments won't be used uninitialized. So, yeah, the code's fine even without this. Normally, such a "fix" won't be applied but that warning gets automatically enabled in -Wall builds and when CONFIG_WERROR is set in allmodconfig builds, the build fails. So shut it up with a minimal fix as this code will see more reorganization very soon. [ bp: Write commit message. ] Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/Y%2BqdVHidnrrKvxiD@dev-arch.thelio-3990X commit 2554dd0ac362738f588ba073d8333eb9b14f9587 Author: Mukesh Ojha Date: Tue Jan 31 21:31:06 2023 +0530 remoteproc: qcom: fix sparse warnings This patch try to address below sparse warnings. drivers/remoteproc/qcom_common.c:126:27: warning: restricted __le32 degrades to integer drivers/remoteproc/qcom_common.c:133:32: warning: cast to restricted __le32 drivers/remoteproc/qcom_common.c:133:32: warning: cast from restricted __le64 Signed-off-by: Mukesh Ojha Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1675180866-16695-1-git-send-email-quic_mojha@quicinc.com commit 8a3d95ea42921a8021b2459e22f91b4f49495e57 Author: Arnd Bergmann Date: Tue Feb 14 14:18:47 2023 +0100 dax/hmem: build hmem device support as module if possible When device_hmem.o is enabled but dax itself is a loadable module, the dax_hmem support fails to link because Kbuild never compiles built-in code under drivers/dax: ERROR: modpost: "walk_hmem_resources" [drivers/dax/hmem/dax_hmem.ko] undefined! Make sure that drivers/dax is entered for compiling built-in code even with CONFIG_DAX=m. Fixes: 7dab174e2e27 ("dax/hmem: Move hmem device registration to dax_hmem.ko") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230214131913.1431969-1-arnd@kernel.org Signed-off-by: Dan Williams commit 0c16c83ed57fc66b033306ba426a5b324966a33e Author: Arnd Bergmann Date: Tue Feb 14 11:30:49 2023 +0100 dax: cxl: add CXL_REGION dependency There is already a dependency on CXL_REGION, which depends on CXL_BUS, but since CXL_REGION is a 'bool' symbol, it's possible to configure DAX as built-in even though CXL itself is a loadable module: x86_64-linux-ld: drivers/dax/cxl.o: in function `cxl_dax_region_probe': cxl.c:(.text+0xb): undefined reference to `to_cxl_dax_region' x86_64-linux-ld: drivers/dax/cxl.o: in function `cxl_dax_region_driver_init': cxl.c:(.init.text+0x10): undefined reference to `__cxl_driver_register' x86_64-linux-ld: drivers/dax/cxl.o: in function `cxl_dax_region_driver_exit': cxl.c:(.exit.text+0x9): undefined reference to `cxl_driver_unregister' Prevent this with another depndency on the tristate symbol. Fixes: 09d09e04d2fc ("cxl/dax: Create dax devices for CXL RAM regions") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230214103054.1082908-1-arnd@kernel.org Signed-off-by: Dan Williams commit 7abcb0b10668eaf3c174ff383f3b2a7a8c95fb34 Author: Arnd Bergmann Date: Mon Feb 13 11:12:11 2023 +0100 cxl: avoid returning uninitialized error code The new cxl_add_to_region() function returns an uninitialized value on success: drivers/cxl/core/region.c:2628:6: error: variable 'rc' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] if (IS_ERR(cxlr)) { ^~~~~~~~~~~~ drivers/cxl/core/region.c:2654:9: note: uninitialized use occurs here return rc; Simplify the logic to have the rc variable always initialized in the same place. Fixes: a32320b71f08 ("cxl/region: Add region autodiscovery") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230213101220.3821689-1-arnd@kernel.org Signed-off-by: Dan Williams commit 9d5b9ad97f83b2390a6006eeb5ae5e48ec4298ce Author: Mukesh Ojha Date: Tue Feb 14 19:38:11 2023 +0530 remoteproc: qcom: replace kstrdup with kstrndup Since, there is no guarantee that region.name will be 0-terminated from the firmware side, replace kstrdup with kstrndup. Suggested-by: Dmitry Baryshkov Signed-off-by: Mukesh Ojha Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/1676383691-29738-1-git-send-email-quic_mojha@quicinc.com commit fb23b97346f9aaa9f7b7a996e7baf066c88d69bd Author: Bjorn Andersson Date: Mon Feb 13 07:52:15 2023 -0800 rpmsg: glink: Cancel pending intent requests at removal During removal of the glink edge interrupts are disabled and no more incoming messages are being serviced. In addition to the remote endpoint being defunct that means that any outstanding requests for intents will not be serviced, and qcom_glink_request_intent() will blindly wait for up to 10 seconds. Mark the intent request as not granted and complete the intent request completion to fail the waiting client immediately. Once the current intent request is failed, any potential clients waiting for the intent request mutex will not enter the same wait, as the qcom_glink_tx() call will fail fast. Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213155215.1237059-7-quic_bjorande@quicinc.com commit 9c96bacf1af51bc71898f31e025f08338c6ca4da Author: Bjorn Andersson Date: Mon Feb 13 07:52:14 2023 -0800 rpmsg: glink: Fail qcom_glink_tx() once remove has been initiated Upon removing the glink edge, communication is at best one-way. This means that the very common scenario of glink requesting intents will not be possible to serve. Typically a successful transmission results in the client waiting for a response, with some timeout and a mechanism for aborting that timeout. Because of this, once the glink edge is defunct once removal is commenced it's better to fail transmissions fast. Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213155215.1237059-6-quic_bjorande@quicinc.com commit f424d1cbe8c7ef78a4b639502fa9904c4198387b Author: Bjorn Andersson Date: Mon Feb 13 07:52:13 2023 -0800 rpmsg: glink: Move irq and mbox handling to transports Not all GLINK transports uses an interrupt and a mailbox instance. The interrupt for RPM needs to be IRQF_NOSUSPEND, while it seems reasonable for the SMEM interrupt to use irq_set_wake. The glink struct device is constructed in the SMEM and RPM drivers but torn down in the core driver. Move the interrupt and kick handling into the SMEM and RPM driver, to improve this and facilitate further improvements. Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213155215.1237059-5-quic_bjorande@quicinc.com commit 178c3af447f92c58d5b1153df2cd02b755c083c8 Author: Bjorn Andersson Date: Mon Feb 13 07:52:12 2023 -0800 rpmsg: glink: rpm: Wrap driver context As with the SMEM driver update, wrap the RPM context in a struct to facilitate the upcoming changes of moving IRQ and mailbox registration to the driver. Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213155215.1237059-4-quic_bjorande@quicinc.com commit ab9fdd41d970c38ddc0fd59e5f8f37e8d966d454 Author: Bjorn Andersson Date: Mon Feb 13 07:52:11 2023 -0800 rpmsg: glink: smem: Wrap driver context The Glink SMEM driver allocates a struct device and hangs two devres-allocated pipe objects thereon. To facilitate the move of interrupt and mailbox handling to the driver, introduce a wrapper object capturing the device, glink reference and remote processor id. The type of the remoteproc reference is updated, as these are specifically targeting the SMEM implementation. Signed-off-by: Bjorn Andersson Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213155215.1237059-3-quic_bjorande@quicinc.com commit 8278fd3144779d883779d1f5bcbf49da36587fd1 Author: Bjorn Andersson Date: Mon Feb 13 07:52:10 2023 -0800 rpmsg: glink: Extract tx kick operation Refactor out the tx kick operations to its own function, in preparation for pushing the details to the individual transports. Reviewed-by: Chris Lew Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213155215.1237059-2-quic_bjorande@quicinc.com commit a527b0111798ed7b9f49830989eaabfe537e09ef Author: Thomas Weißschuh Date: Tue Feb 14 03:23:52 2023 +0000 ACPI: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Signed-off-by: Rafael J. Wysocki commit 3082d7efd76a55f74f263dc01f059f5b5221e8cc Author: Andy Shevchenko Date: Mon Feb 13 22:40:05 2023 +0200 Documentation: firmware-guide: gpio-properties: Clarify Explicit and Implicit Clarify the Explicit and Implicit meanings in the table of Pull Bias. While at it, distinguish pull bias keywords used in ACPI by using bold font in the table of the respective terms. Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 779aeb73d925586945b5dacab7453824766f149d Author: Greg Kroah-Hartman Date: Tue Feb 14 15:41:17 2023 +0100 driver core: class: move EXPORT_SYMBOL_GPL() lines to the correct place For some reason, the drivers/base/class.c file still had the "old style" of exports, at the end of the file. Move the exports to the proper location, right after the function, to be correct. Reviewed-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20230214144117.158956-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 99537067aca7e2826bffc514c241e3ce76dc22eb Merge: ceaa837f96adb eca4c0eea5343 Author: Rafael J. Wysocki Date: Tue Feb 14 15:27:41 2023 +0100 Merge tag 'opp-updates-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull OPP (Operating Performance Points) updates for 6.3 from Viresh Kumar: "- Add missing 'cache-unified' property in example for kryo OPP bindings (Rob Herring). - Fix error checking in opp_migrate_dentry() (Qi Zheng). - Remove "select SRCU" (Paul E. McKenney). - Let qcom,opp-fuse-level be a 2-long array for qcom SoCs (Konrad Dybcio)." * tag 'opp-updates-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: OPP: fix error checking in opp_migrate_dentry() dt-bindings: opp: v2-qcom-level: Let qcom,opp-fuse-level be a 2-long array drivers/opp: Remove "select SRCU" dt-bindings: opp: opp-v2-kryo-cpu: Add missing 'cache-unified' property in example commit f0f8e9e730b84dd9255343dc6b2cbd6ecc3a08e0 Merge: 3500e221d50da ba38f3cbe7db2 Author: Rafael J. Wysocki Date: Tue Feb 14 15:25:07 2023 +0100 Merge tag 'cpufreq-arm-updates-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull cpufreq ARM updates for 6.3 from Viresh Kumar: "- Enable thermal cooling for Tegra194 (Yi-Wei Wang). - Register module device table and add missing compatibles for cpufreq-qcom-hw (Nícolas F. R. A. Prado, Abel Vesa and Luca Weiss). - Various dt binding updates for qcom-cpufreq-nvmem and opp-v2-kryo-cpu (Christian Marangi)." * tag 'cpufreq-arm-updates-6.3' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: dt-bindings: opp: opp-v2-kryo-cpu: enlarge opp-supported-hw maximum dt-bindings: cpufreq: qcom-cpufreq-nvmem: make cpr bindings optional dt-bindings: cpufreq: qcom-cpufreq-nvmem: specify supported opp tables dt-bindings: cpufreq: cpufreq-qcom-hw: Add SM8550 compatible dt-bindings: cpufreq: cpufreq-qcom-hw: Add missing compatibles cpufreq: mediatek-hw: Register to module device table cpufreq: tegra194: Enable CPUFREQ thermal cooling commit 3500e221d50da5e56603bfde3be1c1f0fabfae23 Merge: 6f098cde9df2c e947925f10c25 Author: Rafael J. Wysocki Date: Tue Feb 14 15:22:31 2023 +0100 Merge back cpufreq material for 6.3-rc1. commit 8fcf2d012c8641c18adcd139dba6a1e556338d36 Author: Harshit Mogalapalli Date: Tue Feb 14 01:38:01 2023 -0800 ubi: block: Fix a possible use-after-free bug in ubiblock_create() Smatch warns: drivers/mtd/ubi/block.c:438 ubiblock_create() warn: '&dev->list' not removed from list 'dev' is freed in 'out_free_dev:, but it is still on the list. To fix this, delete the list item before freeing. Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING") Signed-off-by: Harshit Mogalapalli Reviewed-by: Christoph Hellwig Signed-off-by: Richard Weinberger commit 5791c7699ff1b8be24e1e3b2c08b180598d3ba28 Author: Stefan Binding Date: Mon Feb 13 14:50:08 2023 +0000 ALSA: hda: cs35l41: Enable Amp High Pass Filter This helps smooth out pops and clicks in the amps. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20230213145008.1215849-4-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit cd40dad2ca9196631dcd48e1b991244ab3940d83 Author: Stefan Binding Date: Mon Feb 13 14:50:07 2023 +0000 ALSA: hda: cs35l41: Ensure firmware/tuning pairs are always loaded To ensure firmware for cs35l41 is correctly running, it is necessary that a corresponding tuning file is also loaded. Without both, the firmware may not be performing correctly Ensure that if we load the firmware, we have also loaded the correct tuning file. Otherwise, fall back to default firmware and tuning. If default tuning is also missing, then disable DSP firmware. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20230213145008.1215849-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 943f4e64ee177cf44d7f2c235281fcda7c32bb28 Author: Vitaly Rodionov Date: Mon Feb 13 14:50:06 2023 +0000 ALSA: hda: cs35l41: Correct error condition handling Function cs_dsp_coeff_write_ctrl() can return 3 possible values: 0 - no change, 1 - value has changed and -1 - error, so positive value is not an error. Fixes: 7406bdbc4fb8 ("ASoC: wm_adsp: Return whether changed when writing controls") Signed-off-by: Vitaly Rodionov Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20230213145008.1215849-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 4315eab7054d15db50265ab249b7f87912b49902 Merge: 4ca651df07183 bc30c15f27548 Author: Vinod Koul Date: Tue Feb 14 19:25:45 2023 +0530 Merge tag 'phy-fixes-6.2' into next Merge fixes tag pulled into mainline by Linus into phy/next due to dependency on amlogic patches commit 4ca651df07183e29cdad7272255e23aec0169a1b Author: Neill Kapron Date: Thu Jan 26 00:10:12 2023 +0000 phy: rockchip-typec: fix tcphy_get_mode error case The existing logic in tcphy_get_mode() can cause the phy to be incorrectly configured to USB UFP or DisplayPort mode when extcon_get_state returns an error code. extcon_get_state() can return 0, 1, or a negative error code. It is possible to get into the failing state with an extcon driver which does not support the extcon connector id specified as the second argument to extcon_get_state(). tcphy_get_mode() ->extcon_get_state() -->find_cable_index_by_id() --->return -EINVAL; Fixes: e96be45cb84e ("phy: Add USB Type-C PHY driver for rk3399") Signed-off-by: Neill Kapron Reviewed-by: Lee Jones Link: https://lore.kernel.org/r/20230126001013.3707873-1-nkapron@google.com Signed-off-by: Vinod Koul commit e6f5dcb7ec9badd9500f64b087f7243c37300d63 Author: Gilad Itzkovitch Date: Thu Nov 24 13:53:36 2022 +1300 wifi: mac80211: Fix for Rx fragmented action frames The ieee80211_accept_frame() function performs a number of early checks to decide whether or not further processing needs to be done on a frame. One of those checks is the ieee80211_is_robust_mgmt_frame() function. It requires to peek into the frame payload, but because defragmentation does not occur until later on in the receive path, this peek is invalid for any fragment other than the first one. Also, in this scenario there is no STA and so the fragmented frame will be dropped later on in the process and will not reach the upper stack. This can happen with large action frames at low rates, for example, we see issues with DPP on S1G. This change will only check if the frame is robust if it's the first fragment. Invalid fragmented packets will be discarded later after defragmentation is completed. Signed-off-by: Gilad Itzkovitch Link: https://lore.kernel.org/r/20221124005336.1618411-1-gilad.itzkovitch@morsemicro.com Signed-off-by: Johannes Berg commit 1d8d4af4347420d657be448f8be4c39c558f3b5d Author: Arnd Bergmann Date: Tue Feb 14 14:20:21 2023 +0100 wifi: mac80211: avoid u32_encode_bits() warning gcc-9 triggers a false-postive warning in ieee80211_mlo_multicast_tx() for u32_encode_bits(ffs(links) - 1, ...), since ffs() can return zero on an empty bitmask, and the negative argument to u32_encode_bits() is then out of range: In file included from include/linux/ieee80211.h:21, from include/net/cfg80211.h:23, from net/mac80211/tx.c:23: In function 'u32_encode_bits', inlined from 'ieee80211_mlo_multicast_tx' at net/mac80211/tx.c:4437:17, inlined from 'ieee80211_subif_start_xmit' at net/mac80211/tx.c:4485:3: include/linux/bitfield.h:177:3: error: call to '__field_overflow' declared with attribute error: value doesn't fit into mask 177 | __field_overflow(); \ | ^~~~~~~~~~~~~~~~~~ include/linux/bitfield.h:197:2: note: in expansion of macro '____MAKE_OP' 197 | ____MAKE_OP(u##size,u##size,,) | ^~~~~~~~~~~ include/linux/bitfield.h:200:1: note: in expansion of macro '__MAKE_OP' 200 | __MAKE_OP(32) | ^~~~~~~~~ Newer compiler versions do not cause problems with the zero argument because they do not consider this a __builtin_constant_p(). It's also harmless since the hweight16() check already guarantees that this cannot be 0. Replace the ffs() with an equivalent find_first_bit() check that matches the later for_each_set_bit() style and avoids the warning. Fixes: 963d0e8d08d9 ("wifi: mac80211: optionally implement MLO multicast TX") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230214132025.1532147-1-arnd@kernel.org Signed-off-by: Johannes Berg commit 5ec63fdbca604568890c577753c6f66c5b3ef0b5 Author: Prashanth K Date: Mon Feb 13 23:00:38 2023 +0530 usb: gadget: u_serial: Add null pointer check in gserial_resume Consider a case where gserial_disconnect has already cleared gser->ioport. And if a wakeup interrupt triggers afterwards, gserial_resume gets called, which will lead to accessing of gser->ioport and thus causing null pointer dereference.Add a null pointer check to prevent this. Added a static spinlock to prevent gser->ioport from becoming null after the newly added check. Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") Cc: stable Signed-off-by: Prashanth K Acked-by: Alan Stern Link: https://lore.kernel.org/r/1676309438-14922-1-git-send-email-quic_prashk@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 7ebb605d2283fb2647b4fa82030307ce00bee436 Author: Yang Yingliang Date: Mon Feb 13 15:09:26 2023 +0800 usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails If kstrtou8() fails, the mutex_unlock() is missed, move kstrtou8() before mutex_lock() to fix it up. Fixes: 0525210c9840 ("usb: gadget: uvc: Allow definition of XUs in configfs") Fixes: b3c839bd8a07 ("usb: gadget: uvc: Make bSourceID read/write") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20230213070926.776447-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit 7ec844a2c7535e4c4991e7e453baca85e156f7c1 Author: Alain Volmat Date: Mon Feb 13 20:23:48 2023 +0100 spi: spi-st-ssc: convert to DT schema Convert spi-st-ssc.txt into st,ssc-spi.yaml for the ST Microelectronics SSC SPI driver. Signed-off-by: Alain Volmat Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230213192349.17101-1-avolmat@me.com Signed-off-by: Mark Brown commit 9d77522b45246c3dc5950b9641aea49ce3c973d7 Author: Christophe JAILLET Date: Tue Feb 14 11:34:50 2023 +0100 spi: Reorder fields in 'struct spi_transfer' Group some variables based on their sizes to reduce hole and avoid padding. On x86_64, this shrinks the size from 144 to 128 bytes. Turn 'timestamped' into a bitfield so that it can be easily merged with some other bifields and move 'error'. This should have no real impact on memory allocation because 'struct spi_transfer' is mostly used on stack, but it can save a few cycles when the structure is initialized or copied. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/93a051da85a895bc6003aedfb00a13e1c2fc6338.1676370870.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit d403fb6e76bf854ef0f7d84e797e51b9494788e0 Author: Dhruva Gole Date: Wed Jan 25 13:40:23 2023 +0530 spi: cadence-quadspi: use STIG mode for small reads Fix the issue where some flash chips like cypress S25HS256T return the value of the same register over and over in DAC mode. For example in the TI K3-AM62x Processors refer [0] Technical Reference Manual there is a layer of digital logic in front of the QSPI/OSPI Drive when used in DAC mode. This is part of the Flash Subsystem (FSS) which provides access to external Flash devices. The FSS0_0_SYSCONFIG Register (Offset = 4h) has a BIT Field for OSPI_32B_DISABLE_MODE which has a Reset value = 0. This means, OSPI 32bit mode enabled by default. Thus, by default controller operates in 32 bit mode causing it to always align all data to 4 bytes from a 4byte aligned address. In some flash chips like cypress for example if we try to read some regs in DAC mode then it keeps sending the value of the first register that was requested and inorder to read the next reg, we have to stop and re-initiate a new transaction. This causes wrong register values to be read than what is desired when registers are read in DAC mode. Hence if the data.nbytes is very less then prefer STIG mode for such small reads. [0] https://www.ti.com/lit/ug/spruiv7a/spruiv7a.pdf Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230125081023.1573712-5-d-gole@ti.com Signed-off-by: Mark Brown commit a8674ae02db232927385c2d0a063e10c0118f5ca Author: Dhruva Gole Date: Wed Jan 25 13:40:22 2023 +0530 spi: cadence-quadspi: setup ADDR Bits in cmd reads Setup the Addr bit field while issuing register reads in STIG mode. This is needed for example flashes like cypress define in their transaction table that to read any register there is 1 cmd byte and a few more address bytes trailing the cmd byte. Absence of addr bytes will obviously fail to read correct data from flash register that maybe requested by flash driver because the controller doesn't even specify which address of the flash register the read is being requested from. Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230125081023.1573712-4-d-gole@ti.com Signed-off-by: Mark Brown commit e8c51b164355c1d519a4b8ad0873f131035d26b7 Author: Dhruva Gole Date: Wed Jan 25 13:40:21 2023 +0530 spi: cadence-quadspi: Add flag for direct mode writes Create new flag inorder to avoid playing with use_direct_mode flag currently being used throughout the driver. Disable DAC write if auto polling is disabled or CQSPI_DISABLE_DAC_MODE is set. Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230125081023.1573712-3-d-gole@ti.com Signed-off-by: Mark Brown commit d4f43a2d05faf7febb839edb2e9e8f85dfb9d2d2 Author: Dhruva Gole Date: Wed Jan 25 13:40:20 2023 +0530 spi: cadence-quadspi: Reset CMD_CTRL Reg on cmd r/w completion If one leaves the CQSPI_REG_CMDCTRL in an unclean state this may cause issues in future command reads. This issue came to light when some flash reads in STIG mode were coming back dirty. Signed-off-by: Dhruva Gole Link: https://lore.kernel.org/r/20230125081023.1573712-2-d-gole@ti.com Signed-off-by: Mark Brown commit 7464145862d606cf9835f24080341a397cbc0669 Author: Christophe JAILLET Date: Tue Feb 14 09:40:14 2023 +0100 regmap: Reorder fields in 'struct regmap_bus' to save some memory Group some bool variables to reduce hole and avoid padding. On x86_64, this shrinks the size from 136 to 128 bytes. As an example: $ size drivers/base/regmap/regmap-fsi.o (Before) text data bss dec hex filename 4837 136 0 4973 136d drivers/base/regmap/regmap-fsi.o $ size drivers/base/regmap/regmap-fsi.o (After) text data bss dec hex filename 4701 136 0 4837 12e5 drivers/base/regmap/regmap-fsi.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/077ca39622c8870a3ea932298a9cec34f7a8295a.1676363976.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit ec285cb999c145f70631f13a284b4696102d06ef Author: Deepak R Varma Date: Mon Feb 13 23:10:46 2023 +0530 ASoC: codecs: wcd934x: Use min macro for comparison and assignment Simplify code by using min helper macro for logical evaluation and value assignment. The change also facilitates code realignment for improved readability. Proposed change is identified using minmax.cocci Coccinelle script. Signed-off-by: Deepak R Varma Link: https://lore.kernel.org/r/Y+p2Hn0nrtHiKwPR@ubun2204.myguest.virtualbox.org Signed-off-by: Mark Brown commit 1fd61d018aefc9bf366fd73eddc868163f2ed7da Author: Amadeusz Sławiński Date: Mon Feb 13 21:52:23 2023 +0100 ASoC: Intel: Skylake: Fix struct definition The kernel is globally removing the ambiguous 0-length and 1-element arrays in favor of flexible arrays, so that we can gain both compile-time and run-time array bounds checking[1]. In this instance, struct skl_cpr_cfg contains struct skl_cpr_gtw_cfg, which defined "config_data" as a 1-element array. However, case present in sound/soc/intel/skylake/skl-topology.h is not a simple one as the structure takes part in IPC communication. Apparently original definition missed one field, which while not used by AudioDSP firmware when there is no additional data, is still expected to be part of an IPC message. Currently this works because of how 'config_data' is declared: 'config_data[1]'. Now when one replaces it with a flexible array there would be one field missing. Update struct declaration to fix this. Reported-by: Sasa Ostrouska Link: https://lore.kernel.org/all/CALFERdwvq5day_sbDfiUsMSZCQu9HG8-SBpOZDNPeMdZGog6XA@mail.gmail.com/ Cc: Pierre-Louis Bossart Cc: Liam Girdwood Cc: Peter Ujfalusi Cc: Bard Liao Cc: Ranjani Sridharan Cc: Kai Vehmanen Cc: Mark Brown Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: "Gustavo A. R. Silva" Cc: alsa-devel@alsa-project.org CC: Kees Cook Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Link: https://lore.kernel.org/r/20230213205223.2679357-1-amadeuszx.slawinski@linux.intel.com Signed-off-by: Mark Brown commit 7af4222832a10c2726a93c2600652090ae06ecb9 Author: Steffen Aschbacher Date: Tue Feb 14 11:10:51 2023 +0200 ASoC: tlv320adcx140: extend list of supported samplerates The 'tlv320adcx140' driver currently supports 3 devices: TLV320ADC3140, TLV320ADC5140 and TLV320ADC6140. All 3 devices, support higher samplerates, up to 768-kHz according to their datasheets. In our applications, we only tested (and worked) with 96 kHz and 192 kHz. This change extends the list of supported sample-rates for these devices with 96 & 192 kHz. References: https://www.ti.com/product/TLV320ADC3140 https://www.ti.com/product/TLV320ADC5140 https://www.ti.com/product/TLV320ADC6140 Signed-off-by: Steffen Aschbacher Signed-off-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20230214091051.16323-1-alex@shruggie.ro Signed-off-by: Mark Brown commit 88541443497d47313ec4de1ecc1946288ae0ed16 Author: Deepak R Varma Date: Mon Feb 13 23:43:03 2023 +0530 ASoC: imx-pcm-rpmsg: Remove unused variable Variable ret is initialed but is never modified or used except for returning the initial value 0. The value can be directly returned instead and the variable definition can be dropped. Issue identified using returnvar.cocci Coccinelle semantic patch. Signed-off-by: Deepak R Varma Link: https://lore.kernel.org/r/Y+p9r5y9DPSJkPVf@ubun2204.myguest.virtualbox.org Signed-off-by: Mark Brown commit f7d00a9be147d9c6feeb19591b39f8102f70cc45 Author: Matthias Kaehlcke Date: Thu Feb 9 01:20:23 2023 +0000 SoC: rt5682s: Disable jack detection interrupt during suspend The rt5682s driver switches its regmap to cache-only when the device suspends and back to regular mode on resume. When the jack detect interrupt fires rt5682s_irq() schedules the jack detect work. This can result in invalid reads from the regmap in cache-only mode if the work runs before the device has resumed: [ 19.672162] rt5682s 2-001a: ASoC: error at soc_component_read_no_lock on rt5682s.2-001a for register: [0x000000f0] -16 Disable the jack detection interrupt during suspend and re-enable it on resume. The driver already schedules the jack detection work on resume, so any state change during suspend is still handled. Signed-off-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20230209012002.1.Ib4d6481f1d38a6e7b8c9e04913c02ca88c216cf6@changeid Signed-off-by: Mark Brown commit 6611b975eb87d7793e4632575649308762e7d01e Author: Rander Wang Date: Tue Feb 14 12:33:45 2023 +0200 ASoC: SOF: Intel: hda-dsp: Set streaming flag for d0i3 Enable d0i3 streaming if all the active streams can work in d0i3 state and playback is enabled. Signed-off-by: Rander Wang Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230214103345.30669-6-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3e6b6ed34bda047a818003a8c06d368eb3596bba Author: Rander Wang Date: Tue Feb 14 12:33:44 2023 +0200 ASoC: SOF: Intel: Enable d0i3 work for ipc4 Schedule a delayed work for d0i3 entry after every non-pm ipc msg. Signed-off-by: Rander Wang Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230214103345.30669-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 1c91e927e55cef17bafd8903cb34a7d12968ae6d Author: Rander Wang Date: Tue Feb 14 12:33:43 2023 +0200 ASoC: SOF: ipc4: Wake up dsp core before sending ipc msg The driver shall update the power state to D0i0 before sending a generic IPC. Power-related IPCs are the exception to the rule, they may be sent even when the power-state is D0i3 Signed-off-by: Rander Wang Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230214103345.30669-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3c168838fb0d64dd64f7d65cdbd7d127ce6112ef Author: Rander Wang Date: Tue Feb 14 12:33:42 2023 +0200 ASoC: SOF: Intel: hda-dsp: use set_pm_gate according to ipc version Use set_pm_gate to unify pm gate setting for different ipc version. Signed-off-by: Rander Wang Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230214103345.30669-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 167ca6a4fd87726e044df2db38fe86f6cb0fb907 Author: Rander Wang Date: Tue Feb 14 12:33:41 2023 +0200 ASoC: SOF: Introduce a new set_pm_gate() IPC PM op Set_pm_gate depends on ipc version. This patch defines the ops for both IPC3 and IPC4. Signed-off-by: Rander Wang Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230214103345.30669-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 77191db5ba7bd321fbbf4315675ee774a2b5a362 Author: Dan Carpenter Date: Thu Feb 9 16:43:45 2023 +0300 xhci: host: potential NULL dereference in xhci_generic_plat_probe() It's possible to exit the loop with "sysdev" set to NULL. In that case we should use "&pdev->dev". Fixes: ec5499d338ec ("xhci: split out rcar/rz support from xhci-plat.c") Signed-off-by: Dan Carpenter Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/Y+T4kTcJwRwxNHJq@kili Signed-off-by: Greg Kroah-Hartman commit 2edd92570441dd33246210042dc167319a5cf7e3 Author: Jiri Pirko Date: Mon Feb 13 12:58:36 2023 +0100 devlink: don't allow to change net namespace for FW_ACTIVATE reload action The change on network namespace only makes sense during re-init reload action. For FW activation it is not applicable. So check if user passed an ATTR indicating network namespace change request and forbid it. Signed-off-by: Jiri Pirko Acked-by: Jakub Kicinski Link: https://lore.kernel.org/r/20230213115836.3404039-1-jiri@resnulli.us Signed-off-by: Paolo Abeni commit dca5161f9bd052e9e73be90716ffd57e8762c697 Author: Michael Kelley Date: Sun Feb 12 21:08:01 2023 -0800 hv_netvsc: Check status in SEND_RNDIS_PKT completion message Completion responses to SEND_RNDIS_PKT messages are currently processed regardless of the status in the response, so that resources associated with the request are freed. While this is appropriate, code bugs that cause sending a malformed message, or errors on the Hyper-V host, go undetected. Fix this by checking the status and outputting a rate-limited message if there is an error. Signed-off-by: Michael Kelley Reviewed-by: Haiyang Zhang Link: https://lore.kernel.org/r/1676264881-48928-1-git-send-email-mikelley@microsoft.com Signed-off-by: Paolo Abeni commit c4a07e264d38d5cad5d77298957cbd7d7db70b1f Merge: f87b564686ee4 ceaa837f96adb Author: Greg Kroah-Hartman Date: Tue Feb 14 13:44:08 2023 +0100 Merge 6.2-rc8 into usb-next We need the USB fixes in here for testing. Signed-off-by: Greg Kroah-Hartman commit daf8fb4295dccc032515cdc1bd3873370063542b Author: Andrei Otcheretianski Date: Tue Feb 14 12:10:48 2023 +0200 wifi: mac80211: Don't translate MLD addresses for multicast MLD address translation should be done only for individually addressed frames. Otherwise, AAD calculation would be wrong and the decryption would fail. Fixes: e66b7920aa5ac ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Signed-off-by: Andrei Otcheretianski Link: https://lore.kernel.org/r/20230214101048.792414-1-andrei.otcheretianski@intel.com Signed-off-by: Johannes Berg commit d99975c4953eb79e389d4630e848435c700e2dfc Author: Wen Gong Date: Wed Feb 1 01:53:13 2023 -0500 wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint Currently the regulatory driver does not call the regulatory callback reg_notifier for self managed wiphys. Sometimes driver needs cfg80211 to calculate the info of ieee80211_channel such as flags and power, and driver needs to get the info of ieee80211_channel after hint of driver, but driver does not know when calculation of the info of ieee80211_channel become finished, so add notify to driver in reg_process_self_managed_hint() from cfg80211 is a good way, then driver could get the correct info in callback of reg_notifier. Signed-off-by: Wen Gong Link: https://lore.kernel.org/r/20230201065313.27203-1-quic_wgong@quicinc.com Signed-off-by: Johannes Berg commit 935ef47b16cc5bc15fcd2b3dbc61abb0b7ea671a Author: Lorenzo Bianconi Date: Wed Feb 1 13:48:30 2023 +0100 wifi: cfg80211: get rid of gfp in cfg80211_bss_color_notify Since cfg80211_bss_color_notify() is now always run in non-atomic context, get rid of gfp_t flags in the routine signature and always use GFP_KERNEL for netlink message allocation. Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/c687724e7b53556f7a2d9cbe3d11cdcf065cb687.1675255390.git.lorenzo@kernel.org Signed-off-by: Johannes Berg commit 9b89495e479c5fedbf3f2eca4f1c4e9dd481265e Author: Vinay Gannevaram Date: Sat Feb 4 19:29:39 2023 +0530 wifi: nl80211: Allow authentication frames and set keys on NAN interface Wi-Fi Aware R4 specification defines NAN Pairing which uses PASN handshake to authenticate the peer and generate keys. Hence allow to register and transmit the PASN authentication frames on NAN interface and set the keys to driver or underlying modules on NAN interface. The driver needs to configure the feature flag NL80211_EXT_FEATURE_SECURE_NAN, which also helps userspace modules to know if the driver supports secure NAN. Signed-off-by: Vinay Gannevaram Link: https://lore.kernel.org/r/1675519179-24174-1-git-send-email-quic_vganneva@quicinc.com Signed-off-by: Johannes Berg commit aaacf1740f2f95e0c5449ff3bbcff252d69cf952 Author: Karthikeyan Periyasamy Date: Mon Feb 6 21:33:30 2023 +0530 wifi: mac80211: fix non-MLO station association Non-MLO station frames are dropped in Rx path due to the condition check in ieee80211_rx_is_valid_sta_link_id(). In multi-link AP scenario, non-MLO stations try to connect in any of the valid links in the ML AP, where the station valid_links and link_id params are valid in the ieee80211_sta object. But ieee80211_rx_is_valid_sta_link_id() always return false for the non-MLO stations by the assumption taken is valid_links and link_id are not valid in non-MLO stations object (ieee80211_sta), this assumption is wrong. Due to this assumption, non-MLO station frames are dropped which leads to failure in association. Fix it by removing the condition check and allow the link validation check for the non-MLO stations. Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta") Signed-off-by: Karthikeyan Periyasamy Link: https://lore.kernel.org/r/20230206160330.1613-1-quic_periyasa@quicinc.com Signed-off-by: Johannes Berg commit 57b341e9ab13e5688491bfd54f8b5502416c8905 Author: Rameshkumar Sundaram Date: Tue Feb 7 17:11:46 2023 +0530 wifi: mac80211: Allow NSS change only up to capability Stations can update bandwidth/NSS change in VHT action frame with action type Operating Mode Notification. (IEEE Std 802.11-2020 - 9.4.1.53 Operating Mode field) For Operating Mode Notification, an RX NSS change to a value greater than AP's maximum NSS should not be allowed. During fuzz testing, by forcefully sending VHT Op. mode notif. frames from STA with random rx_nss values, it is found that AP accepts rx_nss values greater that APs maximum NSS instead of discarding such NSS change. Hence allow NSS change only up to maximum NSS that is negotiated and capped to AP's capability during association. Signed-off-by: Rameshkumar Sundaram Link: https://lore.kernel.org/r/20230207114146.10567-1-quic_ramess@quicinc.com Signed-off-by: Johannes Berg commit 6e4c0d0460bd32ca9244dff3ba2d2da27235de11 Author: Felix Fietkau Date: Mon Feb 13 11:08:55 2023 +0100 wifi: mac80211: add a workaround for receiving non-standard mesh A-MSDU At least ath10k and ath11k supported hardware (maybe more) does not implement mesh A-MSDU aggregation in a standard compliant way. 802.11-2020 9.3.2.2.2 declares that the Mesh Control field is part of the A-MSDU header (and little-endian). As such, its length must not be included in the subframe length field. Hardware affected by this bug treats the mesh control field as part of the MSDU data and sets the length accordingly. In order to avoid packet loss, keep track of which stations are affected by this and take it into account when converting A-MSDU to 802.3 + mesh control packets. Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230213100855.34315-5-nbd@nbd.name Signed-off-by: Johannes Berg commit 986e43b19ae9176093da35e0a844e65c8bf9ede7 Author: Felix Fietkau Date: Mon Feb 13 11:08:54 2023 +0100 wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets on mesh interfaces, because it assumes that the Mesh Control field is always directly after the 802.11 header. 802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is actually part of the A-MSDU subframe header. This makes more sense, since it allows packets for multiple different destinations to be included in the same A-MSDU, as long as RA and TID are still the same. Another issue is the fact that the A-MSDU subframe length field was apparently accidentally defined as little-endian in the standard. In order to fix this, the mesh forwarding path needs happen at a different point in the receive path. ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field and leave it in after the ethernet header. This also affects the source/dest MAC address fields, which now in the case of mesh point to the mesh SA/DA. ieee80211_amsdu_to_8023s is changed to deal with the endian difference and to add the Mesh Control length to the subframe length, since it's not covered by the MSDU length field. With these changes, the mac80211 will get the same packet structure for converted regular data packets and unpacked A-MSDU subframes. The mesh forwarding checks are now only performed after the A-MSDU decap. For locally received packets, the Mesh Control header is stripped away. For forwarded packets, a new 802.11 header gets added. Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230213100855.34315-4-nbd@nbd.name [fix fortify build error] Signed-off-by: Johannes Berg commit cfd4ea4815d16f7426723a5cb80ee5db811ea1f2 Author: Liming Sun Date: Thu Feb 2 10:29:15 2023 -0500 mmc: sdhci-of-dwcmshc: add the missing device table IDs for acpi This commit adds the missing MODULE_DEVICE_TABLE for acpi, or else it won't be loaded automatically when compiled as a kernel module. Reviewed-by: David Thompson Signed-off-by: Liming Sun Link: https://lore.kernel.org/r/f57ad0f8fdf663465bca74467c344dfa305a3199.1675305696.git.limings@nvidia.com Signed-off-by: Ulf Hansson commit 5c1e269aa5ebafeec69b68ff560522faa5bcb6c1 Author: Felix Fietkau Date: Mon Feb 13 11:08:53 2023 +0100 wifi: mac80211: remove mesh forwarding congestion check Now that all drivers use iTXQ, it does not make sense to check to drop tx forwarding packets when the driver has stopped the queues. fq_codel will take care of dropping packets when the queues fill up Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230213100855.34315-3-nbd@nbd.name Signed-off-by: Johannes Berg commit 9f718554e7eacea62d3f972cae24d969755bf3b6 Author: Felix Fietkau Date: Mon Feb 13 11:08:52 2023 +0100 wifi: cfg80211: factor out bridge tunnel / RFC1042 header check The same check is done in multiple places, unify it. Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230213100855.34315-2-nbd@nbd.name Signed-off-by: Johannes Berg commit 0f690e6b4dcd7243e2805a76981b252c2d4bdce6 Author: Felix Fietkau Date: Mon Feb 13 11:08:51 2023 +0100 wifi: cfg80211: move A-MSDU check in ieee80211_data_to_8023_exthdr When parsing the outer A-MSDU header, don't check for inner bridge tunnel or RFC1042 headers. This is handled by ieee80211_amsdu_to_8023s already. Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230213100855.34315-1-nbd@nbd.name Signed-off-by: Johannes Berg commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 Author: Shayne Chen Date: Thu Feb 9 19:06:59 2023 +0800 wifi: mac80211: make rate u32 in sta_set_rate_info_rx() The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to u16 after being assigned to rate variable, which causes information loss in STA_STATS_FIELD_TYPE and later bitfields. Signed-off-by: Shayne Chen Link: https://lore.kernel.org/r/20230209110659.25447-1-shayne.chen@mediatek.com Fixes: 41cbb0f5a295 ("mac80211: add support for HE") Signed-off-by: Johannes Berg commit 796703baead0c2862f7f2ebb9b177590af533035 Author: Bo Liu Date: Mon Feb 6 03:16:41 2023 -0500 rfkill: Use sysfs_emit() to instead of sprintf() Follow the advice of the Documentation/filesystems/sysfs.rst and show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: Bo Liu Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230206081641.3193-1-liubo03@inspur.com Signed-off-by: Johannes Berg commit 19085ef39fa3dd27fa76d1c86dd448403101dcf7 Author: Rameshkumar Sundaram Date: Wed Feb 1 11:46:02 2023 +0530 wifi: cfg80211: Allow action frames to be transmitted with link BSS in MLD Currently action frames TX only with ML address as A3(BSSID) are allowed in an ML AP, but TX for a non-ML Station can happen in any link of an ML BSS with link BSS address as A3. In case of an MLD, if User-space has provided a valid link_id in action frame TX request, allow transmission of the frame in that link. Signed-off-by: Rameshkumar Sundaram Link: https://lore.kernel.org/r/20230201061602.3918-1-quic_ramess@quicinc.com Signed-off-by: Johannes Berg commit 2cc25e4b2a04cdd90dbb2916678745565cc4aeed Author: Aloka Dixit Date: Mon Jan 30 16:12:27 2023 -0800 wifi: mac80211: configure puncturing bitmap - Configure the bitmap in link_conf and notify the driver. - Modify 'change' in ieee80211_start_ap() from u32 to u64 to support BSS_CHANGED_EHT_PUNCTURING. - Propagate the bitmap in channel switch events to userspace. Signed-off-by: Aloka Dixit Signed-off-by: Muna Sinada Link: https://lore.kernel.org/r/20230131001227.25014-5-quic_alokad@quicinc.com Signed-off-by: Johannes Berg commit b345f0637c0042f9e6b78378a32256d90f485774 Author: Aloka Dixit Date: Mon Jan 30 16:12:26 2023 -0800 wifi: cfg80211: include puncturing bitmap in channel switch events Add puncturing bitmap in channel switch notifications and corresponding trace functions. Signed-off-by: Aloka Dixit Link: https://lore.kernel.org/r/20230131001227.25014-4-quic_alokad@quicinc.com [fix qtnfmac] Signed-off-by: Johannes Berg commit d7c1a9a0ed180d8884798ce97afe7283622a484f Author: Aloka Dixit Date: Mon Jan 30 16:12:25 2023 -0800 wifi: nl80211: validate and configure puncturing bitmap - New feature flag, NL80211_EXT_FEATURE_PUNCT, to advertise driver support for preamble puncturing in AP mode. - New attribute, NL80211_ATTR_PUNCT_BITMAP, to receive a puncturing bitmap from the userspace during AP bring up (NL80211_CMD_START_AP) and channel switch (NL80211_CMD_CHANNEL_SWITCH) operations. Each bit corresponds to a 20 MHz channel in the operating bandwidth, lowest bit for the lowest channel. Bit set to 1 indicates that the channel is punctured. Higher 16 bits are reserved. - New members added to structures cfg80211_ap_settings and cfg80211_csa_settings to propagate the bitmap to the driver after validation. Signed-off-by: Aloka Dixit Signed-off-by: Muna Sinada Link: https://lore.kernel.org/r/20230131001227.25014-3-quic_alokad@quicinc.com [move validation against 0xffff into policy] Signed-off-by: Johannes Berg commit b25413fed3d43e1ed3340df4d928971bb8639f66 Author: Aloka Dixit Date: Mon Jan 30 16:12:24 2023 -0800 wifi: cfg80211: move puncturing bitmap validation from mac80211 - Move ieee80211_valid_disable_subchannel_bitmap() from mlme.c to chan.c, rename it as cfg80211_valid_disable_subchannel_bitmap() and export it. - Modify the prototype to include struct cfg80211_chan_def instead of only bandwidth to support a check which returns false if the primary channel is punctured. Signed-off-by: Aloka Dixit Link: https://lore.kernel.org/r/20230131001227.25014-2-quic_alokad@quicinc.com Signed-off-by: Johannes Berg commit 90b2c3cc4b718d7e5591e812313dd72677d9fad0 Author: Jaewan Kim Date: Mon Jan 30 07:45:14 2023 +0000 wifi: nl80211: return error message for malformed chandef Add an error message to the missing frequency case to have all -EINVAL in nl80211_parse_chandef() return a better error. Signed-off-by: Jaewan Kim Link: https://lore.kernel.org/r/20230130074514.1560021-1-jaewan@google.com [rewrite commit message] Signed-off-by: Johannes Berg commit 08b74776a8acb02b7cabb77fc1ccbd93e147edfa Author: Jaewan Kim Date: Mon Jan 30 02:22:52 2023 +0000 wifi: mac80211_hwsim: Rename pid to portid to avoid confusion It is a frequent mistake to confuse the netlink port identifier with a process identifier. Try to reduce this confusion by renaming that hold port identifiers portid instead of pid. This change replicates following commit: commit 15e473046cb6 ("netlink: Rename pid to portid to avoid confusion") Signed-off-by: Jaewan Kim Link: https://lore.kernel.org/r/20230130022252.1514647-1-jaewan@google.com Signed-off-by: Johannes Berg commit cba7217a9269e0c43cb858bdca33b291d6442068 Author: Alvin Šipraga Date: Sat Jan 28 13:58:44 2023 +0100 wifi: nl80211: add MLO_LINK_ID to CMD_STOP_AP event nl80211_send_ap_stopped() can be called multiple times on the same netdev for each link when using Multi-Link Operation. Add the MLO_LINK_ID attribute to the event to allow userspace to distinguish which link the event is for. Signed-off-by: Alvin Šipraga Link: https://lore.kernel.org/r/20230128125844.2407135-2-alvin@pqrs.dk Signed-off-by: Johannes Berg commit 77669c151f1de6de2eaa28d7efdf387d39208309 Author: Alvin Šipraga Date: Sat Jan 28 13:58:43 2023 +0100 wifi: nl80211: emit CMD_START_AP on multicast group when an AP is started Userspace processes such as network daemons may wish to be informed when any AP interface is brought up on the system, for example to initiate a (re)configuration of IP settings or to start a DHCP server. Currently nl80211 does not broadcast any such event on its multicast groups, leaving userspace only two options: 1. the process must be the one that actually issued the NL80211_CMD_START_AP request, so that it can react on the response to that request; 2. the process must react to RTM_NEWLINK events indicating a change in carrier state, and may query for further information about the AP and react accordingly. Option (1) is robust, but it does not cover all scenarios. It is easy to imagine a situation where this is not the case (e.g. hostapd + systemd-networkd). Option (2) is not robust, because RTM_NEWLINK events may be silently discarded by the linkwatch logic (cf. linkwatch_fire_event()). Concretely, consider a scenario in which the carrier state flip-flops in the following way: ^ carrier state (high/low = carrier/no carrier) | | _______ _______ ... | | | | | ______| "foo" |____| "bar" (SSID in "quotes") | +-------A-------B----C---------> time If the time interval between (A) and (C) is less than 1 second, then linkwatch may emit only a single RTM_NEWLINK event indicating carrier gain. This is problematic because it is possible that the network configuration that should be applied is a function of the AP's properties such as SSID (cf. SSID= in systemd.network(5)). As illustrated in the above diagram, it may be that the AP with SSID "bar" ends up being configured as though it had SSID "foo". Address the above issue by having nl80211 emit an NL80211_CMD_START_AP message on the MLME nl80211 multicast group. This allows for arbitrary processes to be reliably informed. Signed-off-by: Alvin Šipraga Link: https://lore.kernel.org/r/20230128125844.2407135-1-alvin@pqrs.dk Signed-off-by: Johannes Berg commit aa87cd8b35736a5183745ab0ec4b82419024dfd7 Author: Johannes Berg Date: Fri Jan 27 12:39:31 2023 +0100 wifi: mac80211: mlme: handle EHT channel puncturing Handle the Puncturing info received from the AP in the EHT Operation element in beacons. If the info is invalid: - during association: disable EHT connection for the AP - after association: disconnect This commit includes many (internal) bugfixes and spec updates various people. Co-developed-by: Miri Korenblit Signed-off-by: Miri Korenblit Link: https://lore.kernel.org/r/20230127123930.4fbc74582331.I3547481d49f958389f59dfeba3fcc75e72b0aa6e@changeid Signed-off-by: Johannes Berg commit 8bb588d975019748ebdab9448e9a274b7463c13b Author: Veerendranath Jakkam Date: Thu Jan 26 20:02:56 2023 +0530 wifi: cfg80211: Extend cfg80211_update_owe_info_event() for MLD AP Add support to offload OWE processing to user space for MLD AP when driver's SME in use. Add new parameters in struct cfg80211_update_owe_info to provide below information in cfg80211_update_owe_info_event() call: - MLO link ID of the AP, with which station requested (re)association. This is applicable for both MLO and non-MLO station connections when the AP affiliated with an MLD. - Station's MLD address if the connection is MLO capable. Signed-off-by: Veerendranath Jakkam Link: https://lore.kernel.org/r/20230126143256.960563-3-quic_vjakkam@quicinc.com [reformat the trace event macro] Signed-off-by: Johannes Berg commit a42e59eb9689e54279227e2af5ed75128d92a82b Author: Veerendranath Jakkam Date: Thu Jan 26 20:02:55 2023 +0530 wifi: cfg80211: Extend cfg80211_new_sta() for MLD AP Add support for drivers to indicate STA connection(MLO/non-MLO) when user space SME (e.g., hostapd) is not used for MLD AP. Add new parameters in struct station_info to provide below information in cfg80211_new_sta() call: - MLO link ID of the AP, with which station completed (re)association. This is applicable for both MLO and non-MLO station connections when the AP affiliated with an MLD. - Station's MLD address if the connection is MLO capable. - (Re)Association Response IEs sent to the station. User space needs this to determine rejected and accepted affiliated links information of the connected station if the connection is MLO capable. Signed-off-by: Veerendranath Jakkam Link: https://lore.kernel.org/r/20230126143256.960563-2-quic_vjakkam@quicinc.com Signed-off-by: Johannes Berg commit 9288188438d85e22c23cfd6657ee8a801babc83c Author: Lorenzo Bianconi Date: Wed Jan 25 12:01:02 2023 +0100 wifi: mac80211: move color collision detection report in a delayed work Move color collision report in a dedicated delayed work and do not run it in interrupt context in order to rate-limit the number of events reported to userspace. Moreover grab wdev mutex in ieee80211_color_collision_detection_work routine since it is required by cfg80211_obss_color_collision_notify(). Tested-by: Nicolas Cavallari Signed-off-by: Lorenzo Bianconi Fixes: 5f9404abdf2a ("mac80211: add support for BSS color change") Link: https://lore.kernel.org/r/3f6cf60c892ad40c1cca4a55d62b1224ef1c6ce9.1674644379.git.lorenzo@kernel.org Signed-off-by: Johannes Berg commit 015b8cc5e7c4d7bb671f1984d7b7338c310b185b Author: Alexander Wetzel Date: Tue Jan 24 15:18:56 2023 +0100 wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection. Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory. Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work. Fixes: fffd0934b939 ("cfg80211: rework key operation") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230124141856.356646-1-alexander@wetzel-home.de Signed-off-by: Alexander Wetzel Signed-off-by: Johannes Berg commit 8eff2e2410cfe941207cb17ab322b0e6ce780f54 Author: Heiko Carstens Date: Sun Feb 12 17:37:48 2023 +0100 s390: remove confusing comment from uapi types header file The comment for addr_t doesn't make too much sense. Given that also the formatting is incorrect, just remove it. Signed-off-by: Heiko Carstens commit 1c06bb87afb2d95b8e9f4f2e3d0d6772c68f3e76 Author: Eric Farman Date: Fri Feb 10 18:42:27 2023 +0100 vfio/ccw: remove WARN_ON during shutdown The logic in vfio_ccw_sch_shutdown() always assumed that the input subchannel would point to a vfio_ccw_private struct, without checking that one exists. The blamed commit put in a check for this scenario, to prevent the possibility of a missing private. The trouble is that check was put alongside a WARN_ON(), presuming that such a scenario would be a cause for concern. But this can be triggered by binding a subchannel to vfio-ccw, and rebooting the system before starting the mdev (via "mdevctl start" or similar) or after stopping it. In those cases, shutdown doesn't need to worry because either the private was never allocated, or it was cleaned up by vfio_ccw_mdev_remove(). Remove the WARN_ON() piece of this check, since there are plausible scenarios where private would be NULL in this path. Fixes: 9e6f07cd1eaa ("vfio/ccw: create a parent struct") Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/r/20230210174227.2256424-1-farman@linux.ibm.com Signed-off-by: Heiko Carstens commit adf1e17edc65560ea5615d35ded65834cbf33422 Author: Heiko Carstens Date: Sun Feb 12 18:00:56 2023 +0100 s390/entry: remove toolchain dependent micro-optimization Get rid of CONFIG_AS_IS_LLVM in entry.S to make the code a bit more readable. This removes a micro-optimization, but given that the llvm IAS limitation will likely stay, just use the version that works with llvm. See commit 4c25f0ff6336 ("s390/entry: workaround llvm's IAS limitations") for further details. Signed-off-by: Heiko Carstens commit af0735269b72333d06e9677cb843bf5ce689a38c Author: Vasily Gorbik Date: Fri Feb 10 15:47:06 2023 +0100 s390/mem_detect: do not truncate online memory ranges info Commit bf64f0517e5d ("s390/mem_detect: handle online memory limit just once") introduced truncation of mem_detect online ranges based on identity mapping size. For kdump case however the full set of online memory ranges has to be feed into memblock_physmem_add so that crashed system memory could be extracted. Instead of truncating introduce a "usable limit" which is respected by mem_detect api. Also add extra online memory ranges iterator which still provides full set of online memory ranges disregarding the "usable limit". Fixes: bf64f0517e5d ("s390/mem_detect: handle online memory limit just once") Reported-by: Alexander Egorenkov Tested-by: Alexander Egorenkov Reviewed-by: Alexander Gordeev Signed-off-by: Vasily Gorbik Signed-off-by: Heiko Carstens commit 55d169c87db1d0faa95313809f18f8b49cafdd75 Author: Heiko Carstens Date: Fri Feb 10 14:09:38 2023 +0100 s390/vx: remove __uint128_t type from __vector128 struct again The __uint128_t member was only added for future convenience to the __vector128 struct. However this is a uapi header file, 31/32 bit (aka compat layer) is still supported, but doesn't know anything about this type: /usr/include/asm/types.h:27:17: error: unknown type name __uint128_t 27 | __uint128_t v; Therefore remove it again. Fixes: b0b7b43fcc46 ("s390/vx: add 64 and 128 bit members to __vector128 struct") Signed-off-by: Heiko Carstens commit 0807b856521f3313d3912ebb52a9144215c4ff08 Author: Gerald Schaefer Date: Mon Feb 6 17:48:21 2023 +0100 s390/mm: add support for RDP (Reset DAT-Protection) RDP instruction allows to reset DAT-protection bit in a PTE, with less CPU synchronization overhead than IPTE instruction. In particular, IPTE can cause machine-wide synchronization overhead, and excessive IPTE usage can negatively impact machine performance. RDP can be used instead of IPTE, if the new PTE only differs in SW bits and _PAGE_PROTECT HW bit, for PTE protection changes from RO to RW. SW PTE bit changes are allowed, e.g. for dirty and young tracking, but none of the other HW-defined part of the PTE must change. This is because the architecture forbids such changes to an active and valid PTE, which is why invalidation with IPTE is always used first, before writing a new entry. The RDP optimization helps mainly for fault-driven SW dirty-bit tracking. Writable PTEs are initially always mapped with HW _PAGE_PROTECT bit set, to allow SW dirty-bit accounting on first write protection fault, where the DAT-protection would then be reset. The reset is now done with RDP instead of IPTE, if RDP instruction is available. RDP cannot always guarantee that the DAT-protection reset is propagated to all CPUs immediately. This means that spurious TLB protection faults on other CPUs can now occur. For this, common code provides a flush_tlb_fix_spurious_fault() handler, which will now be used to do a CPU-local TLB flush. However, this will clear the whole TLB of a CPU, and not just the affected entry. For more fine-grained flushing, by simply doing a (local) RDP again, flush_tlb_fix_spurious_fault() would need to also provide the PTE pointer. Note that spurious TLB protection faults cannot really be distinguished from racing pagetable updates, where another thread already installed the correct PTE. In such a case, the local TLB flush would be unnecessary overhead, but overall reduction of CPU synchronization overhead by not using IPTE is still expected to be beneficial. Reviewed-by: Alexander Gordeev Signed-off-by: Gerald Schaefer Signed-off-by: Heiko Carstens commit d939474b3d92624744a334c9e5f58ce3934584b5 Author: Peter Xu Date: Sun Feb 5 18:17:04 2023 -0500 s390/mm: define private VM_FAULT_* reasons from top bits The current definition already collapse with the generic definition of vm_fault_reason. Move the private definitions to allocate bits from the top of uint so they won't collapse anymore. Signed-off-by: Peter Xu Link: https://lore.kernel.org/r/20230205231704.909536-4-peterx@redhat.com Signed-off-by: Heiko Carstens commit 9a47c1ef5a95d1fd229ee5e375985f809a9d8177 Author: Veerendranath Jakkam Date: Mon Jan 16 18:20:58 2023 +0530 wifi: cfg80211: Authentication offload to user space for MLO connection in STA mode Currently authentication request event interface doesn't have support to indicate the user space whether it should enable MLO or not during the authentication with the specified AP. But driver needs such capability since the connection is MLO or not decided by the driver in case of SME offload to the driver. Add support for driver to indicate MLD address of the AP in authentication offload request to inform user space to enable MLO during authentication process. Driver shall look at NL80211_ATTR_MLO_SUPPORT flag capability in NL80211_CMD_CONNECT to know whether the user space supports enabling MLO during the authentication offload. User space should enable MLO during the authentication only when it receives the AP MLD address in authentication offload request. User space shouldn't enable MLO if the authentication offload request doesn't indicate the AP MLD address even if the AP is MLO capable. When MLO is enabled, user space should use the MAC address of the interface (on which driver sent request) as self MLD address. User space and driver to use MLD addresses in RA, TA and BSSID fields of the frames between them, and driver translates the MLD addresses to/from link addresses based on the link chosen for the authentication. Signed-off-by: Veerendranath Jakkam Link: https://lore.kernel.org/r/20230116125058.1604843-1-quic_vjakkam@quicinc.com Signed-off-by: Johannes Berg commit 991cbd4f34b1d2d4e4cc41aed6eb4799186c3887 Merge: a71fad0fd893b 2b68d659a704a Author: Paolo Abeni Date: Tue Feb 14 11:00:03 2023 +0100 Merge branch 'add-support-for-per-action-hw-stats' Oz Shlomo says: ==================== add support for per action hw stats There are currently two mechanisms for populating hardware stats: 1. Using flow_offload api to query the flow's statistics. The api assumes that the same stats values apply to all the flow's actions. This assumption breaks when action drops or jumps over following actions. 2. Using hw_action api to query specific action stats via a driver callback method. This api assures the correct action stats for the offloaded action, however, it does not apply to the rest of the actions in the flow's actions array, as elaborated below. The current hw_action api does not apply to the following use cases: 1. Actions that are implicitly created by filters (aka bind actions). In the following example only one counter will apply to the rule: tc filter add dev $DEV prio 2 protocol ip parent ffff: \ flower ip_proto tcp dst_ip $IP2 \ action police rate 1mbit burst 100k conform-exceed drop/pipe \ action mirred egress redirect dev $DEV2 2. Action preceding a hw action. In the following example the same flow stats will apply to the sample and mirred actions: tc action add police rate 1mbit burst 100k conform-exceed drop / pipe tc filter add dev $DEV prio 2 protocol ip parent ffff: \ flower ip_proto tcp dst_ip $IP2 \ action sample rate 1 group 10 trunc 60 pipe \ action police index 1 \ action mirred egress redirect dev $DEV2 3. Meter action using jump control. In the following example the same flow stats will apply to both mirred actions: tc action add police rate 1mbit burst 100k conform-exceed jump 2 / pipe tc filter add dev $DEV prio 2 protocol ip parent ffff: \ flower ip_proto tcp dst_ip $IP2 \ action police index 1 \ action mirred egress redirect dev $DEV2 action mirred egress redirect dev $DEV3 This series provides the platform to query per action stats for in_hw flows. The first four patches are preparation patches with no functionality change. The fifth patch re-uses the existing flow action stats api to query action stats for both classifier and action dumps. The rest of the patches add per action stats support to the Mellanox driver. ==================== Link: https://lore.kernel.org/r/20230212132520.12571-1-ozsh@nvidia.com Signed-off-by: Paolo Abeni commit 2b68d659a704abaa61fb3255776b5483bdc4eb35 Author: Oz Shlomo Date: Sun Feb 12 15:25:20 2023 +0200 net/mlx5e: TC, support per action stats Extend the action stats callback implementation to update stats for actions that are associated with hw counters. Note that the callback may be called from tc action utility or from tc flower. Both apis expect the driver to return the stats difference from the last update. As such, query the raw counter value and maintain the diff from the last api call in the tc layer, instead of the fs_core layer. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Paolo Abeni commit d13674b1d14c68339173db5dd39c4ab0949234e7 Author: Oz Shlomo Date: Sun Feb 12 15:25:19 2023 +0200 net/mlx5e: TC, map tc action cookie to a hw counter Currently a hardware counter is associated with a flow cookie. This does not apply to flows using branching action which are required to return per action stats. A single counter may apply to multiple actions. Scan the flow actions in reverse (from the last to the first action) while caching the last counter. Associate all the flow attribute tc action cookies with the current cached counter. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Paolo Abeni commit cca7eac13856e75306bbdefb1673bcd0310d9abc Author: Oz Shlomo Date: Sun Feb 12 15:25:18 2023 +0200 net/mlx5e: TC, store tc action cookies per attr The tc parse action phase translates the tc actions to mlx5 flow attributes data structure that is used during the flow offload phase. Currently, the flow offload stage instantiates hw counters while associating them to flow cookie. However, flows with branching actions are required to associate a hardware counter with its action cookies. Store the parsed tc action cookies on the flow attribute. Use the list of cookies in the next patch to associate a tc action cookie with its allocated hw counter. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Paolo Abeni commit e9d1061d87276d3397157ea947fa28374dcbf974 Author: Oz Shlomo Date: Sun Feb 12 15:25:17 2023 +0200 net/mlx5e: TC, add hw counter to branching actions Currently a hw count action is appended to the last action of the action list. However, a branching action may terminate the action list before reaching the last action. Append a count action to a branching action. In the next patches, filters with branching actions will read this counter when reporting stats per action. Signed-off-by: Oz Shlomo Reviewed-by: Roi Dayan Signed-off-by: Paolo Abeni commit 5246c896b805b043a87fa78af32a33cbce00de05 Author: Oz Shlomo Date: Sun Feb 12 15:25:16 2023 +0200 net/sched: support per action hw stats There are currently two mechanisms for populating hardware stats: 1. Using flow_offload api to query the flow's statistics. The api assumes that the same stats values apply to all the flow's actions. This assumption breaks when action drops or jumps over following actions. 2. Using hw_action api to query specific action stats via a driver callback method. This api assures the correct action stats for the offloaded action, however, it does not apply to the rest of the actions in the flow's actions array. Extend the flow_offload stats callback to indicate that a per action stats update is required. Use the existing flow_offload_action api to query the action's hw stats. In addition, currently the tc action stats utility only updates hw actions. Reuse the existing action stats cb infrastructure to query any action stats. Signed-off-by: Oz Shlomo Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit d307b2c6f962ad5d83d7a7df71c2e9c9e4106d82 Author: Oz Shlomo Date: Sun Feb 12 15:25:15 2023 +0200 net/sched: introduce flow_offload action cookie Currently a hardware action is uniquely identified by the tuple. However, the id is set by the flow_act_setup callback and tc core cannot enforce this, and it is possible that a future change could break this. In addition, are not unique across network namespaces. Uniquely identify the action by setting an action cookie by the tc core. Use the unique action cookie to query the action's hardware stats. Signed-off-by: Oz Shlomo Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit ac7d27907d5445d0accaf998e1dc3ea570ed1ba6 Author: Oz Shlomo Date: Sun Feb 12 15:25:14 2023 +0200 net/sched: pass flow_stats instead of multiple stats args Instead of passing 6 stats related args, pass the flow_stats. Signed-off-by: Oz Shlomo Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit 3320f36fd8ad45312c98857d36ecbef90f829497 Author: Oz Shlomo Date: Sun Feb 12 15:25:13 2023 +0200 net/sched: act_pedit, setup offload action for action stats query A single tc pedit action may be translated to multiple flow_offload actions. Offload only actions that translate to a single pedit command value. Signed-off-by: Oz Shlomo Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit 8f2ca70c07f4cee68ed6297c1876c28b73c9af21 Author: Oz Shlomo Date: Sun Feb 12 15:25:12 2023 +0200 net/sched: optimize action stats api calls Currently the hw action stats update is called from tcf_exts_hw_stats_update, when a tc filter is dumped, and from tcf_action_copy_stats, when a hw action is dumped. However, the tcf_action_copy_stats is also called from tcf_action_dump. As such, the hw action stats update cb is called 3 times for every tc flower filter dump. Move the tc action hw stats update from tcf_action_copy_stats to tcf_dump_walker to update the hw action stats when tc action is dumped. Signed-off-by: Oz Shlomo Reviewed-by: Simon Horman Reviewed-by: Marcelo Ricardo Leitner Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit 3d9c361713f24f3f55b9622d18d32add1910e6ba Author: Johannes Berg Date: Thu Jan 19 14:45:47 2023 +0100 wifi: cfg80211: trace: remove MAC_PR_{FMT,ARG} With %pM, this really is no longer needed, and actually longer to spell out. Remove it. Signed-off-by: Johannes Berg commit a71fad0fd893b5db8ec5a8a287ff87720b7352a6 Author: Arınç ÜNAL Date: Sun Feb 12 16:12:58 2023 +0300 dt-bindings: net: dsa: mediatek,mt7530: improve binding description Fix inaccurate information about PHY muxing, and merge standalone and multi-chip module MT7530 configuration methods. Signed-off-by: Arınç ÜNAL Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230212131258.47551-1-arinc.unal@arinc9.com Signed-off-by: Paolo Abeni commit 17c45768fdf970b8a2ea9745783ff6a0512fca11 Author: Greg Kroah-Hartman Date: Tue Feb 14 08:59:33 2023 +0100 Revert "driver core: add error handling for devtmpfs_create_node()" This reverts commit 31b4b6730fd4f5d503c9f23619c920ce7b794754 as it is reported to cause boot regressions. Link: https://lore.kernel.org/r/Y+rSXg14z1Myd8Px@dev-arch.thelio-3990X Reported-by: Nathan Chancellor Cc: Longlong Xia Signed-off-by: Greg Kroah-Hartman commit 48c9899affd51f7acfc07a3f4d777b6eeb73a451 Author: Greg Kroah-Hartman Date: Tue Feb 14 08:59:22 2023 +0100 Revert "devtmpfs: add debug info to handle()" This reverts commit 90a9d5ff225267b3376f73c19f21174e3b6d7746 as it is reported to cause boot regressions. Link: https://lore.kernel.org/r/Y+rSXg14z1Myd8Px@dev-arch.thelio-3990X Reported-by: Nathan Chancellor Cc: Longlong Xia Signed-off-by: Greg Kroah-Hartman commit d3583f06782cae72374464f9c29b2056fa0bd012 Author: Greg Kroah-Hartman Date: Tue Feb 14 08:59:13 2023 +0100 Revert "devtmpfs: remove return value of devtmpfs_delete_node()" This reverts commit 9d3fe6aa6b9517408064c7c3134187e8ec77dbf7 as it is reported to cause boot regressions. Link: https://lore.kernel.org/r/Y+rSXg14z1Myd8Px@dev-arch.thelio-3990X Reported-by: Nathan Chancellor Cc: Longlong Xia Signed-off-by: Greg Kroah-Hartman commit 1f5dfcc78ab4cc06ce7dac9de6c1ed361fde7119 Author: Alexei Starovoitov Date: Mon Feb 13 22:01:14 2023 -0800 Revert "bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25" This reverts commit 0243d3dfe274832aa0a16214499c208122345173. pahole 1.25 is too aggressive removing functions. With clang compiled kernel the following is seen: WARN: resolve_btfids: unresolved symbol tcp_reno_cong_avoid WARN: resolve_btfids: unresolved symbol dctcp_update_alpha WARN: resolve_btfids: unresolved symbol cubictcp_cong_avoid WARN: resolve_btfids: unresolved symbol bpf_xdp_metadata_rx_timestamp WARN: resolve_btfids: unresolved symbol bpf_xdp_metadata_rx_hash WARN: resolve_btfids: unresolved symbol bpf_task_kptr_get WARN: resolve_btfids: unresolved symbol bpf_task_acquire_not_zero WARN: resolve_btfids: unresolved symbol bpf_rdonly_cast WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_static_unused_arg WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_ref WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_pass_ctx WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_pass2 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_pass1 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_mem_len_pass1 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_mem_len_fail2 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_mem_len_fail1 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_kptr_get WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_fail3 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_fail2 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test_acquire WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test2 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_test1 WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_memb_release WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_memb1_release WARN: resolve_btfids: unresolved symbol bpf_kfunc_call_int_mem_release Signed-off-by: Alexei Starovoitov commit 50a7cedb150a628b54aa7f8ce1e922a72c773273 Author: Joanne Koong Date: Mon Feb 13 21:13:32 2023 -0800 selftests/bpf: Clean up dynptr prog_tests Clean up prog_tests/dynptr.c by removing the unneeded "expected_err_msg" in the dynptr_tests struct, which is a remnant from converting the fail tests cases to use the generic verification tester. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/r/20230214051332.4007131-2-joannelkoong@gmail.com Signed-off-by: Alexei Starovoitov commit 8032cad1030279066ce4a1f82b76d0fe7eb578e2 Author: Joanne Koong Date: Mon Feb 13 21:13:31 2023 -0800 selftests/bpf: Clean up user_ringbuf, cgrp_kfunc, kfunc_dynptr_param tests Clean up user_ringbuf, cgrp_kfunc, and kfunc_dynptr_param tests to use the generic verification tester for checking verifier rejections. The generic verification tester uses btf_decl_tag-based annotations for verifying that the tests fail with the expected log messages. Signed-off-by: Joanne Koong Acked-by: David Vernet Reviewed-by: Roberto Sassu Link: https://lore.kernel.org/r/20230214051332.4007131-1-joannelkoong@gmail.com Signed-off-by: Alexei Starovoitov commit b6c0c237bea191fb99b6c2de093262402b0159a6 Author: Keith Busch Date: Fri Feb 10 10:03:47 2023 -0800 nvme-pci: remove iod use_sgls It's not used anywhere anymore, so remove it. Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 8f0edf45bb676ec3558d6b668ad3f6a7d54cf601 Author: Keith Busch Date: Fri Feb 10 10:03:46 2023 -0800 nvme-pci: fix freeing single sgl There may only be a single DMA mapped entry from multiple physical segments, which means we don't allocate a separte SGL list. Check the number of allocations prior to know if we need to free something. Freeing a single list allocation is the same for both PRP and SGL usages, so we don't need to check the use_sgl flag anymore. Fixes: 01df742d8c5c0 ("nvme-pci: remove SGL segment descriptors") Reported-by: Niklas Schnelle Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig Tested-by: Niklas Schnelle commit 8b84475318641c2b89320859332544cf187e1cbd Author: Taehee Yoo Date: Fri Feb 10 18:15:41 2023 +0000 crypto: x86/aria-avx - Do not use avx2 instructions vpbroadcastb and vpbroadcastd are not AVX instructions. But the aria-avx assembly code contains these instructions. So, kernel panic will occur if the aria-avx works on AVX2 unsupported CPU. vbroadcastss, and vpshufb are used to avoid using vpbroadcastb in it. Unfortunately, this change reduces performance by about 5%. Also, vpbroadcastd is simply replaced by vmovdqa in it. Fixes: ba3579e6e45c ("crypto: aria-avx - add AES-NI/AVX/x86_64/GFNI assembler implementation of aria cipher") Reported-by: Herbert Xu Reported-by: Erhard F. Signed-off-by: Taehee Yoo Signed-off-by: Herbert Xu commit eb33108858b64ebc0f79a582123731c2585ae63b Author: Herbert Xu Date: Fri Feb 10 17:40:57 2023 +0800 crypto: aspeed - Fix modular aspeed-acry When aspeed-acry is enabled as a module it doesn't get built at all. Fix this by adding it to obj-m. Signed-off-by: Herbert Xu Reviewed-by: Neal Liu Signed-off-by: Herbert Xu commit ced18fd1794787d57acff1a4d1b2816d5ec99fbc Author: Weili Qian Date: Thu Feb 9 20:36:17 2023 +0800 crypto: hisilicon/qm - fix coding style issues 1. Remove extra blank lines. 2. Remove extra spaces. 3. Use spaces instead of tabs around '=' and '\', to ensure consistent coding styles. 4. Macros should be capital letters, change 'QM_SQC_VFT_NUM_MASK_v2' to 'QM_SQC_VFT_NUM_MASK_V2'. Signed-off-by: Weili Qian Signed-off-by: Herbert Xu commit 9b4eb8f8b8eccc313663a99904dcfe2660c41b6c Author: Weili Qian Date: Thu Feb 9 20:36:16 2023 +0800 crypto: hisilicon/qm - update comments to match function The return values of some functions have been modified, but the comments have not been modified together. The comments must be updated to be consistent with the functions. Also move comments over the codes instead of right place to ensure consistent coding styles. Signed-off-by: Weili Qian Signed-off-by: Herbert Xu commit ac80056f2e7bd80184312ccd91a40532eb95b811 Author: Weili Qian Date: Thu Feb 9 20:36:15 2023 +0800 crypto: hisilicon/qm - change function names The accelerator devices support multiple interrupts. To better reflect purpose of each interrupt function, change function name 'qm_irq' to 'qm_eq_irq' and 'do_qm_irq' to 'do_qm_eq_irq'. Signed-off-by: Weili Qian Signed-off-by: Herbert Xu commit f8de067cbe05a43a3de5d8873cd63c17abb1c7c8 Author: Weili Qian Date: Thu Feb 9 20:36:14 2023 +0800 crypto: hisilicon/qm - use min() instead of min_t() 'act_q_num = min_t(int, act_q_num, max_qp_num)', the type of 'act_q_num' and 'max_qp_num' are both 'u32', so use min() instead of min_t(). Signed-off-by: Weili Qian Signed-off-by: Herbert Xu commit a292f2534fb2caec7f3ad32045338f8feac28112 Author: Weili Qian Date: Thu Feb 9 20:36:13 2023 +0800 crypto: hisilicon/qm - remove some unused defines 1. Remove some macros define since it is not used. 2. Remove enum QM_HW_UNKNOWN since it is not used. 3. Remove unused member 'is_frozen' in 'hisi_qm' structure. Signed-off-by: Weili Qian Signed-off-by: Herbert Xu commit c43cc8823d56b1d34744581e42d6eeaca028f1ab Author: Herbert Xu Date: Thu Feb 9 09:16:45 2023 +0800 crypto: proc - Print fips status As FIPS may disable algorithms it is useful to show their status in /proc/crypto. Signed-off-by: Herbert Xu Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit bcdda4301bdc4955d45f7e1ffefb6207967b067e Author: Herbert Xu Date: Mon Feb 6 14:01:53 2023 +0800 crypto: crypto4xx - Call dma_unmap_page when done In crypto4xx_cipher_done, we should be unmapping the dst page, not mapping it. This was flagged by a sparse warning about the unused addr variable. While we're at it, also fix a sparse warning regarding the unused ctx variable in crypto4xx_ahash_done (by actually using it). Fixes: 049359d65527 ("crypto: amcc - Add crypt4xx driver") Signed-off-by: Herbert Xu Tested-by: Christian Lamparter Signed-off-by: Herbert Xu commit 72bc4e71dbeedee0a446bcbc37c9bb25449072b7 Author: Alexander Lobakin Date: Mon Feb 6 13:18:50 2023 +0800 crypto: octeontx2 - Fix objects shared between several modules cn10k_cpt.o, otx2_cptlf.o and otx2_cpt_mbox_common.o are linked into both rvu_cptpf and rvu_cptvf modules: > scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: > cn10k_cpt.o is added to multiple modules: rvu_cptpf rvu_cptvf > scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: > otx2_cptlf.o is added to multiple modules: rvu_cptpf rvu_cptvf > scripts/Makefile.build:252: ./drivers/crypto/marvell/octeontx2/Makefile: > otx2_cpt_mbox_common.o is added to multiple modules: rvu_cptpf rvu_cptvf Despite they're build under the same Kconfig option (CONFIG_CRYPTO_DEV_OCTEONTX2_CPT), it's better do link the common code into a standalone module and export the shared functions. Under certain circumstances, this can lead to the same situation as fixed by commit 637a642f5ca5 ("zstd: Fixing mixed module-builtin objects"). Plus, those three common object files are relatively big to duplicate them several times. Introduce the new module, rvu_cptcommon, to provide the common functions to both modules. Fixes: 19d8e8c7be15 ("crypto: octeontx2 - add virtual function driver support") Suggested-by: Masahiro Yamada Signed-off-by: Alexander Lobakin Reviewed-by: Masahiro Yamada Signed-off-by: Herbert Xu commit 6084466e761754815bea11d0fa67dbf79e2b0666 Author: Herbert Xu Date: Mon Feb 6 13:08:48 2023 +0800 crypto: nx - Fix sparse warnings This driver generates a large number of sparse warnings due to two issues. First of all the structure nx842_devdata is defined inline causing the __rcu tag to be added to all users of it. This easily fixed by splitting up the struct definition. The second issue is with kdoc markers being incomplete. The trivial case of nx842_exec_vas has been fixed, while the other incomplete documentation has simply been downgraded to normal C comments. Signed-off-by: Herbert Xu commit 5072b1c211107fca80b75f0ac0ca6f90e3385837 Author: Herbert Xu Date: Mon Feb 6 12:53:38 2023 +0800 crypto: ecc - Silence sparse warning Rewrite the bitwise operations to silence the sparse warnings: CHECK ../crypto/ecc.c ../crypto/ecc.c:1387:39: warning: dubious: !x | y ../crypto/ecc.c:1397:47: warning: dubious: !x | y Signed-off-by: Herbert Xu Reviewed-by: Vitaly Chikunov Signed-off-by: Herbert Xu commit ba38f3cbe7db2cec802c6d60e2bef57a3ff095a4 Author: Christian Marangi Date: Wed Feb 8 16:39:13 2023 +0100 dt-bindings: opp: opp-v2-kryo-cpu: enlarge opp-supported-hw maximum Enlarge opp-supported-hw maximum value. In recent SoC we started matching more bit and we currently match mask of 112. The old maximum of 7 was good for old SoC that didn't had complex id, but now this is limiting and we need to enlarge it to support more variants. Document all the various mask that can be used and limit them to only reasonable values instead of using a generic maximum limit. Signed-off-by: Christian Marangi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Viresh Kumar commit 389de9c5a677c0d950528ee7d1871366ad2a6fd8 Author: Christian Marangi Date: Wed Feb 8 16:39:12 2023 +0100 dt-bindings: cpufreq: qcom-cpufreq-nvmem: make cpr bindings optional The qcom-cpufreq-nvmem driver supports 2 kind of devices: - pre-cpr that doesn't have power-domains and base everything on nvmem cells and multiple named microvolt bindings. Doesn't need required-opp binding in the opp nodes as they are only used for genpd based devices. - cpr-based that require power-domain in the cpu nodes and use various source to decide the correct voltage and freq Require required-opp binding since they need to be linked to the related opp-level. When the schema was introduced, it was wrongly set to always require these binding but this is not the case for pre-cpr devices. Make the power-domain and the required-opp optional and set them required only for qcs404 based devices. Signed-off-by: Christian Marangi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Viresh Kumar commit 26e27f4e382f126d80e230df2a76d5f1c5a1ac42 Author: Christian Marangi Date: Wed Feb 8 16:39:11 2023 +0100 dt-bindings: cpufreq: qcom-cpufreq-nvmem: specify supported opp tables Add additional info on what opp tables the defined devices in this schema supports (operating-points-v2-kryo-cpu and operating-points-v2-qcom-level) and reference them. Signed-off-by: Christian Marangi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Viresh Kumar commit 5dc3750e747f93f9bb7987da3d47a8ab4a5a181e Author: Daniel Bristot de Oliveira Date: Tue Feb 7 22:48:51 2023 +0100 Documentation/rtla: Add hwnoise man page Add a man page for the new rtla hwnoise tool, mostly based in the rtla osnoise top. Link: https://lkml.kernel.org/r/27088e0f42a6129e9b75f789d78adff4171f2e79.1675805361.git.bristot@kernel.org Signed-off-by: Daniel Bristot de Oliveira Reviewed-by: Bagas Sanjaya Cc: Daniel Bristot de Oliveira Cc: Juri Lelli Cc: Clark Williams Cc: Jonathan Corbet Signed-off-by: Steven Rostedt (Google) commit 1f428356c38dcbe49fd2f1c488b41e88720ead92 Author: Daniel Bristot de Oliveira Date: Tue Feb 7 22:48:50 2023 +0100 rtla: Add hwnoise tool The hwnoise tool is a special mode for the osnoise top tool. hwnoise dispatches the osnoise tracer and displays a summary of the noise. The difference is that it runs the tracer with the OSNOISE_IRQ_DISABLE option set, thus only allowing only hardware-related noise, resulting in a simplified output. hwnoise has the same features of osnoise. An example of the tool's output: # rtla hwnoise -c 1-11 -T 1 -d 10m -q Hardware-related Noise duration: 0 00:10:00 | time is in us CPU Period Runtime Noise % CPU Aval Max Noise Max Single HW NMI 1 #599 599000000 138 99.99997 3 3 4 74 2 #599 599000000 85 99.99998 3 3 4 75 3 #599 599000000 86 99.99998 4 3 6 75 4 #599 599000000 81 99.99998 4 4 2 75 5 #599 599000000 85 99.99998 2 2 2 75 Link: https://lkml.kernel.org/r/2d6f49a6f3a4f8b51b2c806458b1cff71ad4d014.1675805361.git.bristot@kernel.org Signed-off-by: Daniel Bristot de Oliveira Cc: Daniel Bristot de Oliveira Cc: Juri Lelli Cc: Clark Williams Cc: Bagas Sanjaya Cc: Jonathan Corbet Signed-off-by: Steven Rostedt (Google) commit 64816aa7683091cb5dbacaf9b355761961c8a657 Merge: 1a940b00013a4 545dbcd124b02 Author: Jakub Kicinski Date: Mon Feb 13 19:55:34 2023 -0800 Merge branch 'ipv6-more-drop-reason' Eric Dumazet says: ==================== ipv6: more drop reason Add more drop reasons to IPv6: - IPV6_BAD_EXTHDR - IPV6_NDISC_FRAG - IPV6_NDISC_HOP_LIMIT - IPV6_NDISC_BAD_CODE ==================== Link: https://lore.kernel.org/r/20230210184708.2172562-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 545dbcd124b02c9dc93c8a5894c71d682effc3e6 Author: Eric Dumazet Date: Fri Feb 10 18:47:08 2023 +0000 ipv6: icmp6: add drop reason support to ndisc_rcv() Creates three new drop reasons: SKB_DROP_REASON_IPV6_NDISC_FRAG: invalid frag (suppress_frag_ndisc). SKB_DROP_REASON_IPV6_NDISC_HOP_LIMIT: invalid hop limit. SKB_DROP_REASON_IPV6_NDISC_BAD_CODE: invalid NDISC icmp6 code. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 30c89bad3ea2ef7a2d4686f9c3cc08420fe627bc Author: Eric Dumazet Date: Fri Feb 10 18:47:07 2023 +0000 ipv6: icmp6: add drop reason support to icmpv6_notify() Accurately reports what happened in icmpv6_notify() when handling a packet. This makes use of the new IPV6_BAD_EXTHDR drop reason. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 1fb2d41501f38192d8a19da585cd441cf8845697 Author: Eric Dumazet Date: Fri Feb 10 18:47:06 2023 +0000 net: add pskb_may_pull_reason() helper pskb_may_pull() can fail for two different reasons. Provide pskb_may_pull_reason() helper to distinguish between these reasons. It returns: SKB_NOT_DROPPED_YET : Success SKB_DROP_REASON_PKT_TOO_SMALL : packet too small SKB_DROP_REASON_NOMEM : skb->head could not be resized Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit dc68eaf2c29f410fb078fd6da8e56201d3282e0b Author: Eric Dumazet Date: Fri Feb 10 18:47:05 2023 +0000 net: dropreason: add SKB_DROP_REASON_IPV6_BAD_EXTHDR This drop reason can be used whenever an IPv6 packet has a malformed extension header. Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: Jakub Kicinski commit 1a940b00013a468c0c9dd79dbb485c3ad273939e Author: Uwe Kleine-König Date: Sat Feb 11 12:24:31 2023 +0100 net: stmmac: dwc-qos: Make struct dwc_eth_dwmac_data::remove return void All implementations of the remove callback return 0 unconditionally. So in dwc_eth_dwmac_remove() there is no error handling necessary. Simplify accordingly. This is a preparation for making struct platform_driver::remove return void, too. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230211112431.214252-2-u.kleine-koenig@pengutronix.de Signed-off-by: Jakub Kicinski commit ff0011cf56014b4dfe88adc35e36a25df63d5005 Author: Uwe Kleine-König Date: Sat Feb 11 12:24:30 2023 +0100 net: stmmac: Make stmmac_dvr_remove() return void The function returns zero unconditionally. Change it to return void instead which simplifies some callers as error handing becomes unnecessary. This also makes it more obvious that most platform remove callbacks always return zero. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230211112431.214252-1-u.kleine-koenig@pengutronix.de Signed-off-by: Jakub Kicinski commit 1dc55923296dee3eda1816bcf36be8ab064882e0 Author: Lorenzo Bianconi Date: Sun Feb 12 11:08:26 2023 +0100 net: mvneta: do not set xdp_features for hw buffer devices Devices with hardware buffer management do not support XDP, so do not set xdp_features for them. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/19b5838bb3e4515750af822edb2fa5e974d0a86b.1676196230.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 450bdf5bd6c6b78372620da2c32c5a58ab0f124e Author: Lorenzo Bianconi Date: Sun Feb 12 10:57:58 2023 +0100 hv_netvsc: add missing NETDEV_XDP_ACT_NDO_XMIT xdp-features flag Add missing ndo_xdp_xmit bit to xdp_features capability flag. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/8e3747018f0fd0b5d6e6b9aefe8d9448ca3a3288.1676195726.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit c758fedf08025dd3d08768e8f04dbd9be70c83a3 Author: Lorenzo Bianconi Date: Sun Feb 12 10:54:43 2023 +0100 net: stmmac: add missing NETDEV_XDP_ACT_XSK_ZEROCOPY bit to xdp_features Add missing xsk zero-copy bit to xdp_features capability flag. Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/c8949baafdf617188dcedb9033ce5a9ca6e9e5ff.1676195440.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit 511b88fedab459205693dc4bc2ad690fb0dd89ea Author: Christophe JAILLET Date: Sun Feb 12 07:51:51 2023 +0100 net: ethernet: mtk_wed: No need to clear memory after a dma_alloc_coherent() call dma_alloc_coherent() already clears the allocated memory, there is no need to explicitly call memset(). Moreover, it is likely that the size in the memset() is incorrect and should be "size * sizeof(*ring->desc)". Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/d5acce7dd108887832c9719f62c7201b4c83b3fb.1676184599.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit c8ea09974f33c5c516e63ee29d3e6d13ac4bb915 Merge: 6a3cd3318ff65 c31315c3aa092 Author: Alexei Starovoitov Date: Mon Feb 13 19:31:14 2023 -0800 Merge branch 'BPF rbtree next-gen datastructure' Dave Marchevsky says: ==================== This series adds a rbtree datastructure following the "next-gen datastructure" precedent set by recently-added linked-list [0]. This is a reimplementation of previous rbtree RFC [1] to use kfunc + kptr instead of adding a new map type. This series adds a smaller set of API functions than that RFC - just the minimum needed to support current cgfifo example scheduler in ongoing sched_ext effort [2], namely: bpf_rbtree_add bpf_rbtree_remove bpf_rbtree_first The meat of this series is bugfixes and verifier infra work to support these API functions. Adding more rbtree kfuncs in future patches should be straightforward as a result. First, the series refactors and extends linked_list's release_on_unlock logic. The concept of "reference to node that was added to data structure" is formalized as "non-owning reference". From linked_list's perspective this non-owning reference after linked_list_push_{front,back} has same semantics as release_on_unlock, with the addition of writes to such references being valid in the critical section. Such references are no longer marked PTR_UNTRUSTED. Patches 2 and 13 go into more detail. The series then adds rbtree API kfuncs and necessary verifier support for them - namely support for callback args to kfuncs and some non-owning reference interactions that linked_list didn't need. BPF rbtree uses struct rb_root_cached + existing rbtree lib under the hood. From the BPF program writer's perspective, a BPF rbtree is very similar to existing linked list. Consider the following example: struct node_data { long key; long data; struct bpf_rb_node node; } static bool less(struct bpf_rb_node *a, const struct bpf_rb_node *b) { struct node_data *node_a; struct node_data *node_b; node_a = container_of(a, struct node_data, node); node_b = container_of(b, struct node_data, node); return node_a->key < node_b->key; } private(A) struct bpf_spin_lock glock; private(A) struct bpf_rb_root groot __contains(node_data, node); /* ... in BPF program */ struct node_data *n, *m; struct bpf_rb_node *res; n = bpf_obj_new(typeof(*n)); if (!n) /* skip */ n->key = 5; n->data = 10; bpf_spin_lock(&glock); bpf_rbtree_add(&groot, &n->node, less); bpf_spin_unlock(&glock); bpf_spin_lock(&glock); res = bpf_rbtree_first(&groot); if (!res) /* skip */ res = bpf_rbtree_remove(&groot, res); if (!res) /* skip */ bpf_spin_unlock(&glock); m = container_of(res, struct node_data, node); bpf_obj_drop(m); Some obvious similarities: * Special bpf_rb_root and bpf_rb_node types have same semantics as bpf_list_head and bpf_list_node, respectively * __contains is used to associated node type with root * The spin_lock associated with a rbtree must be held when using rbtree API kfuncs * Nodes are allocated via bpf_obj_new and dropped via bpf_obj_drop * Rbtree takes ownership of node lifetime when a node is added. Removing a node gives ownership back to the program, requiring a bpf_obj_drop before program exit Some new additions as well: * Support for callbacks in kfunc args is added to enable 'less' callback use above * bpf_rbtree_first is the first graph API function to return a non-owning reference instead of convering an arg from own->non-own * Because all references to nodes already added to the rbtree are non-owning, bpf_rbtree_remove must accept such a reference in order to remove it from the tree Summary of patches: Patches 1 - 5 implement the meat of rbtree-specific support in this series, gradually building up to implemented kfuncs that verify as expected. Patch 6 adds the bpf_rbtree_{add,first,remove} to bpf_experimental.h. Patch 7 adds tests, Patch 9 adds documentation. [0]: lore.kernel.org/bpf/20221118015614.2013203-1-memxor@gmail.com [1]: lore.kernel.org/bpf/20220830172759.4069786-1-davemarchevsky@fb.com [2]: lore.kernel.org/bpf/20221130082313.3241517-1-tj@kernel.org Changelog: v5 -> v6: lore.kernel.org/bpf/20230212092715.1422619-1-davemarchevsky@fb.com/ Patch #'s below refer to the patch's number in v5 unless otherwise stated. * General / Patch 1 * Rebase onto latest bpf-next: "bpf: Migrate release_on_unlock logic to non-owning ref semantics" * This was Patch 1 of v4, was applied, not included in v6 * Patch 3 - "bpf: Add bpf_rbtree_{add,remove,first} kfuncs" * Use bpf_callback_t instead of plain-C fn ptr for bpf_rbtree_add. This necessitated having bpf_rbtree_add duplicate rbtree_add's functionality. Wrapper function was used w/ internal __bpf_rbtree_add helper so that bpf_experimental.h proto could continue to use plain-C fn ptr so BPF progs could benefit from typechecking (Alexei) v4 -> v5: lore.kernel.org/bpf/20230209174144.3280955-1-davemarchevsky@fb.com/ Patch #'s below refer to the patch's number in v4 unless otherwise stated. * General * Rebase onto latest bpf-next: "Merge branch 'bpf, mm: introduce cgroup.memory=nobpf'" * Patches 1-3 are squashed into "bpf: Migrate release_on_unlock logic to non-owning ref semantics". * Added type_is_non_owning_ref helper (Alexei) * Use a NON_OWN_REF type flag instead of separate bool (Alexei) * Patch 8 - "bpf: Special verifier handling for bpf_rbtree_{remove, first}" * When doing btf_parse_fields, reject structs with both bpf_list_node and bpf_rb_node fields. This is a temporary measure that can be removed after "collection identity" followup. See comment added in btf_parse_fields for more detail (Kumar, Alexei) * Add linked_list BTF test exercising check added to btf_parse_fields * Minor changes and moving around of some reg type checks due to NON_OWN_REF type flag introduction * Patch 10 - "selftests/bpf: Add rbtree selftests" * Migrate failure tests to RUN_TESTS, __failure, __msg() framework (Alexei) v3 -> v4: lore.kernel.org/bpf/20230131180016.3368305-1-davemarchevsky@fb.com/ Patch #'s below refer to the patch's number in v3 unless otherwise stated. * General * Don't base this series on "bpf: Refactor release_regno searching logic", which was submitted separately as a refactor. * Rebase onto latest bpf-next: "samples/bpf: Add openat2() enter/exit tracepoint to syscall_tp sample" * Patch 2 - "bpf: Improve bpf_reg_state space usage for non-owning ref lock" * print_verifier_state change was adding redundant comma after "non_own_ref", fix it to put comma in correct place * invalidate_non_owning_refs no longer needs to take bpf_active_lock param, since any non-owning ref reg in env's cur_state is assumed to use that state's active_lock (Alexei) * invalidate_non_owning_refs' reg loop should check that the reg being inspected is a PTR_TO_BTF_ID before checking reg->non_owning_ref_lock, since that field is part of a union and may be filled w/ meaningless bytes if reg != PTR_TO_BTF_ID (Alexei) * Patch 3 - "selftests/bpf: Update linked_list tests for non-owning ref semantics" * Change the string searched for by the following tests: * linked_list/incorrect_node_off1 * linked_list/double_push_front * linked_list/double_push_back necessary due to rebase / dropping of "release_regno searching logic" patch (see "General" changes) * Patch 8 - "bpf: Special verifier handling for bpf_rbtree_{remove, first}" * Just call invalidate_non_owning_refs w/ env instead of env, lock. (see Patch 2 changes) * Patch 11 - "bpf, documentation: Add graph documentation for non-owning refs" * Fix documentation formatting and improve content (David) * v3's version of patch 11 was missing some changes, v4's patch 11 is still addressing David's feedback from v2 v2 -> v3: lore.kernel.org/bpf/20221217082506.1570898-1-davemarchevsky@fb.com/ Patch #'s below refer to the patch's number in v2 unless otherwise stated. * Patch 1 - "bpf: Support multiple arg regs w/ ref_obj_id for kfuncs" * No longer needed as v3 doesn't have multiple ref_obj_id arg regs * The refactoring pieces were submitted separately (https://lore.kernel.org/bpf/20230121002417.1684602-1-davemarchevsky@fb.com/) * Patch 2 - "bpf: Migrate release_on_unlock logic to non-owning ref semantics" * Remove KF_RELEASE_NON_OWN flag from list API push methods, just match against specific kfuncs for now (Alexei, David) * Separate "release non owning reference" logic from KF_RELEASE logic (Alexei, David) * reg_find_field_offset now correctly tests 'rec' instead of 'reg' after calling reg_btf_record (Dan Carpenter) * New patch added after Patch 2 - "bpf: Improve bpf_reg_state space usage for non-owning ref lock" * Eliminates extra bpf_reg_state memory usage by using a bool instead of copying lock identity * Patch 4 - "bpf: rename list_head -> graph_root in field info types" * v2's version was applied to bpf-next, not including in respins * Patch 6 - "bpf: Add bpf_rbtree_{add,remove,first} kfuncs" * Remove KF_RELEASE_NON_OWN flag from rbtree_add, just add it to specific kfunc matching (Alexei, David) * Patch 9 - "bpf: Special verifier handling for bpf_rbtree_{remove, first}" * Remove KF_INVALIDATE_NON_OWN kfunc flag, just match against specific kfunc for now (Alexei, David) * Patch 11 - "libbpf: Make BTF mandatory if program BTF has spin_lock or alloc_obj type" * Drop for now, will submit separately * Patch 12 - "selftests/bpf: Add rbtree selftests" * Some expected-failure tests have different error messages due to "release non-owning reference logic" being separated from KF_RELEASE logic in Patch 2 changes * Patch 13 - "bpf, documentation: Add graph documentation for non-owning refs" * Fix documentation formatting and improve content (David) v1 -> v2: lore.kernel.org/bpf/20221206231000.3180914-1-davemarchevsky@fb.com/ Series-wide changes: * Rename datastructure_{head,node,api} -> graph_{root,node,api} (Alexei) * "graph datastructure" in patch summaries to refer to linked_list + rbtree instead of "next-gen datastructure" (Alexei) * Move from hacky marking of non-owning references as PTR_UNTRUSTED to cleaner implementation (Alexei) * Add invalidation of non-owning refs to rbtree_remove (Kumar, Alexei) Patch #'s below refer to the patch's number in v1 unless otherwise stated. Note that in v1 most of the meaty verifier changes were in the latter half of the series. Here, about half of that complexity has been moved to "bpf: Migrate release_on_unlock logic to non-owning ref semantics" - was Patch 3 in v1. * Patch 1 - "bpf: Loosen alloc obj test in verifier's reg_btf_record" * Was applied, dropped from further iterations * Patch 2 - "bpf: map_check_btf should fail if btf_parse_fields fails" * Dropped in favor of verifier check-on-use: when some normal verifier checking expects the map to have btf_fields correctly parsed, it won't find any and verification will fail * New patch added before Patch 3 - "bpf: Support multiple arg regs w/ ref_obj_id for kfuncs" * Addition of KF_RELEASE_NON_OWN flag, which requires KF_RELEASE, and tagging of bpf_list_push_{front,back} KF_RELEASE | KF_RELEASE_NON_OWN, means that list-in-list push_{front,back} will trigger "only one ref_obj_id arg reg" logic. This is because "head" arg to those functions can be a list-in-list, which itself can be an owning reference with ref_obj_id. So need to support multiple ref_obj_id for release kfuncs. * Patch 3 - "bpf: Minor refactor of ref_set_release_on_unlock" * Now a major refactor w/ a rename to reflect this * "bpf: Migrate release_on_unlock logic to non-owning ref semantics" * Replaces release_on_unlock with active_lock logic as discussed in v1 * New patch added after Patch 3 - "selftests/bpf: Update linked_list tests for non_owning_ref logic" * Removes "write after push" linked_list failure tests - no longer failure scenarios. * Patch 4 - "bpf: rename list_head -> datastructure_head in field info types" * rename to graph_root instead. Similar renamings across the series - see series-wide changes. * Patch 5 - "bpf: Add basic bpf_rb_{root,node} support" * OWNER_FIELD_MASK -> GRAPH_ROOT_MASK, OWNEE_FIELD_MASK -> GRAPH_NODE_MASK, and change of "owner"/"ownee" in big btf_check_and_fixup_fields comment to "root"/"node" (Alexei) * Patch 6 - "bpf: Add bpf_rbtree_{add,remove,first} kfuncs" * bpf_rbtree_remove can no longer return NULL. v2 continues v1's "use type system to prevent remove of node that isn't in a datastructure" approach, so rbtree_remove should never have been able to return NULL * Patch 7 - "bpf: Add support for bpf_rb_root and bpf_rb_node in kfunc args" * is_bpf_datastructure_api_kfunc -> is_bpf_graph_api_kfunc (Alexei) * Patch 8 - "bpf: Add callback validation to kfunc verifier logic" * Explicitly disallow rbtree_remove in rbtree callback * Explicitly disallow bpf_spin_{lock,unlock} call in rbtree callback, preventing possibility of "unbalanced" unlock (Alexei) * Patch 10 - "bpf, x86: BPF_PROBE_MEM handling for insn->off < 0" * Now that non-owning refs aren't marked PTR_UNTRUSTED it's not necessary to include this patch as part of the series * After conversation w/ Alexei, did another pass and submitted as an independent series (lore.kernel.org/bpf/20221213182726.325137-1-davemarchevsky@fb.com/) * Patch 13 - "selftests/bpf: Add rbtree selftests" * Since bpf_rbtree_remove can no longer return null, remove null checks * Remove test confirming that rbtree_first isn't allowed in callback. We want this to be possible * Add failure test confirming that rbtree_remove's new non-owning reference invalidation behavior behaves as expected * Add SEC("license") to rbtree_btf_fail__* progs. They were previously failing due to lack of this section. Now they're failing for correct reasons. * rbtree_btf_fail__add_wrong_type.c - add locking around rbtree_add, rename the bpf prog to something reasonable * New patch added after patch 13 - "bpf, documentation: Add graph documentation for non-owning refs" * Summarizes details of owning and non-owning refs which we hashed out in v1 ==================== Signed-off-by: Alexei Starovoitov commit c31315c3aa09297d99cb39e837185ef225586d2b Author: Dave Marchevsky Date: Mon Feb 13 16:40:17 2023 -0800 bpf, documentation: Add graph documentation for non-owning refs It is difficult to intuit the semantics of owning and non-owning references from verifier code. In order to keep the high-level details from being lost in the mailing list, this patch adds documentation explaining semantics and details. The target audience of doc added in this patch is folks working on BPF internals, as there's focus on "what should the verifier do here". Via reorganization or copy-and-paste, much of the content can probably be repurposed for BPF program writer audience as well. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-9-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit 215249f6adc0359e3546829e7ee622b5e309b0ad Author: Dave Marchevsky Date: Mon Feb 13 16:40:16 2023 -0800 selftests/bpf: Add rbtree selftests This patch adds selftests exercising the logic changed/added in the previous patches in the series. A variety of successful and unsuccessful rbtree usages are validated: Success: * Add some nodes, let map_value bpf_rbtree_root destructor clean them up * Add some nodes, remove one using the non-owning ref leftover by successful rbtree_add() call * Add some nodes, remove one using the non-owning ref returned by rbtree_first() call Failure: * BTF where bpf_rb_root owns bpf_list_node should fail to load * BTF where node of type X is added to tree containing nodes of type Y should fail to load * No calling rbtree api functions in 'less' callback for rbtree_add * No releasing lock in 'less' callback for rbtree_add * No removing a node which hasn't been added to any tree * No adding a node which has already been added to a tree * No escaping of non-owning references past their lock's critical section * No escaping of non-owning references past other invalidation points (rbtree_remove) These tests mostly focus on rbtree-specific additions, but some of the failure cases revalidate scenarios common to both linked_list and rbtree which are covered in the former's tests. Better to be a bit redundant in case linked_list and rbtree semantics deviate over time. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-8-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit c834df847ee60eeb678171eb0f1e59f611c62a99 Author: Dave Marchevsky Date: Mon Feb 13 16:40:15 2023 -0800 bpf: Add bpf_rbtree_{add,remove,first} decls to bpf_experimental.h These kfuncs will be used by selftests in following patches Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-7-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit a40d3632436b1677a94c16e77be8da798ee9e12b Author: Dave Marchevsky Date: Mon Feb 13 16:40:14 2023 -0800 bpf: Special verifier handling for bpf_rbtree_{remove, first} Newly-added bpf_rbtree_{remove,first} kfuncs have some special properties that require handling in the verifier: * both bpf_rbtree_remove and bpf_rbtree_first return the type containing the bpf_rb_node field, with the offset set to that field's offset, instead of a struct bpf_rb_node * * mark_reg_graph_node helper added in previous patch generalizes this logic, use it * bpf_rbtree_remove's node input is a node that's been inserted in the tree - a non-owning reference. * bpf_rbtree_remove must invalidate non-owning references in order to avoid aliasing issue. Use previously-added invalidate_non_owning_refs helper to mark this function as a non-owning ref invalidation point. * Unlike other functions, which convert one of their input arg regs to non-owning reference, bpf_rbtree_first takes no arguments and just returns a non-owning reference (possibly null) * For now verifier logic for this is special-cased instead of adding new kfunc flag. This patch, along with the previous one, complete special verifier handling for all rbtree API functions added in this series. With functional verifier handling of rbtree_remove, under current non-owning reference scheme, a node type with both bpf_{list,rb}_node fields could cause the verifier to accept programs which remove such nodes from collections they haven't been added to. In order to prevent this, this patch adds a check to btf_parse_fields which rejects structs with both bpf_{list,rb}_node fields. This is a temporary measure that can be removed after "collection identity" followup. See comment added in btf_parse_fields. A linked_list BTF test exercising the new check is added in this patch as well. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-6-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit 5d92ddc3de1b44a82108af68ed71f638ca20509a Author: Dave Marchevsky Date: Mon Feb 13 16:40:13 2023 -0800 bpf: Add callback validation to kfunc verifier logic Some BPF helpers take a callback function which the helper calls. For each helper that takes such a callback, there's a special call to __check_func_call with a callback-state-setting callback that sets up verifier bpf_func_state for the callback's frame. kfuncs don't have any of this infrastructure yet, so let's add it in this patch, following existing helper pattern as much as possible. To validate functionality of this added plumbing, this patch adds callback handling for the bpf_rbtree_add kfunc and hopes to lay groundwork for future graph datastructure callbacks. In the "general plumbing" category we have: * check_kfunc_call doing callback verification right before clearing CALLER_SAVED_REGS, exactly like check_helper_call * recognition of func_ptr BTF types in kfunc args as KF_ARG_PTR_TO_CALLBACK + propagation of subprogno for this arg type In the "rbtree_add / graph datastructure-specific plumbing" category: * Since bpf_rbtree_add must be called while the spin_lock associated with the tree is held, don't complain when callback's func_state doesn't unlock it by frame exit * Mark rbtree_add callback's args with ref_set_non_owning to prevent rbtree api functions from being called in the callback. Semantically this makes sense, as less() takes no ownership of its args when determining which comes first. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-5-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit cd6791b4b6f66f6b7925c840efe5c8fa0ce1ac87 Author: Dave Marchevsky Date: Mon Feb 13 16:40:12 2023 -0800 bpf: Add support for bpf_rb_root and bpf_rb_node in kfunc args Now that we find bpf_rb_root and bpf_rb_node in structs, let's give args that contain those types special classification and properly handle these types when checking kfunc args. "Properly handling" these types largely requires generalizing similar handling for bpf_list_{head,node}, with little new logic added in this patch. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-4-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit bd1279ae8a691d7ec75852c6d0a22139afb034a4 Author: Dave Marchevsky Date: Mon Feb 13 16:40:11 2023 -0800 bpf: Add bpf_rbtree_{add,remove,first} kfuncs This patch adds implementations of bpf_rbtree_{add,remove,first} and teaches verifier about their BTF_IDs as well as those of bpf_rb_{root,node}. All three kfuncs have some nonstandard component to their verification that needs to be addressed in future patches before programs can properly use them: * bpf_rbtree_add: Takes 'less' callback, need to verify it * bpf_rbtree_first: Returns ptr_to_node_type(off=rb_node_off) instead of ptr_to_rb_node(off=0). Return value ref is non-owning. * bpf_rbtree_remove: Returns ptr_to_node_type(off=rb_node_off) instead of ptr_to_rb_node(off=0). 2nd arg (node) is a non-owning reference. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-3-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit 9c395c1b99bd23f74bc628fa000480c49593d17f Author: Dave Marchevsky Date: Mon Feb 13 16:40:10 2023 -0800 bpf: Add basic bpf_rb_{root,node} support This patch adds special BPF_RB_{ROOT,NODE} btf_field_types similar to BPF_LIST_{HEAD,NODE}, adds the necessary plumbing to detect the new types, and adds bpf_rb_root_free function for freeing bpf_rb_root in map_values. structs bpf_rb_root and bpf_rb_node are opaque types meant to obscure structs rb_root_cached rb_node, respectively. btf_struct_access will prevent BPF programs from touching these special fields automatically now that they're recognized. btf_check_and_fixup_fields now groups list_head and rb_root together as "graph root" fields and {list,rb}_node as "graph node", and does same ownership cycle checking as before. Note that this function does _not_ prevent ownership type mixups (e.g. rb_root owning list_node) - that's handled by btf_parse_graph_root. After this patch, a bpf program can have a struct bpf_rb_root in a map_value, but not add anything to nor do anything useful with it. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230214004017.2534011-2-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit ef01749f6a0d3d77e18488263fa920c49a001bfb Author: Lorenzo Bianconi Date: Fri Feb 10 20:06:04 2023 +0100 net: lan966x: set xdp_features flag Set xdp_features netdevice flag if lan966x nic supports xdp mode. Signed-off-by: Lorenzo Bianconi Reviewed-by: Horatiu Vultur Link: https://lore.kernel.org/r/01f4412f28899d97b0054c9c1a63694201301b42.1676055718.git.lorenzo@kernel.org Signed-off-by: Jakub Kicinski commit f57aec443c24d2e8e1f3b5b4856aea12ddda4254 Author: Dan Williams Date: Mon Feb 13 17:01:05 2023 -0800 cxl/pmem: Fix nvdimm registration races A loop of the form: while true; do modprobe cxl_pci; modprobe -r cxl_pci; done ...fails with the following crash signature: BUG: kernel NULL pointer dereference, address: 0000000000000040 [..] RIP: 0010:cxl_internal_send_cmd+0x5/0xb0 [cxl_core] [..] Call Trace: cxl_pmem_ctl+0x121/0x240 [cxl_pmem] nvdimm_get_config_data+0xd6/0x1a0 [libnvdimm] nd_label_data_init+0x135/0x7e0 [libnvdimm] nvdimm_probe+0xd6/0x1c0 [libnvdimm] nvdimm_bus_probe+0x7a/0x1e0 [libnvdimm] really_probe+0xde/0x380 __driver_probe_device+0x78/0x170 driver_probe_device+0x1f/0x90 __device_attach_driver+0x85/0x110 bus_for_each_drv+0x7d/0xc0 __device_attach+0xb4/0x1e0 bus_probe_device+0x9f/0xc0 device_add+0x445/0x9c0 nd_async_device_register+0xe/0x40 [libnvdimm] async_run_entry_fn+0x30/0x130 ...namely that the bottom half of async nvdimm device registration runs after the CXL has already torn down the context that cxl_pmem_ctl() needs. Unlike the ACPI NFIT case that benefits from launching multiple nvdimm device registrations in parallel from those listed in the table, CXL is already marked PROBE_PREFER_ASYNCHRONOUS. So provide for a synchronous registration path to preclude this scenario. Fixes: 21083f51521f ("cxl/pmem: Register 'pmem' / cxl_nvdimm devices") Cc: Reported-by: Dave Jiang Signed-off-by: Dan Williams commit a2b9b123ccac913e9f9b80337d687a2fe786a634 Author: Mengyuan Lou Date: Tue Feb 7 18:24:19 2023 +0800 PCI: Add ACS quirk for Wangxun NICs Wangxun has verified there is no peer-to-peer between functions for the below selection of SFxxx, RP1000 and RP2000 NICS. They may be multi-function devices, but the hardware does not advertise ACS capability. Add an ACS quirk for these devices so the functions can be in independent IOMMU groups. Link: https://lore.kernel.org/r/20230207102419.44326-1-mengyuanlou@net-swift.com Signed-off-by: Mengyuan Lou Signed-off-by: Bjorn Helgaas commit 6bdfc60cf0f9771d592a006dcd2cf6e40e1ccd79 Author: Jakub Wilk Date: Fri Feb 10 21:33:16 2023 +0100 mm: fix typo in __vm_enough_memory warning Link: https://lkml.kernel.org/r/20230210203316.5613-1-jwilk@jwilk.net Signed-off-by: Jakub Wilk Acked-by: Mike Rapoport (IBM) Cc: Kefeng Wang Signed-off-by: Andrew Morton commit 620932cd285208ef3009ac338b1eeed13ccd1753 Author: SeongJae Park Date: Thu Feb 9 19:20:09 2023 +0000 mm/damon/dbgfs: print DAMON debugfs interface deprecation message DAMON debugfs interface has announced to be deprecated after >v5.15 LTS kernel is released. And, v6.1.y has announced to be an LTS[1]. Though the announcement was there for a while, some people might not noticed that so far. Also, some users could depend on it and have problems at movng to the alternative (DAMON sysfs interface). For such cases, warn DAMON debugfs interface deprecation with contacts to ask helps when any DAMON debugfs interface file is opened. [1] https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=332e9121320bc7461b2d3a79665caf153e51732c [sj@kernel.org: split DAMON debugfs file open warning message, per Randy] Link: https://lkml.kernel.org/r/20230209192009.7885-4-sj@kernel.org Link: https://lkml.kernel.org/r/20230210044838.63723-4-sj@kernel.org Link: https://lkml.kernel.org/r/20230209192009.7885-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 61e88a2f66580d7488bbf7454423c81886d2e8cd Author: SeongJae Park Date: Thu Feb 9 19:20:08 2023 +0000 mm/damon/Kconfig: add DAMON debugfs interface deprecation notice DAMON debugfs interface has announced to be deprecated after >v5.15 LTS kernel is released. And, v6.1.y has announced to be an LTS[1]. Though the announcement was there for a while, some people might not noticed that so far. Also, some users could depend on it and have problems at movng to the alternative (DAMON sysfs interface). For such cases, note DAMON debugfs interface as deprecated, and contacts to ask helps on the Kconfig. [1] https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=332e9121320bc7461b2d3a79665caf153e51732c Link: https://lkml.kernel.org/r/20230209192009.7885-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 5445fcbc4cda770cd07f49624704fabcc284d563 Author: SeongJae Park Date: Thu Feb 9 19:20:07 2023 +0000 Docs/admin-guide/mm/damon/usage: add DAMON debugfs interface deprecation notice Patch series "mm/damon: deprecate DAMON debugfs interface". DAMON debugfs interface has announced to be deprecated after >v5.15 LTS kernel is released. And v6.1.y has been announced to be an LTS[1]. Though the announcement was there for a while, some people might not have noticed that so far. Also, some users could depend on it and have problems at movng to the alternative (DAMON sysfs interface). For such cases, keep the code and documents with warning messages and contacts to ask helps for the deprecation. [1] https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=332e9121320bc7461b2d3a79665caf153e51732c This patch (of 3): DAMON debugfs interface has announced to be deprecated after >v5.15 LTS kernel is released. And, v6.1.y has announced to be an LTS[1]. Though the announcement was there for a while, some people might not noticed that so far. Also, some users could depend on it and have problems at movng to the alternative (DAMON sysfs interface). For such cases, note DAMON debugfs interface as deprecated, and contacts to ask helps on the document. [1] https://git.kernel.org/pub/scm/docs/kernel/website.git/commit/?id=332e9121320bc7461b2d3a79665caf153e51732c Link: https://lkml.kernel.org/r/20230209192009.7885-1-sj@kernel.org Link: https://lkml.kernel.org/r/20230209192009.7885-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 280d724ac20f9cc463d4ab8e2269f598476b070f Author: Vishal Moola (Oracle) Date: Mon Jan 30 13:43:52 2023 -0800 mm/migrate: convert putback_movable_pages() to use folios Removes 6 calls to compound_head(), and replaces putback_movable_page() with putback_movable_folio() as well. Link: https://lkml.kernel.org/r/20230130214352.40538-5-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 19979497c02a365ed9d8276b5f4cc36557a13ced Author: Vishal Moola (Oracle) Date: Mon Jan 30 13:43:51 2023 -0800 mm/migrate: convert isolate_movable_page() to use folios Removes 6 calls to compound_head() and prepares the function to take in a folio instead of page argument. Link: https://lkml.kernel.org/r/20230130214352.40538-4-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit da707a6d184a8a6ef0b756c3ba49888fec223793 Author: Vishal Moola (Oracle) Date: Mon Jan 30 13:43:50 2023 -0800 mm/migrate: add folio_movable_ops() folio_movable_ops() does the same as page_movable_ops() except uses folios instead of pages. This function will help make folio conversions in migrate.c more readable. Link: https://lkml.kernel.org/r/20230130214352.40538-3-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 3c1ea2c729ef8ef07bcb80d01ab2ead45b3406dd Author: Vishal Moola (Oracle) Date: Mon Jan 30 13:43:49 2023 -0800 mm: add folio_get_nontail_page() Patch series "Convert a couple migrate functions to use folios", v2. This patchset introduces folio_movable_ops() and converts 3 functions in mm/migrate.c to use folios. It also introduces folio_get_nontail_page() for folio conversions which may want to distinguish between head and tail pages. This patch (of 4): folio_get_nontail_page() returns the folio associated with a head page. This is necessary for folio conversions where the behavior of that function differs between head pages and tail pages. Link: https://lkml.kernel.org/r/20230130214352.40538-1-vishal.moola@gmail.com Link: https://lkml.kernel.org/r/20230130214352.40538-2-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 4a64981dfee9119aa2c1f243b48f34cbbd67779c Author: Vishal Moola (Oracle) Date: Mon Jan 30 12:18:33 2023 -0800 mm/mempolicy: convert migrate_page_add() to migrate_folio_add() Replace migrate_page_add() with migrate_folio_add(). migrate_folio_add() does the same a migrate_page_add() but takes in a folio instead of a page. This removes a couple of calls to compound_head(). Link: https://lkml.kernel.org/r/20230130201833.27042-7-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Yin Fengwei Cc: David Hildenbrand Cc: Jane Chu Signed-off-by: Andrew Morton commit d451b89dcd183da725eda84dfb8a46c0b32a4234 Author: Vishal Moola (Oracle) Date: Mon Jan 30 12:18:32 2023 -0800 mm/mempolicy: convert queue_pages_required() to queue_folio_required() Replace queue_pages_required() with queue_folio_required(). queue_folio_required() does the same as queue_pages_required(), except takes in a folio instead of a page. Link: https://lkml.kernel.org/r/20230130201833.27042-6-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: David Hildenbrand Cc: Jane Chu Cc: "Yin, Fengwei" Signed-off-by: Andrew Morton commit 0a2c1e8183163a31fe8c9838f3108aacf9c05c4a Author: Vishal Moola (Oracle) Date: Mon Jan 30 12:18:31 2023 -0800 mm/mempolicy: convert queue_pages_hugetlb() to queue_folios_hugetlb() This change is in preparation for the conversion of queue_pages_required() to queue_folio_required() and migrate_page_add() to migrate_folio_add(). Link: https://lkml.kernel.org/r/20230130201833.27042-5-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: David Hildenbrand Cc: Jane Chu Cc: "Yin, Fengwei" Signed-off-by: Andrew Morton commit 3dae02bbd07f40e37bbfec2d77119628db461eaa Author: Vishal Moola (Oracle) Date: Mon Jan 30 12:18:30 2023 -0800 mm/mempolicy: convert queue_pages_pte_range() to queue_folios_pte_range() This function now operates on folios associated with ptes instead of pages. This change is in preparation for the conversion of queue_pages_required() to queue_folio_required() and migrate_page_add() to migrate_folio_add(). Link: https://lkml.kernel.org/r/20230130201833.27042-4-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: David Hildenbrand Cc: Jane Chu Cc: "Yin, Fengwei" Signed-off-by: Andrew Morton commit de1f5055523e9a035b38533f25a56df03d45034a Author: Vishal Moola (Oracle) Date: Mon Jan 30 12:18:29 2023 -0800 mm/mempolicy: convert queue_pages_pmd() to queue_folios_pmd() The function now operates on a folio instead of the page associated with a pmd. This change is in preparation for the conversion of queue_pages_required() to queue_folio_required() and migrate_page_add() to migrate_folio_add(). Link: https://lkml.kernel.org/r/20230130201833.27042-3-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Cc: David Hildenbrand Cc: Jane Chu Cc: "Yin, Fengwei" Signed-off-by: Andrew Morton commit fa4e3f5ffa5e6e22f751d289c9afa502dda30b8d Author: Vishal Moola (Oracle) Date: Mon Jan 30 12:18:28 2023 -0800 mm: add folio_estimated_sharers() Patch series "Convert various mempolicy.c functions to use folios", v4. This patch series converts migrate_page_add() and queue_pages_required() to migrate_folio_add() and queue_page_required(). It also converts the callers of the functions to use folios as well, and introduces a helper function to estimate the number of sharers of a folio. This patch (of 6): folio_estimated_sharers() takes in a folio and returns the precise number of times the first subpage of the folio is mapped. This function aims to provide an estimate for the number of sharers of a folio. This is necessary for folio conversions where we care about the number of processes that share a folio, but don't necessarily want to check every single page within that folio. This is in contrast to folio_mapcount() which calculates the total number of the times a folio and all its subpages are mapped. Link: https://lkml.kernel.org/r/20230130201833.27042-1-vishal.moola@gmail.com Link: https://lkml.kernel.org/r/20230130201833.27042-2-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Reviewed-by: Yin Fengwei Acked-by: David Hildenbrand Cc: Jane Chu Signed-off-by: Andrew Morton commit 192a50220342f82826812d0032a82fe441e924e2 Author: Sidhartha Kumar Date: Wed Jan 25 09:05:37 2023 -0800 Documentation/mm: update hugetlbfs documentation to mention alloc_hugetlb_folio Link: https://lkml.kernel.org/r/20230125170537.96973-9-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Cc: Gerald Schaefer Cc: John Hubbard Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit 371607a3c793d7183b0faecc1fb4aa88fadcf202 Author: Sidhartha Kumar Date: Wed Jan 25 09:05:36 2023 -0800 mm/hugetlb: convert hugetlb_wp() to take in a folio Change the pagecache_page argument of hugetlb_wp to pagecache_folio. Replaces a call to find_lock_page() with filemap_lock_folio(). Link: https://lkml.kernel.org/r/20230125170537.96973-8-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reported-by: gerald.schaefer@linux.ibm.com Cc: John Hubbard Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit 9b91c0e277a3dbb165c2e4301be7a231dc2f76f7 Author: Sidhartha Kumar Date: Wed Jan 25 09:05:35 2023 -0800 mm/hugetlb: convert hugetlb_add_to_page_cache to take in a folio Every caller of hugetlb_add_to_page_cache() is now passing in &folio->page, change the function to take in a folio directly and clean up the call sites. Link: https://lkml.kernel.org/r/20230125170537.96973-7-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Cc: Gerald Schaefer Cc: John Hubbard Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit d2d7bb44bfbd29200426ba17741550d36e081f91 Author: Sidhartha Kumar Date: Wed Jan 25 09:05:34 2023 -0800 mm/hugetlb: convert restore_reserve_on_error to take in a folio Every caller of restore_reserve_on_error() is now passing in &folio->page, change the function to take in a folio directly and clean up the call sites. Link: https://lkml.kernel.org/r/20230125170537.96973-6-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Cc: Gerald Schaefer Cc: John Hubbard Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit d0ce0e47b323a8d7fb5dc3314ce56afa650ade2d Author: Sidhartha Kumar Date: Wed Jan 25 09:05:33 2023 -0800 mm/hugetlb: convert hugetlb fault paths to use alloc_hugetlb_folio() Change alloc_huge_page() to alloc_hugetlb_folio() by changing all callers to handle the now folio return type of the function. In this conversion, alloc_huge_page_vma() is also changed to alloc_hugetlb_folio_vma() and hugepage_add_new_anon_rmap() is changed to take in a folio directly. Many additions of '&folio->page' are cleaned up in subsequent patches. hugetlbfs_fallocate() is also refactored to use the RCU + page_cache_next_miss() API. Link: https://lkml.kernel.org/r/20230125170537.96973-5-sidhartha.kumar@oracle.com Suggested-by: Mike Kravetz Reported-by: kernel test robot Signed-off-by: Sidhartha Kumar Cc: Gerald Schaefer Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit ea8e72f4116a995c2aba3fb738ac372c4115375a Author: Sidhartha Kumar Date: Wed Jan 25 09:05:32 2023 -0800 mm/hugetlb: convert putback_active_hugepage to take in a folio Convert putback_active_hugepage() to folio_putback_active_hugetlb(), this removes one user of the Huge Page macros which take in a page. The callers in migrate.c are also cleaned up by being able to directly use the src and dst folio variables. Link: https://lkml.kernel.org/r/20230125170537.96973-4-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: Gerald Schaefer Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit 91a2fb956ad993f3cbcfc632611e17e3699fb652 Author: Sidhartha Kumar Date: Wed Jan 25 09:05:31 2023 -0800 mm/hugetlb: convert hugetlbfs_pagecache_present() to folios Refactor hugetlbfs_pagecache_present() to avoid getting and dropping a refcount on a page. Use RCU and page_cache_next_miss() instead. Link: https://lkml.kernel.org/r/20230125170537.96973-3-sidhartha.kumar@oracle.com Suggested-by: Matthew Wilcox Signed-off-by: Sidhartha Kumar Cc: Gerald Schaefer Cc: John Hubbard Cc: kernel test robot Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit ea4c353df37750d170dc0dcbfa8c47c984779733 Author: Sidhartha Kumar Date: Wed Jan 25 09:05:30 2023 -0800 mm/hugetlb: convert hugetlb_install_page to folios Patch series "convert hugetlb fault functions to folios", v2. This series converts the hugetlb page faulting functions to operate on folios. These include hugetlb_no_page(), hugetlb_wp(), copy_hugetlb_page_range(), and hugetlb_mcopy_atomic_pte(). This patch (of 8): Change hugetlb_install_page() to hugetlb_install_folio(). This reduces one user of the Huge Page flag macros which take in a page. Link: https://lkml.kernel.org/r/20230125170537.96973-1-sidhartha.kumar@oracle.com Link: https://lkml.kernel.org/r/20230125170537.96973-2-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: Gerald Schaefer Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit bdd7be075acb650cc57d8ee752b5375b966ad07e Author: Sidhartha Kumar Date: Fri Jan 13 16:30:57 2023 -0600 mm/hugetlb: convert demote_free_huge_page to folios Change demote_free_huge_page to demote_free_hugetlb_folio() and change demote_pool_huge_page() pass in a folio. Link: https://lkml.kernel.org/r/20230113223057.173292-9-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Cc: John Hubbard Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit 0ffdc38eb564c1c71a58bbaf874945ba54293ff9 Author: Sidhartha Kumar Date: Fri Jan 13 16:30:56 2023 -0600 mm/hugetlb: convert restore_reserve_on_error() to folios Use the hugetlb folio flag macros inside restore_reserve_on_error() and update the comments to reflect the use of folios. Link: https://lkml.kernel.org/r/20230113223057.173292-8-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit e37d3e838d9078538f920957d1e89682b6764977 Author: Sidhartha Kumar Date: Fri Jan 13 16:30:55 2023 -0600 mm/hugetlb: convert alloc_migrate_huge_page to folios Change alloc_huge_page_nodemask() to alloc_hugetlb_folio_nodemask() and alloc_migrate_huge_page() to alloc_migrate_hugetlb_folio(). Both functions now return a folio rather than a page. Link: https://lkml.kernel.org/r/20230113223057.173292-7-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit ff7d853b031302376a0d3640fa1c463d94079637 Author: Sidhartha Kumar Date: Fri Jan 13 16:30:54 2023 -0600 mm/hugetlb: increase use of folios in alloc_huge_page() Change hugetlb_cgroup_commit_charge{,_rsvd}(), dequeue_huge_page_vma() and alloc_buddy_huge_page_with_mpol() to use folios so alloc_huge_page() is cleaned by operating on folios until its return. Link: https://lkml.kernel.org/r/20230113223057.173292-6-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit 3a740e8bb56ef7ee6b9098b694caabab843be067 Author: Sidhartha Kumar Date: Fri Jan 13 16:30:53 2023 -0600 mm/hugetlb: convert alloc_surplus_huge_page() to folios Change alloc_surplus_huge_page() to alloc_surplus_hugetlb_folio() and update its callers. Link: https://lkml.kernel.org/r/20230113223057.173292-5-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit a36f1e9024740c3820427afca4cd375e32a1bb15 Author: Sidhartha Kumar Date: Fri Jan 13 16:30:52 2023 -0600 mm/hugetlb: convert dequeue_hugetlb_page functions to folios dequeue_huge_page_node_exact() is changed to dequeue_hugetlb_folio_node_ exact() and dequeue_huge_page_nodemask() is changed to dequeue_hugetlb_ folio_nodemask(). Update their callers to pass in a folio. Link: https://lkml.kernel.org/r/20230113223057.173292-4-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Cc: John Hubbard Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit 6f6956cf7e6a3034f61780446547e849aa4e216d Author: Sidhartha Kumar Date: Fri Jan 13 16:30:51 2023 -0600 mm/hugetlb: convert __update_and_free_page() to folios Change __update_and_free_page() to __update_and_free_hugetlb_folio() by changing its callers to pass in a folio. Link: https://lkml.kernel.org/r/20230113223057.173292-3-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: John Hubbard Cc: Matthew Wilcox Cc: Muchun Song Signed-off-by: Andrew Morton commit 6aa3a920125e9f58891e2b5dc2efd4d0c1ff05a6 Author: Sidhartha Kumar Date: Fri Jan 13 16:30:50 2023 -0600 mm/hugetlb: convert isolate_hugetlb to folios Patch series "continue hugetlb folio conversion", v3. This series continues the conversion of core hugetlb functions to use folios. This series converts many helper funtions in the hugetlb fault path. This is in preparation for another series to convert the hugetlb fault code paths to operate on folios. This patch (of 8): Convert isolate_hugetlb() to take in a folio and convert its callers to pass a folio. Use page_folio() to convert the callers to use a folio is safe as isolate_hugetlb() operates on a head page. Link: https://lkml.kernel.org/r/20230113223057.173292-1-sidhartha.kumar@oracle.com Link: https://lkml.kernel.org/r/20230113223057.173292-2-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Mike Kravetz Cc: John Hubbard Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Muchun Song Signed-off-by: Andrew Morton commit f528260b1a7d52140dfeb58857e13fc98ac193ef Author: Vishal Moola (Oracle) Date: Mon Feb 13 13:43:24 2023 -0800 mm/khugepaged: fix invalid page access in release_pte_pages() release_pte_pages() converts from a pfn to a folio by using pfn_folio(). If the pte is not mapped, pfn_folio() will result in undefined behavior which ends up causing a kernel panic[1]. Only call pfn_folio() once we have validated that the pte is both valid and mapped to fix the issue. [1] https://lore.kernel.org/linux-mm/ff300770-afe9-908d-23ed-d23e0796e899@samsung.com/ Link: https://lkml.kernel.org/r/20230213214324.34215-1-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Fixes: 9bdfeea46f49 ("mm/khugepaged: convert release_pte_pages() to use folios") Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Debugged-by: Alexandre Ghiti Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit aca5a0944c309c56267b0c1d001aa999ddb2fb1e Author: Shuah Khan Date: Mon Feb 13 14:52:47 2023 -0700 selftests/mount_setattr: fix to make run_tests failure make run_tests doesn't run the test. Fix Makefile to set TEST_GEN_PROGS instead of TEST_GEN_FILES to fix the problem. run_tests runs TEST_GEN_PROGS, TEST_CUSTOM_PROGS, and TEST_PROGS. TEST_GEN_FILES is for files generated by tests. Signed-off-by: Shuah Khan commit d8e45bf1aed2e5fddd8985b5bb1aaf774a97aba8 Author: Shuah Khan Date: Mon Feb 13 11:20:07 2023 -0700 selftests/mount_setattr: fix redefine struct mount_attr build error Fix the following build error due to redefining struct mount_attr by removing duplicate define from mount_setattr_test.c gcc -g -isystem .../tools/testing/selftests/../../../usr/include -Wall -O2 -pthread mount_setattr_test.c -o .../tools/testing/selftests/mount_setattr/mount_setattr_test mount_setattr_test.c:107:8: error: redefinition of ‘struct mount_attr’ 107 | struct mount_attr { | ^~~~~~~~~~ In file included from /usr/include/x86_64-linux-gnu/sys/mount.h:32, from mount_setattr_test.c:10: .../usr/include/linux/mount.h:129:8: note: originally defined here 129 | struct mount_attr { | ^~~~~~~~~~ make: *** [../lib.mk:145: .../tools/testing/selftests/mount_setattr/mount_setattr_test] Error 1 Signed-off-by: Shuah Khan commit a7151a8eaa292933cc934deb1dda0f5f51114c82 Author: Shuah Khan Date: Mon Feb 13 10:21:43 2023 -0700 selftests/sched: fix warn_unused_result build warns Fix the following warns by adding return check and error handling. gcc -O2 -Wall -g -I./ -isystem .../tools/testing/selftests/../../../usr/include -Wl,-rpath=./ cs_prctl_test.c -lpthread -o .../tools/testing/selftests/sched/cs_prctl_test cs_prctl_test.c: In function ‘create_processes’: cs_prctl_test.c:187:17: warning: ignoring return value of ‘read’ declared with attribute ‘warn_unused_result’ [-Wunused-result] 187 | read(proc[i].pfd[0], &proc[i].thr_tids, sizeof(int) * proc[i].num_threads); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cs_prctl_test.c: In function ‘child_func_process’: cs_prctl_test.c:159:9: warning: ignoring return value of ‘write’ declared with attribute ‘warn_unused_result’ [-Wunused-result] 159 | write(ca->pfd[1], &ca->thr_tids, sizeof(int) * ca->num_threads); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Shuah Khan commit b75a52b0dda353aeefb4830a320589a363f49579 Author: Shawn Lin Date: Thu Feb 2 08:35:16 2023 +0800 mmc: sdhci-of-dwcmshc: Update DLL and pre-change delay for rockchip platform For Rockchip platform, DLL bypass bit and start bit need to be set if DLL is not locked. And adjust pre-change delay to 0x3 for better signal test result. Signed-off-by: Shawn Lin Link: https://lore.kernel.org/r/1675298118-64243-2-git-send-email-shawn.lin@rock-chips.com Signed-off-by: Ulf Hansson commit 0d3b2b4d2364166a955d03407ddace9269c603a5 Merge: 022d3f0800682 3fb901cdc9e4a Author: Oliver Upton Date: Mon Feb 13 23:33:41 2023 +0000 Merge branch kvm-arm64/nv-prefix into kvmarm/next * kvm-arm64/nv-prefix: : Preamble to NV support, courtesy of Marc Zyngier. : : This brings in a set of prerequisite patches for supporting nested : virtualization in KVM/arm64. Of course, there is a long way to go until : NV is actually enabled in KVM. : : - Introduce cpucap / vCPU feature flag to pivot the NV code on : : - Add support for EL2 vCPU register state : : - Basic nested exception handling : : - Hide unsupported features from the ID registers for NV-capable VMs KVM: arm64: nv: Use reg_to_encoding() to get sysreg ID KVM: arm64: nv: Only toggle cache for virtual EL2 when SCTLR_EL2 changes KVM: arm64: nv: Filter out unsupported features from ID regs KVM: arm64: nv: Emulate EL12 register accesses from the virtual EL2 KVM: arm64: nv: Allow a sysreg to be hidden from userspace only KVM: arm64: nv: Emulate PSTATE.M for a guest hypervisor KVM: arm64: nv: Add accessors for SPSR_EL1, ELR_EL1 and VBAR_EL1 from virtual EL2 KVM: arm64: nv: Handle SMCs taken from virtual EL2 KVM: arm64: nv: Handle trapped ERET from virtual EL2 KVM: arm64: nv: Inject HVC exceptions to the virtual EL2 KVM: arm64: nv: Support virtual EL2 exceptions KVM: arm64: nv: Handle HCR_EL2.NV system register traps KVM: arm64: nv: Add nested virt VCPU primitives for vEL2 VCPU state KVM: arm64: nv: Add EL2 system registers to vcpu context KVM: arm64: nv: Allow userspace to set PSR_MODE_EL2x KVM: arm64: nv: Reset VCPU to EL2 registers if VCPU nested virt is set KVM: arm64: nv: Introduce nested virtualization VCPU feature KVM: arm64: Use the S2 MMU context to iterate over S2 table arm64: Add ARM64_HAS_NESTED_VIRT cpufeature Signed-off-by: Oliver Upton commit 022d3f0800682f84e1437ad2a2f6fb85fc94abf6 Merge: e4f7417e9680a 67d953d4d7bec Author: Oliver Upton Date: Mon Feb 13 23:32:59 2023 +0000 Merge branch kvm-arm64/misc into kvmarm/next * kvm-arm64/misc: : Miscellaneous updates : : - Convert CPACR_EL1_TTA to the new, generated system register : definitions. : : - Serialize toggling CPACR_EL1.SMEN to avoid unexpected exceptions when : accessing SVCR in the host. : : - Avoid quiescing the guest if a vCPU accesses its own redistributor's : SGIs/PPIs, eliminating the need to IPI. Largely an optimization for : nested virtualization, as the L1 accesses the affected registers : rather often. : : - Conversion to kstrtobool() : : - Common definition of INVALID_GPA across architectures : : - Enable CONFIG_USERFAULTFD for CI runs of KVM selftests KVM: arm64: Fix non-kerneldoc comments KVM: selftests: Enable USERFAULTFD KVM: selftests: Remove redundant setbuf() arm64/sysreg: clean up some inconsistent indenting KVM: MMU: Make the definition of 'INVALID_GPA' common KVM: arm64: vgic-v3: Use kstrtobool() instead of strtobool() KVM: arm64: vgic-v3: Limit IPI-ing when accessing GICR_{C,S}ACTIVER0 KVM: arm64: Synchronize SMEN on vcpu schedule out KVM: arm64: Kill CPACR_EL1_TTA definition Signed-off-by: Oliver Upton commit e4f7417e9680a281a77f0328f1b835557a558b58 Merge: 3f1a14af5e17a ad818e6010ef1 Author: Oliver Upton Date: Mon Feb 13 23:31:23 2023 +0000 Merge branch kvm-arm64/apple-vgic-mi into kvmarm/next * kvm-arm64/apple-vgic-mi: : VGIC maintenance interrupt support for the AIC, courtesy of Marc Zyngier. : : The AIC provides a non-maskable VGIC maintenance interrupt, which until : now was not supported by KVM. This series (1) allows the registration of : a non-maskable maintenance interrupt and (2) wires in support for this : with the AIC driver. irqchip/apple-aic: Correctly map the vgic maintenance interrupt irqchip/apple-aic: Register vgic maintenance interrupt with KVM KVM: arm64: vgic: Allow registration of a non-maskable maintenance interrupt Signed-off-by: Oliver Upton commit 3f1a14af5e17a8d03b2db2085861da68c8405ee3 Merge: 1b915210d9bed 6f10f2ec61c79 Author: Oliver Upton Date: Mon Feb 13 23:30:37 2023 +0000 Merge branch kvm-arm64/psci-relay-fixes into kvmarm/next * kvm-arm64/psci-relay-fixes: : Fixes for CPU on/resume with pKVM, courtesy Quentin Perret. : : A consequence of deprivileging the host is that pKVM relays PSCI calls : on behalf of the host. pKVM's CPU initialization failed to fully : initialize the CPU's EL2 state, which notably led to unexpected SVE : traps resulting in a hyp panic. : : The issue is addressed by reusing parts of __finalise_el2 to restore CPU : state in the PSCI relay. KVM: arm64: Finalise EL2 state from pKVM PSCI relay KVM: arm64: Use sanitized values in __check_override in nVHE KVM: arm64: Introduce finalise_el2_state macro KVM: arm64: Provide sanitized SYS_ID_AA64SMFR0_EL1 to nVHE commit 152b5245e361f9493d930a1aaa51c932e3dff660 Author: Paul Cercueil Date: Tue Jan 31 21:02:29 2023 +0000 mmc: jz4740: Add support for vqmmc power supply Support enabling / disabling the vqmmc power supply if it was provided by the firmware. Provide the .start_signal_voltage_switch callback to change the voltage of the external vqmmc power supply. Signed-off-by: Paul Cercueil Link: https://lore.kernel.org/r/20230131210229.68129-2-paul@crapouillou.net Signed-off-by: Ulf Hansson commit 1b915210d9bed44512f6034eacda9e8dcd89bd93 Merge: 073988eb3247a ba82e06cf7f46 Author: Oliver Upton Date: Mon Feb 13 23:26:21 2023 +0000 Merge branch kvm-arm64/nv-timer-improvements into kvmarm/next * kvm-arm64/nv-timer-improvements: : Timer emulation improvements, courtesy of Marc Zyngier. : : - Avoid re-arming an hrtimer for a guest timer that is already pending : : - Only reload the affected timer context when emulating a sysreg access : instead of both the virtual/physical timers. KVM: arm64: timers: Don't BUG() on unhandled timer trap KVM: arm64: Reduce overhead of trapped timer sysreg accesses KVM: arm64: Don't arm a hrtimer for an already pending timer Signed-off-by: Oliver Upton commit 073988eb3247a4fd9ddefb3ae12e655359ce19cb Merge: 52b603628a2c0 960c3028a1d52 Author: Oliver Upton Date: Mon Feb 13 23:25:50 2023 +0000 Merge branch kvm-arm64/MAINTAINERS into kvmarm/next * kvm-arm64/MAINTAINERS: : KVM/arm64 MAINTAINERS updates : : - Drop the old columbia.edu mailing list (you will be missed!) : : - Move Oliver up to co-maintainer w/ Marc KVM: arm64: Drop Columbia-hosted mailing list MAINTAINERS: Add Oliver Upton as co-maintainer of KVM/arm64 Signed-off-by: Oliver Upton commit fe3e137c6d7106d67f37cb76781b90f90a4e988f Merge: 565e46842489b 3f18c5046e633 Author: Ulf Hansson Date: Tue Feb 14 00:19:41 2023 +0100 mmc: Merge branch fixes into next Merge the mmc fixes for v6.2-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.3. Signed-off-by: Ulf Hansson commit 565e46842489bf27d5da2ac7061241d7254fc9a7 Author: Jonathan Neuschäfer Date: Sun Jan 29 14:00:59 2023 +0100 dt-bindings: mmc: fsl-imx-esdhc: Improve grammar and fix a typo This makes the text read a little better. Signed-off-by: Jonathan Neuschäfer Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230129130059.1322858-1-j.neuschaefer@gmx.net Signed-off-by: Ulf Hansson commit 418f7c2de1334b70fbee790911a1b46503230137 Author: Heiner Kallweit Date: Sat Feb 4 00:54:48 2023 +0100 mmc: meson-gx: use devm_mmc_alloc_host Use new function devm_mmc_alloc_host() to simplify the code. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/728f159b-885f-c78a-1a3d-f55c245250e1@gmail.com Signed-off-by: Ulf Hansson commit 80df83c2c57e75cb482ccf0c639ce84703ab41a2 Author: Heiner Kallweit Date: Sat Feb 4 00:53:35 2023 +0100 mmc: core: add devm_mmc_alloc_host Add a device-managed version of mmc_alloc_host(). The argument order is reversed compared to mmc_alloc_host() because device-managed functions typically have the device argument first. Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/6d8f9fdc-7c9e-8e4f-e6ef-5470b971c74e@gmail.com Signed-off-by: Ulf Hansson commit 9d8ba74a181b1c81def21168795ed96cbe6f05ed Author: Geert Uytterhoeven Date: Fri Feb 10 14:46:39 2023 +0100 PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xc3a34e00 (size 64): comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s) hex dump (first 32 bytes): b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...].......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] __kmalloc+0xf0/0x140 [<34bd6bc0>] resource_list_create_entry+0x18/0x38 [<767046bc>] pci_add_resource_offset+0x20/0x68 [] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390 When coalescing two resources for a contiguous aperture, the second resource is enlarged to cover the full contiguous range, while the first resource is marked invalid. This invalidation is done by clearing the flags, start, and end members. When adding the initial resources to the bus later, invalid resources are skipped. Unfortunately, the check for an invalid resource considers only the end member, causing false positives. E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no longer registered with pci_bus_insert_busn_res() (causing the memory leak), nor printed: pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges: pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000 pci-rcar-gen2 ee090000.pci: PCI: revision 11 pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00 -pci_bus 0000:00: root bus resource [bus 00] pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff] Fix this by only skipping resources where all of the flags, start, and end members are zero. Fixes: 7c3855c423b17f6c ("PCI: Coalesce host bridge contiguous apertures") Link: https://lore.kernel.org/r/da0fcd5e86c74239be79c7cb03651c0fce31b515.1676036673.git.geert+renesas@glider.be Tested-by: Niklas Schnelle Signed-off-by: Geert Uytterhoeven Signed-off-by: Bjorn Helgaas Acked-by: Kai-Heng Feng commit 52b603628a2c06be38648aa025daa81e4355a7fc Merge: e8789ab7047a8 1dfc3e905089a Author: Oliver Upton Date: Mon Feb 13 22:33:10 2023 +0000 Merge branch kvm-arm64/parallel-access-faults into kvmarm/next * kvm-arm64/parallel-access-faults: : Parallel stage-2 access fault handling : : The parallel faults changes that went in to 6.2 covered most stage-2 : aborts, with the exception of stage-2 access faults. Building on top of : the new infrastructure, this series adds support for handling access : faults (i.e. updating the access flag) in parallel. : : This is expected to provide a performance uplift for cores that do not : implement FEAT_HAFDBS, such as those from the fruit company. KVM: arm64: Condition HW AF updates on config option KVM: arm64: Handle access faults behind the read lock KVM: arm64: Don't serialize if the access flag isn't set KVM: arm64: Return EAGAIN for invalid PTE in attr walker KVM: arm64: Ignore EAGAIN for walks outside of a fault KVM: arm64: Use KVM's pte type/helpers in handle_access_fault() Signed-off-by: Oliver Upton commit e8789ab7047a824fa415948d511634fea0c3aea3 Merge: 619cec00857f2 5f623a598d128 Author: Oliver Upton Date: Mon Feb 13 22:32:14 2023 +0000 Merge branch kvm-arm64/virtual-cache-geometry into kvmarm/next * kvm-arm64/virtual-cache-geometry: : Virtualized cache geometry for KVM guests, courtesy of Akihiko Odaki. : : KVM/arm64 has always exposed the host cache geometry directly to the : guest, even though non-secure software should never perform CMOs by : Set/Way. This was slightly wrong, as the cache geometry was derived from : the PE on which the vCPU thread was running and not a sanitized value. : : All together this leads to issues migrating VMs on heterogeneous : systems, as the cache geometry saved/restored could be inconsistent. : : KVM/arm64 now presents 1 level of cache with 1 set and 1 way. The cache : geometry is entirely controlled by userspace, such that migrations from : older kernels continue to work. KVM: arm64: Mark some VM-scoped allocations as __GFP_ACCOUNT KVM: arm64: Normalize cache configuration KVM: arm64: Mask FEAT_CCIDX KVM: arm64: Always set HCR_TID2 arm64/cache: Move CLIDR macro definitions arm64/sysreg: Add CCSIDR2_EL1 arm64/sysreg: Convert CCSIDR_EL1 to automatic generation arm64: Allow the definition of UNKNOWN system register fields Signed-off-by: Oliver Upton commit 619cec00857f21dbc6db5ef9e0b9c613479f3745 Merge: 92425e058ab6a 9442d05bba6c1 Author: Oliver Upton Date: Mon Feb 13 22:30:07 2023 +0000 Merge branch arm64/for-next/sme2 into kvmarm/next Merge the SME2 branch to fix up a rather annoying conflict due to the EL2 finalization refactor. Signed-off-by: Oliver Upton commit 92425e058ab6ab1a4c4a9d384d2d86b810f57e23 Merge: 5dc4c995db9eb 9f1a4c004869d Author: Oliver Upton Date: Mon Feb 13 22:28:30 2023 +0000 Merge branch kvm/kvm-hw-enable-refactor into kvmarm/next Merge the kvm_init() + hardware enable rework to avoid conflicts with kvmarm. Signed-off-by: Oliver Upton commit f5edd8715e2ea672e6119c3764041743761fb178 Author: Manivannan Sadhasivam Date: Tue Jan 24 12:41:58 2023 +0530 PCI: endpoint: Use link_up() callback in place of LINK_UP notifier As a part of the transition towards callback mechanism for signalling the events from EPC to EPF, let's use the link_up() callback in the place of the LINK_UP notifier. This also removes the notifier support completely from the PCI endpoint framework. Link: https://lore.kernel.org/linux-pci/20230124071158.5503-6-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Acked-by: Kishon Vijay Abraham I commit 838125b07e7706b1a9069079a73507fd3df244f7 Author: Manivannan Sadhasivam Date: Tue Jan 24 12:41:57 2023 +0530 PCI: endpoint: Use callback mechanism for passing events from EPC to EPF Instead of using the notifiers for passing the events from EPC to EPF, let's introduce a callback based mechanism where the EPF drivers can populate relevant callbacks for EPC events they want to subscribe. The use of notifiers in kernel is not recommended if there is a real link between the sender and receiver, like in this case. Also, the existing atomic notifier forces the notification functions to be in atomic context while the caller may be in non-atomic context. For instance, the two in-kernel users of the notifiers, pcie-qcom and pcie-tegra194, both are calling the notifier functions in non-atomic context (from threaded IRQ handlers). This creates a sleeping in atomic context issue with the existing EPF_TEST driver that calls the EPC APIs that may sleep. For all these reasons, let's get rid of the notifier chains and use the simple callback mechanism for signalling the events from EPC to EPF drivers. This preserves the context of the caller and avoids the latency of going through a separate interface for triggering the notifications. As a first step of the transition, the core_init() callback is introduced in this commit, that'll replace the existing CORE_INIT notifier used for signalling the init complete event from EPC. During the occurrence of the event, EPC will go over the list of EPF drivers attached to it and will call the core_init() callback if available. Link: https://lore.kernel.org/linux-pci/20230124071158.5503-5-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Acked-by: Kishon Vijay Abraham I commit d6dd5bafaabf98a99a76227ab8dc9a89e76a198f Author: Manivannan Sadhasivam Date: Tue Jan 24 12:41:56 2023 +0530 PCI: endpoint: Use a separate lock for protecting epc->pci_epf list The EPC controller maintains a list of EPF drivers added to it. For protecting this list against the concurrent accesses, the epc->lock (used for protecting epc_ops) has been used so far. Since there were no users trying to use epc_ops and modify the pci_epf list simultaneously, this was not an issue. But with the addition of callback mechanism for passing the events, this will be a problem. Because the pci_epf list needs to be iterated first for getting hold of the EPF driver and then the relevant event specific callback needs to be called for the driver. If the same epc->lock is used, then it will result in a deadlock scenario. For instance, ... mutex_lock(&epc->lock); list_for_each_entry(epf, &epc->pci_epf, list) { epf->event_ops->core_init(epf); | |-> pci_epc_set_bar(); | |-> mutex_lock(&epc->lock) # DEADLOCK ... So to fix this issue, use a separate lock called "list_lock" for protecting the pci_epf list against the concurrent accesses. This lock will also be used by the callback mechanism. Link: https://lore.kernel.org/linux-pci/20230124071158.5503-4-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Acked-by: Kishon Vijay Abraham I commit c2cc5cdda46c0a94ff82bf61016ada2e120f1a3f Author: Manivannan Sadhasivam Date: Tue Jan 24 12:41:55 2023 +0530 PCI: tegra194: Move dw_pcie_ep_linkup() to threaded IRQ handler dw_pcie_ep_linkup() may take more time to execute depending on the EPF driver implementation. Calling this API in the hard IRQ handler is not encouraged since the hard IRQ handlers are supposed to complete quickly. So move the dw_pcie_ep_linkup() call to threaded IRQ handler. Link: https://lore.kernel.org/linux-pci/20230124071158.5503-3-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Reviewed-by: Vidya Sagar commit da87d35a6e51480703d6f055e7a1b52c85731d7e Author: Manivannan Sadhasivam Date: Tue Jan 24 12:41:54 2023 +0530 PCI: dra7xx: Use threaded IRQ handler for "dra7xx-pcie-main" IRQ The "dra7xx-pcie-main" hard IRQ handler is just printing the IRQ status and calling the dw_pcie_ep_linkup() API if LINK_UP status is set. But the execution of dw_pcie_ep_linkup() depends on the EPF driver and may take more time depending on the EPF implementation. In general, hard IRQ handlers are supposed to return quickly and not block for so long. Moreover, there is no real need of the current IRQ handler to be a hard IRQ handler. So switch to the threaded IRQ handler for the "dra7xx-pcie-main" IRQ. Link: https://lore.kernel.org/linux-pci/20230124071158.5503-2-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Krzysztof Wilczyński Acked-by: Kishon Vijay Abraham I commit 407ef897bd0275e38ae33d410857e71c092679bd Author: Krzysztof Kozlowski Date: Wed Feb 8 11:15:41 2023 +0100 arm64: dts: qcom: msm8996: align RPM G-Link clock-controller node with bindings qcom,rpmcc bindings expect RPM clock controller to be named generic "clock-controller": rpm-glink: rpm-requests: 'qcom,rpmcc' does not match any of the regexes: '^regulators(-[01])?$', 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230208101545.45711-3-krzysztof.kozlowski@linaro.org commit 7bf30eb441b3bdaa368e65837a03f9fbba033180 Author: Krzysztof Kozlowski Date: Wed Feb 8 11:15:40 2023 +0100 arm64: dts: qcom: qcs404: align RPM G-Link node with bindings Bindings expect (and most of DTS use) the RPM G-Link node name to be "rpm-requests". Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230208101545.45711-2-krzysztof.kozlowski@linaro.org commit 679ee73bbee28cab441008f8cca38160cc8f3d05 Author: Krzysztof Kozlowski Date: Wed Feb 8 11:15:39 2023 +0100 arm64: dts: qcom: ipq6018: align RPM G-Link node with bindings Bindings expect (and most of DTS use) the RPM G-Link node name to be "rpm-requests". Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230208101545.45711-1-krzysztof.kozlowski@linaro.org commit 687bcd03a047e65fcf12ae2b693043ee44acad4c Author: Bartosz Golaszewski Date: Thu Feb 9 11:35:31 2023 +0100 arm64: defconfig: enable drivers required by the Qualcomm SA8775P platform Enable the pinctrl, GCC clock and interconnect drivers in order to allow booting SA8775P boards. The drivers need to be built-in for QUPv3 and subsequently UART console to work. Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Reviewed-by: Eric Chanudet Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209103531.469809-1-brgl@bgdev.pl commit 26e95ff8a912fd787a65ae1ae4cc4684f5f84fce Author: Neil Armstrong Date: Thu Feb 9 09:44:43 2023 +0100 arm64: dts: qcom: sm8550: remove invalid interconnect property from cryptobam The interconnect property is already present in the qce node, which is the consumer of the cryptobam, so no need for an interconnect property as documented by the bindings. Fixes: 433477c3bf0b ("arm64: dts: qcom: sm8550: add QCrypto nodes") Suggested-by: Bhupesh Sharma Signed-off-by: Neil Armstrong Acked-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209-topic-sm8550-upstream-cryptobam-remove-interconnect-v1-1-84587c7bad0f@linaro.org commit f15c1b1bd3c2b3a688d1139593be6c620bb9af6f Author: Owen Yang Date: Mon Feb 13 10:59:05 2023 +0800 arm64: dts: qcom: sc7280: Adjust zombie PWM frequency Tune the PWM to solve screen flashing issue and high frequency noise. While at it, the comment for the PWM settings incorrectly said we were using a 5kHz duty cycle. It should have said "period", not "duty cycle". Correct this while updating the values. Signed-off-by: Owen Yang Reviewed-by: Douglas Anderson Reviewed-by: Matthias Kaehlcke Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213105803.v2.1.I610cef0ead2d5df1f7bd18bc0e0ae040b03725d0@changeid commit 2d5cab9232ba6bac734186f3e74fb106793bc738 Author: Manivannan Sadhasivam Date: Mon Feb 13 14:31:18 2023 +0530 arm64: dts: qcom: sc8280xp-pmics: Specify interrupt parent explicitly Nodes like pwrkey, resin, iadc, adc-tm, temp-alarm which are the grand children of spmi_bus node represent the interrupt generating devices but don't have "interrupt-parent" property. As per the devicetree spec v0.3, section 2.4: "The physical wiring of an interrupt source to an interrupt controller is represented in the devicetree with the interrupt-parent property. Nodes that represent interrupt-generating devices contain an interrupt-parent property which has a phandle value that points to the device to which the device’s interrupts are routed, typically an interrupt controller. If an interrupt-generating device does not have an interrupt-parent property, its interrupt parent is assumed to be its devicetree parent." This clearly says that if the "interrupt-parent" property is absent, then the immediate devicetree parent will be assumed as the interrupt parent. But the immediate parents of these nodes are not interrupt controllers themselves. This may lead to failure while wiring the interrupt for these nodes by an operating system. But a few operating systems like Linux, workaround this issue by walking up the parent nodes until it finds the "interrupt-cells" property. Then the node that has the "interrupt-cells" property will be used as the interrupt parent. But this workaround is not as per the DT spec and is not being implemented by other operating systems such as OpenBSD. Hence, fix this issue by adding the "interrupts-extended" property that explicitly specifies the spmi_bus node as the interrupt parent. Note that the "interrupts-extended" property is chosen over "interrupt-parent" as it allows specifying both interrupt parent phandle and interrupt specifiers in a single property. Reported-by: Patrick Wildt Signed-off-by: Manivannan Sadhasivam Reviewed-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213090118.11527-1-manivannan.sadhasivam@linaro.org commit 574f2ffd45dc786dc443c5e11ea477420ffa5f52 Author: Luca Weiss Date: Mon Feb 13 15:46:31 2023 +0100 arm64: dts: qcom: sm7225-fairphone-fp4: enable remaining i2c busses Enable all i2c busses where something is connected on this phone. Add comments as placeholders for which components are still missing. Also enable gpi_dma and the other qupv3 for that. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213-fp4-more-i2c-v2-2-1c459c572f80@fairphone.com commit 65aedb0b48c09595065c81722d9cca53760f7220 Author: Luca Weiss Date: Mon Feb 13 15:46:30 2023 +0100 arm64: dts: qcom: sm7225-fairphone-fp4: move status property down Currently the dts contains a mix of status-as-first-property (old qcom style) and status-as-last-property (new style). Move all status properties down to the bottom once and for all so that the style is consistent between different nodes. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213-fp4-more-i2c-v2-1-1c459c572f80@fairphone.com commit c0ee8e0ba5cc17623e63349a168b41e407b1eef0 Author: Konrad Dybcio Date: Mon Feb 13 22:29:30 2023 +0100 arm64: dts: qcom: pmk8350: Use the correct PON compatible A special compatible was introduced for PMK8350 both in the driver and the bindings to facilitate for 2 base registers (PBS & HLOS). Use it. Fixes: b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for pmk8350") Signed-off-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213212930.2115182-1-konrad.dybcio@linaro.org commit 85d81e15862a95d1a0de5a60f5ac8caba7068b9b Author: Bjorn Andersson Date: Mon Feb 13 13:56:19 2023 -0800 arm64: defconfig: Enable DisplayPort on SC8280XP laptops The QCOM_PMIC_GLINK implements the parts of a TCPM necessary for negotiating DP altmode and the TYPEC_MUX_GPIO_SBU driver is used for controlling connection and orientation switching of the SBU lanes in the USB-C connector Enable these to enable USB Type-C DisplayPort on SC8280XP laptops. Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213215619.1362566-5-quic_bjorande@quicinc.com commit 8fcff430faee2a2e99df80c6e9b09175a0fa5002 Author: Bjorn Andersson Date: Mon Feb 13 13:56:18 2023 -0800 arm64: dts: qcom: sc8280xp-x13s: Enable external display Like on the CRD, add the necessary nodes to enable USB Type-C altmode-based external display on the Lenovo ThinkPad X13s. Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213215619.1362566-4-quic_bjorande@quicinc.com commit bc9a747ae91f148f97a63ade8b56b81f63bd39ad Author: Bjorn Andersson Date: Mon Feb 13 13:56:17 2023 -0800 arm64: dts: qcom: sc8280xp-crd: Introduce pmic_glink The SC8280XP CRD control over battery management and its two USB Type-C port using pmic_glink and two GPIO-based SBU muxes. Enable the two DisplayPort instances, GPIO SBU mux instance and pmic_glink with the two connectors on the CRD. Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213215619.1362566-3-quic_bjorande@quicinc.com commit 19d3bb90754ff11e2cd69e2c8f1124dd5b9e40fa Author: Bjorn Andersson Date: Mon Feb 13 13:56:16 2023 -0800 arm64: dts: qcom: sc8280xp: Add USB-C-related DP blocks Add the two DisplayPort controllers that are attached to QMP phys for providing display output on USB Type-C. Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230213215619.1362566-2-quic_bjorande@quicinc.com commit a8ecd17bb681d1743309b0d2a4622b643b61d69c Author: Dmitry Baryshkov Date: Thu Feb 9 15:38:39 2023 +0200 arm64: dts: qcom: sm8350-hdk: enable GPU Enable the GPU on the SM8350-HDK device. The ZAP shader is required for the GPU to function properly. Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209133839.762631-7-dmitry.baryshkov@linaro.org commit 54af0ceb75958a8b7e62138646cfa6c114e71a77 Author: Dmitry Baryshkov Date: Thu Feb 9 15:38:38 2023 +0200 arm64: dts: qcom: sm8350: add GPU, GMU, GPU CC and SMMU nodes Add device nodes required to enable GPU on the SM8350 platform. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio [bjorn: Workaround for lacking RPMH_REGULATOR_LEVEL_LOW_SVS_L1 constant] Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209133839.762631-6-dmitry.baryshkov@linaro.org commit 51f83fbbf1c8d7a09885099f9a8f25b3c9139797 Author: Dmitry Baryshkov Date: Thu Feb 9 15:38:37 2023 +0200 arm64: dts: qcom: sm8350: finish reordering nodes Finish reordering DT nodes by their address. Move PDC, tsens, AOSS, SRAM, SPMI and TLMM nodes to the proper position. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209133839.762631-5-dmitry.baryshkov@linaro.org commit 1417372f4f846fbc28b4306370eb011d1f0853ca Author: Dmitry Baryshkov Date: Thu Feb 9 15:38:36 2023 +0200 arm64: dts: qcom: sm8350: move more nodes to correct place Continue ordering DT nodes by their address. Move RNG, UFS, system NoC and SLPI nodes to the proper position. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209133839.762631-4-dmitry.baryshkov@linaro.org commit f5f6bd58186afa4ec1ebcd074bc30255826e8480 Author: Dmitry Baryshkov Date: Thu Feb 9 15:38:35 2023 +0200 arm64: dts: qcom: sm8350: reorder device nodes Somehow sm8350 got its device nodes not fully sorted. Start reordering DT nodes by their address. Move apps SMMU, GIC, timer, apps RSC, cpufreq ADSP and cDSP nodes to the end to the proper position at the end of /soc/. Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230209133839.762631-3-dmitry.baryshkov@linaro.org commit 29e8142b5623b5949587bcc4f591c4e6595c4aca Author: Bjorn Andersson Date: Tue Feb 7 06:42:41 2023 -0800 power: supply: Introduce Qualcomm PMIC GLINK power supply The PMIC GLINK service, running on a coprocessor of modern Qualcomm platforms, deals with battery charging and fuel gauging, as well as reporting status of AC and wireless power supplies. As this is just one of the functionalities provided by the PMIC GLINK service, this power supply driver is implemented as an auxilirary bus driver, spawned by the main "pmic glink" driver when the PMIC GLINK service is detected. Signed-off-by: Bjorn Andersson Tested-by: Konrad Dybcio # SM8350 PDX215 Reviewed-by: Neil Armstrong Tested-by: Neil Armstrong # on SM8550-MTP & SM8450-HDK Signed-off-by: Bjorn Andersson Acked-by: Sebastian Reichel Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230207144241.1767973-1-quic_bjorande@quicinc.com commit 6a3cd3318ff65622415e34e8ee39d76331e7c869 Author: Dave Marchevsky Date: Sun Feb 12 01:27:07 2023 -0800 bpf: Migrate release_on_unlock logic to non-owning ref semantics This patch introduces non-owning reference semantics to the verifier, specifically linked_list API kfunc handling. release_on_unlock logic for refs is refactored - with small functional changes - to implement these semantics, and bpf_list_push_{front,back} are migrated to use them. When a list node is pushed to a list, the program still has a pointer to the node: n = bpf_obj_new(typeof(*n)); bpf_spin_lock(&l); bpf_list_push_back(&l, n); /* n still points to the just-added node */ bpf_spin_unlock(&l); What the verifier considers n to be after the push, and thus what can be done with n, are changed by this patch. Common properties both before/after this patch: * After push, n is only a valid reference to the node until end of critical section * After push, n cannot be pushed to any list * After push, the program can read the node's fields using n Before: * After push, n retains the ref_obj_id which it received on bpf_obj_new, but the associated bpf_reference_state's release_on_unlock field is set to true * release_on_unlock field and associated logic is used to implement "n is only a valid ref until end of critical section" * After push, n cannot be written to, the node must be removed from the list before writing to its fields * After push, n is marked PTR_UNTRUSTED After: * After push, n's ref is released and ref_obj_id set to 0. NON_OWN_REF type flag is added to reg's type, indicating that it's a non-owning reference. * NON_OWN_REF flag and logic is used to implement "n is only a valid ref until end of critical section" * n can be written to (except for special fields e.g. bpf_list_node, timer, ...) Summary of specific implementation changes to achieve the above: * release_on_unlock field, ref_set_release_on_unlock helper, and logic to "release on unlock" based on that field are removed * The anonymous active_lock struct used by bpf_verifier_state is pulled out into a named struct bpf_active_lock. * NON_OWN_REF type flag is introduced along with verifier logic changes to handle non-owning refs * Helpers are added to use NON_OWN_REF flag to implement non-owning ref semantics as described above * invalidate_non_owning_refs - helper to clobber all non-owning refs matching a particular bpf_active_lock identity. Replaces release_on_unlock logic in process_spin_lock. * ref_set_non_owning - set NON_OWN_REF type flag after doing some sanity checking * ref_convert_owning_non_owning - convert owning reference w/ specified ref_obj_id to non-owning references. Set NON_OWN_REF flag for each reg with that ref_obj_id and 0-out its ref_obj_id * Update linked_list selftests to account for minor semantic differences introduced by this patch * Writes to a release_on_unlock node ref are not allowed, while writes to non-owning reference pointees are. As a result the linked_list "write after push" failure tests are no longer scenarios that should fail. * The test##missing_lock##op and test##incorrect_lock##op macro-generated failure tests need to have a valid node argument in order to have the same error output as before. Otherwise verification will fail early and the expected error output won't be seen. Signed-off-by: Dave Marchevsky Link: https://lore.kernel.org/r/20230212092715.1422619-2-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov commit 6fffbc7ae1373e10b989afe23a9eeb9c49fe15c3 Author: Rob Herring Date: Fri Feb 10 10:43:51 2023 -0600 PCI: Honor firmware's device disabled status If a device has a firmware node (DT/ACPI), and the device is marked disabled, that is currently ignored. Add a check for this condition and bail out creating the pci_dev. This assumes the config space for the device can still be accessed because they already have by this point in order to identify the device. Link: https://lore.kernel.org/r/20230210164351.2687475-1-robh@kernel.org Tested-by: Binbin Zhou Signed-off-by: Rob Herring Signed-off-by: Bjorn Helgaas Cc: Liu Peibao Cc: Huacai Chen commit 22d74bc26bbfde150f602b2a6e93fb11df30ce0b Author: Thomas Weißschuh Date: Fri Feb 10 02:16:13 2023 +0000 ubifs: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit c768f8c5f40fcdc6f058cc2f02592163d6c6716c Author: Huacai Chen Date: Sat Feb 11 10:33:21 2023 +0800 PCI: loongson: Add more devices that need MRRS quirk Loongson-2K SOC and LS7A2000 chipset add new PCI IDs that need MRRS quirk. Add them. Link: https://lore.kernel.org/r/20230211023321.3530080-1-chenhuacai@loongson.cn Signed-off-by: Huacai Chen Signed-off-by: Bjorn Helgaas commit 05b8773ca33253ea562be145cf3145b05ef19f86 Author: Daniel Golle Date: Thu Dec 22 19:33:31 2022 +0000 mtd: ubi: block: wire-up device parent ubiblock devices were previously only identifyable by their name, but not connected to their parent UBI volume device e.g. in sysfs. Properly parent ubiblock device as descendant of a UBI volume device to reflect device model hierachy. Signed-off-by: Daniel Golle Signed-off-by: Richard Weinberger commit 1ecf9e390452e73a362ea7fbde8f3f0db83de856 Author: Daniel Golle Date: Thu Dec 22 19:33:04 2022 +0000 mtd: ubi: wire-up parent MTD device Wire up the device parent pointer of UBI devices to their lower MTD device, typically an MTD partition or whole-chip device. The most noticeable change is that in sysfs, previously ubi devices would be could in /sys/devices/virtual/ubi while after this change they would be correctly attached to their parent MTD device, e.g. /sys/devices/platform/1100d000.spi/spi_master/spi1/spi1.0/mtd/mtd2/ubi0. Locating UBI devices using /sys/class/ubi/ of course still works as well. Signed-off-by: Daniel Golle Signed-off-by: Richard Weinberger commit a13408c205260716e925a734ef399899d69182ba Author: Mike Rapoport Date: Sun Feb 12 10:46:11 2023 +0200 char/agp: introduce asm-generic/agp.h There are several architectures that duplicate definitions of map_page_into_agp(), unmap_page_from_agp() and flush_agp_cache(). Define those in asm-generic/agp.h and use it instead of duplicated per-architecture headers. Signed-off-by: Mike Rapoport (IBM) Signed-off-by: Arnd Bergmann commit 0e4f2c4567953a230b420f2c4460c3368d6509db Author: Mike Rapoport Date: Sun Feb 12 10:46:10 2023 +0200 char/agp: consolidate {alloc,free}_gatt_pages() There is a copy of alloc_gatt_pages() and free_gatt_pages in several architectures in arch/$ARCH/include/asm/agp.h. All the copies do exactly the same: alias alloc_gatt_pages() to __get_free_pages(GFP_KERNEL) and alias free_gatt_pages() to free_pages(). Define alloc_gatt_pages() and free_gatt_pages() in drivers/char/agp/agp.h and drop per-architecture definitions. Signed-off-by: Mike Rapoport (IBM) Signed-off-by: Arnd Bergmann commit 469bb6093f8e963aab3b1836dc9eb86135c14163 Author: Colin Ian King Date: Mon Feb 6 09:17:42 2023 +0000 power: supply: rt9467: Fix spelling mistake "attache" -> "attach" There is a spelling mistake in a dev_err message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: ChiaEn Wu Signed-off-by: Sebastian Reichel commit 1d6cdc47fec9f7935e04deb640b444e30322ca57 Author: Yang Yingliang Date: Mon Feb 6 20:20:18 2023 +0800 power: supply: rt9471: fix using wrong ce_gpio in rt9471_probe() Pass the correct 'ce_gpio' to IS_ERR(), and remove the ce_gpio in chip data, make it all by SW control only, not to control by HW pin. Fixes: 4a1a5f6781d8 ("power: supply: rt9471: Add Richtek RT9471 charger driver") Reviewed-by: ChiYuan Huang Signed-off-by: Yang Yingliang Signed-off-by: Sebastian Reichel commit a915dfd099b7e324de60fcbc29ef373479c5f69e Author: Uwe Kleine-König Date: Fri Feb 10 22:25:28 2023 +0100 power: supply: max77650: Make max77650_charger_disable() return void The return value of max77650_charger_disable() is ignored by all but one caller. That one caller propagates the error code in the platform driver's remove function. The only effect of that is that the driver core emits a generic error message (but still removes the device). As max77650_charger_disable() already emits an error message, this can better be changed to return zero. This is a preparation for making struct platform_driver::remove return void, too. Signed-off-by: Uwe Kleine-König Reviewed-by: Bartosz Golaszewski Signed-off-by: Sebastian Reichel commit 7135b35fc9596ec233ea016fc8cfb8c4d175d3bf Merge: df2d85d0b0b5b 9dbb8e3452aba Author: Marc Zyngier Date: Mon Feb 13 19:39:25 2023 +0000 Merge branch irq/irqdomain-locking into irq/irqchip-next * irq/irqdomain-locking: : . : irqdomain locking overhaul courtesy of Johan Hovold. : : From the cover letter: : : "Parallel probing (e.g. due to asynchronous probing) of devices that : share interrupts can currently result in two mappings for the same : hardware interrupt to be created. : : This series fixes this mapping race and reworks the irqdomain locking so : that in the end the global irq_domain_mutex is only used for managing : the likewise global irq_domain_list, while domain operations (e.g. IRQ : allocations) use per-domain (hierarchy) locking." : . irqdomain: Switch to per-domain locking irqchip/mvebu-odmi: Use irq_domain_create_hierarchy() irqchip/loongson-pch-msi: Use irq_domain_create_hierarchy() irqchip/gic-v3-mbi: Use irq_domain_create_hierarchy() irqchip/gic-v3-its: Use irq_domain_create_hierarchy() irqchip/gic-v2m: Use irq_domain_create_hierarchy() irqchip/alpine-msi: Use irq_domain_add_hierarchy() x86/uv: Use irq_domain_create_hierarchy() x86/ioapic: Use irq_domain_create_hierarchy() irqdomain: Clean up irq_domain_push/pop_irq() irqdomain: Drop leftover brackets irqdomain: Drop dead domain-name assignment irqdomain: Drop revmap mutex irqdomain: Fix domain registration race irqdomain: Fix mapping-creation race irqdomain: Refactor __irq_domain_alloc_irqs() irqdomain: Look for existing mapping only once irqdomain: Drop bogus fwspec-mapping error handling irqdomain: Fix disassociation race irqdomain: Fix association race Signed-off-by: Marc Zyngier commit eb50912ec931913e70640cecf75cb993fd26995f Author: Imre Deak Date: Mon Feb 6 13:48:56 2023 +0200 drm/i915/dp_mst: Fix payload removal during output disabling Use the correct old/new topology and payload states in intel_mst_disable_dp(). So far drm_atomic_get_mst_topology_state() it used returned either the old state, in case the state was added already earlier during the atomic check phase or otherwise the new state (but the latter could fail, which can't be handled in the enable/disable hooks). After the first patch in the patchset, the state should always get added already during the check phase, so here we can get the old/new states without a failure. drm_dp_remove_payload() should use time_slots from the old payload state and vc_start_slot in the new one. It should update the new payload states to reflect the sink's current payload table after the payload is removed. Pass the new topology state and the old and new payload states accordingly. This also fixes a problem where the payload allocations for multiple MST streams on the same link got inconsistent after a few commits, as during payload removal the old instead of the new payload state got updated, so the subsequent enabling sequence and commits used a stale payload state. v2: Constify the old payload state pointer. (Ville) Cc: Lyude Paul Cc: Ville Syrjälä Cc: stable@vger.kernel.org # 6.1 Reviewed-by: Ville Syrjälä Reviewed-by: Lyude Paul Acked-by: Lyude Paul Acked-by: Daniel Vetter Acked-by: Wayne Lin Acked-by: Jani Nikula Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230206114856.2665066-4-imre.deak@intel.com commit 9ffdb67af0ee625ae127711845532f670cc6a4e7 Author: Imre Deak Date: Mon Feb 6 13:48:55 2023 +0200 drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state() Add a function to get the old MST topology state, required by a follow-up i915 patch. While at it clarify the code comment of drm_atomic_get_new_mst_topology_state() and add _new prefix to the new state pointer to remind about its difference from the old state. v2: Use old_/new_ prefixes for the state pointers. (Ville) Cc: Lyude Paul Cc: Ville Syrjälä Cc: stable@vger.kernel.org # 6.1 Cc: dri-devel@lists.freedesktop.org Reviewed-by: Ville Syrjälä Reviewed-by: Lyude Paul Acked-by: Lyude Paul Acked-by: Daniel Vetter Acked-by: Wayne Lin Acked-by: Jani Nikula Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230206114856.2665066-3-imre.deak@intel.com commit e761cc20946a0094df71cb31a565a6a0d03bd8be Author: Imre Deak Date: Mon Feb 6 13:48:54 2023 +0200 drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload() Atm, drm_dp_remove_payload() uses the same payload state to both get the vc_start_slot required for the payload removal DPCD message and to deduct time_slots from vc_start_slot of all payloads after the one being removed. The above isn't always correct, as vc_start_slot must be the up-to-date version contained in the new payload state, but time_slots must be the one used when the payload was previously added, contained in the old payload state. The new payload's time_slots can change vs. the old one if the current atomic commit changes the corresponding mode. This patch let's drivers pass the old and new payload states to drm_dp_remove_payload(), but keeps these the same for now in all drivers not to change the behavior. A follow-up i915 patch will pass in that driver the correct old and new states to the function. Cc: Lyude Paul Cc: Ville Syrjälä Cc: Ben Skeggs Cc: Karol Herbst Cc: Harry Wentland Cc: Alex Deucher Cc: Wayne Lin Cc: stable@vger.kernel.org # 6.1 Cc: dri-devel@lists.freedesktop.org Reviewed-by: Ville Syrjälä Reviewed-by: Lyude Paul Acked-by: Lyude Paul Acked-by: Daniel Vetter Acked-by: Wayne Lin Acked-by: Jani Nikula Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230206114856.2665066-2-imre.deak@intel.com commit 326b1e792ff08b4d8ecb9605aec98e4e5feef56e Author: Imre Deak Date: Mon Feb 6 13:48:53 2023 +0200 drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs Add the MST topology for a CRTC to the atomic state if the driver needs to force a modeset on the CRTC after the encoder compute config functions are called. Later the MST encoder's disable hook also adds the state, but that isn't guaranteed to work (since in that hook getting the state may fail, which can't be handled there). This should fix that, while a later patch fixes the use of the MST state in the disable hook. v2: Add missing forward struct declartions, caught by hdrtest. v3: Factor out intel_dp_mst_add_topology_state_for_connector() used later in the patchset. Cc: Lyude Paul Cc: Ville Syrjälä Cc: stable@vger.kernel.org # 6.1 Reviewed-by: Ville Syrjälä # v2 Reviewed-by: Lyude Paul Acked-by: Lyude Paul Acked-by: Daniel Vetter Acked-by: Wayne Lin Acked-by: Jani Nikula Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230206114856.2665066-1-imre.deak@intel.com commit 9dbb8e3452aba34e6fa4f63054b3adc66aceb7ec Author: Johan Hovold Date: Mon Feb 13 11:43:02 2023 +0100 irqdomain: Switch to per-domain locking The IRQ domain structures are currently protected by the global irq_domain_mutex. Switch to using more fine-grained per-domain locking, which can speed up parallel probing by reducing lock contention. On a recent arm64 laptop, the total time spent waiting for the locks during boot drops from 160 to 40 ms on average, while the maximum aggregate wait time drops from 550 to 90 ms over ten runs for example. Note that the domain lock of the root domain (innermost domain) must be used for hierarchical domains. For non-hierarchical domains (as for root domains), the new root pointer is set to the domain itself so that &domain->root->mutex always points to the right lock. Also note that hierarchical domains should be constructed using irq_domain_create_hierarchy() (or irq_domain_add_hierarchy()) to avoid having racing allocations access a not fully initialised domain. As a safeguard, the lockdep assertion in irq_domain_set_mapping() will catch any offenders that also fail to set the root domain pointer. Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-21-johan+linaro@kernel.org commit f743f54fa8d2bcb3f2891b783687d91b76a144f5 Author: Johan Hovold Date: Mon Feb 13 11:43:01 2023 +0100 irqchip/mvebu-odmi: Use irq_domain_create_hierarchy() Use the irq_domain_create_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-20-johan+linaro@kernel.org commit 6159c470f812eab0a2f1900c70acbb3ca7b9e14a Author: Johan Hovold Date: Mon Feb 13 11:43:00 2023 +0100 irqchip/loongson-pch-msi: Use irq_domain_create_hierarchy() Use the irq_domain_create_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-19-johan+linaro@kernel.org commit 331f9aac03267f76a15776260eda4f47b81731f7 Author: Johan Hovold Date: Mon Feb 13 11:42:59 2023 +0100 irqchip/gic-v3-mbi: Use irq_domain_create_hierarchy() Use the irq_domain_create_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-18-johan+linaro@kernel.org commit 1e46e040decede1723a5b11f0689942134c29d9a Author: Johan Hovold Date: Mon Feb 13 11:42:58 2023 +0100 irqchip/gic-v3-its: Use irq_domain_create_hierarchy() Use the irq_domain_create_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Note that the domain host_data was first set to the struct its_node during allocation only to immediately be overwritten with the struct msi_domain_info. Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-17-johan+linaro@kernel.org commit e6e8cd62a56f9ed0dcdf8d01147709b59a111418 Author: Johan Hovold Date: Mon Feb 13 11:42:57 2023 +0100 irqchip/gic-v2m: Use irq_domain_create_hierarchy() Use the irq_domain_create_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-16-johan+linaro@kernel.org commit 6c889231e04dffa4b668c1f0fbc26db679600147 Author: Johan Hovold Date: Mon Feb 13 11:42:56 2023 +0100 irqchip/alpine-msi: Use irq_domain_add_hierarchy() Use the irq_domain_add_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-15-johan+linaro@kernel.org commit a14e7fdd43040a2a5da2cc979063b3c958015aa9 Author: Johan Hovold Date: Mon Feb 13 11:42:55 2023 +0100 x86/uv: Use irq_domain_create_hierarchy() Use the irq_domain_create_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-14-johan+linaro@kernel.org commit bc1bc1b309b42ff3faea957df7ac9382366c5eef Author: Johan Hovold Date: Mon Feb 13 11:42:54 2023 +0100 x86/ioapic: Use irq_domain_create_hierarchy() Use the irq_domain_create_hierarchy() helper to create the hierarchical domain, which both serves as documentation and avoids poking at irqdomain internals. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-13-johan+linaro@kernel.org commit 930a1bbbef01cdcd682d9c2b4bc9e36b9618fed3 Author: Johan Hovold Date: Mon Feb 13 11:42:53 2023 +0100 irqdomain: Clean up irq_domain_push/pop_irq() The irq_domain_push_irq() interface is used to add a new (outmost) level to a hierarchical domain after IRQs have been allocated. Possibly due to differing mental images of hierarchical domains, the names used for the irq_data variables make these functions much harder to understand than what they need to be. Rename the struct irq_data pointer to the data embedded in the descriptor as simply 'irq_data' and refer to the data allocated by this interface as 'parent_irq_data' so that the names reflect how hierarchical domains are implemented. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-12-johan+linaro@kernel.org commit 4e0d86df9344bfd1951eb2571e4ef8f3d37000a4 Author: Johan Hovold Date: Mon Feb 13 11:42:52 2023 +0100 irqdomain: Drop leftover brackets Drop some unnecessary brackets that were left in place when the corresponding code was updated. Reviewed-by: Philippe Mathieu-Daudé Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-11-johan+linaro@kernel.org commit 28a9ff23d8b56db09cb01cef174a205ea5e2ca49 Author: Johan Hovold Date: Mon Feb 13 11:42:51 2023 +0100 irqdomain: Drop dead domain-name assignment Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name information only") an IRQ domain is always given a name during allocation (e.g. used for the debugfs entry). Drop the leftover name assignment when allocating the first IRQ. Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-10-johan+linaro@kernel.org commit 47d1932f37de99bae3345bb93f098ac8750ab0fb Author: Johan Hovold Date: Mon Feb 13 11:42:50 2023 +0100 irqdomain: Drop revmap mutex The revmap mutex is essentially only used to maintain the integrity of the radix tree during updates (lookups use RCU). As the global irq_domain_mutex is now held in all paths that update the revmap structures there is strictly no longer any need for the dedicated mutex, which can be removed. Drop the revmap mutex and add lockdep assertions to the revmap helpers to make sure that the global lock is always held when updating the revmap. Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-9-johan+linaro@kernel.org commit 8932c32c3053accd50702b36e944ac2016cd103c Author: Marc Zyngier Date: Mon Feb 13 11:42:49 2023 +0100 irqdomain: Fix domain registration race Hierarchical domains created using irq_domain_create_hierarchy() are currently added to the domain list before having been fully initialised. This specifically means that a racing allocation request might fail to allocate irq data for the inner domains of a hierarchy in case the parent domain pointer has not yet been set up. Note that this is not really any issue for irqchip drivers that are registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE()) but could potentially cause trouble with drivers that are registered later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(), gpiochip drivers, etc.). Fixes: afb7da83b9f4 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()") Cc: stable@vger.kernel.org # 3.19 Signed-off-by: Marc Zyngier [ johan: add commit message ] Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org commit 601363cc08da25747feb87c55573dd54de91d66a Author: Johan Hovold Date: Mon Feb 13 11:42:48 2023 +0100 irqdomain: Fix mapping-creation race Parallel probing of devices that share interrupts (e.g. when a driver uses asynchronous probing) can currently result in two mappings for the same hardware interrupt to be created due to missing serialisation. Make sure to hold the irq_domain_mutex when creating mappings so that looking for an existing mapping before creating a new one is done atomically. Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers") Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") Link: https://lore.kernel.org/r/YuJXMHoT4ijUxnRb@hovoldconsulting.com Cc: stable@vger.kernel.org # 4.8 Cc: Dmitry Torokhov Cc: Jon Hunter Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-7-johan+linaro@kernel.org commit d55f7f4c58c07beb5050a834bf57ae2ede599c7e Author: Johan Hovold Date: Mon Feb 13 11:42:47 2023 +0100 irqdomain: Refactor __irq_domain_alloc_irqs() Refactor __irq_domain_alloc_irqs() so that it can be called internally while holding the irq_domain_mutex. This will be used to fix a shared-interrupt mapping race, hence the Fixes tag. Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-6-johan+linaro@kernel.org commit 6e6f75c9c98d2d246d90411ff2b6f0cd271f4cba Author: Johan Hovold Date: Mon Feb 13 11:42:46 2023 +0100 irqdomain: Look for existing mapping only once Avoid looking for an existing mapping twice when creating a new mapping using irq_create_fwspec_mapping() by factoring out the actual allocation which is shared with irq_create_mapping_affinity(). The new helper function will also be used to fix a shared-interrupt mapping race, hence the Fixes tag. Fixes: b62b2cf5759b ("irqdomain: Fix handling of type settings for existing mappings") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-5-johan+linaro@kernel.org commit e3b7ab025e931accdc2c12acf9b75c6197f1c062 Author: Johan Hovold Date: Mon Feb 13 11:42:45 2023 +0100 irqdomain: Drop bogus fwspec-mapping error handling In case a newly allocated IRQ ever ends up not having any associated struct irq_data it would not even be possible to dispose the mapping. Replace the bogus disposal with a WARN_ON(). This will also be used to fix a shared-interrupt mapping race, hence the CC-stable tag. Fixes: 1e2a7d78499e ("irqdomain: Don't set type when mapping an IRQ") Cc: stable@vger.kernel.org # 4.8 Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-4-johan+linaro@kernel.org commit 3f883c38f5628f46b30bccf090faec054088e262 Author: Johan Hovold Date: Mon Feb 13 11:42:44 2023 +0100 irqdomain: Fix disassociation race The global irq_domain_mutex is held when mapping interrupts from non-hierarchical domains but currently not when disposing them. This specifically means that updates of the domain mapcount is racy (currently only used for statistics in debugfs). Make sure to hold the global irq_domain_mutex also when disposing mappings from non-hierarchical domains. Fixes: 9dc6be3d4193 ("genirq/irqdomain: Add map counter") Cc: stable@vger.kernel.org # 4.13 Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org commit b06730a571a9ff1ba5bd6b20bf9e50e5a12f1ec6 Author: Johan Hovold Date: Mon Feb 13 11:42:43 2023 +0100 irqdomain: Fix association race The sanity check for an already mapped virq is done outside of the irq_domain_mutex-protected section which means that an (unlikely) racing association may not be detected. Fix this by factoring out the association implementation, which will also be used in a follow-on change to fix a shared-interrupt mapping race. Fixes: ddaf144c61da ("irqdomain: Refactor irq_domain_associate_many()") Cc: stable@vger.kernel.org # 3.11 Tested-by: Hsin-Yi Wang Tested-by: Mark-PK Tsai Signed-off-by: Johan Hovold Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230213104302.17307-2-johan+linaro@kernel.org commit 5a9e358f1d1f5a2c2dfd8055b0e9e44d58a54a49 Author: Lukas Wunner Date: Wed Feb 8 06:59:51 2023 +0100 ACPICA: Fix typo in CDAT DSMAS struct definition ACPICA commit 9d8bd58d5f3495ce76d1b9767ec0b92251cbc366 Link: https://github.com/acpica/acpica/commit/9d8bd58d5f34 Signed-off-by: Lukas Wunner Reviewed-by: Ira Weiny Signed-off-by: Rafael J. Wysocki commit 4ec98e6db9f24a9f4716685c62c9f6c348fec45b Author: Asahi Lina Date: Sat Feb 11 18:13:02 2023 +0900 soc: apple: rtkit: Do not copy the reg state structure to the stack The register state struct is 848 bytes, which ends up bloating the apple_rtkit_crashlog_dump_regs stack frame beyond 1024 on some 32-bit platforms, triggering compile warnings. This doesn't matter for 64BIT/ARM64, but there's also no good reason to copy the structure to the stack in this case. We can use __packed to avoid alignment issues, there are no double-read hazards, and this is a fatal error path so performance does not matter. Fixes: 22991d8d5725 ("soc: apple: rtkit: Add register dump decoding to crashlog") Signed-off-by: Asahi Lina Reviewed-by: Eric Curtin Signed-off-by: Arnd Bergmann commit c6cd63f5af3921c484be5789cf23e0f276de3a2f Author: Mark Brown Date: Fri Feb 10 19:52:49 2023 +0000 arm64: configs: Add virtconfig Provide a slimline configuration intended to be booted on virtual machines, with the goal of providing a light configuration which will boot on and enable features available in mach-virt. This is defined in terms of the standard defconfig, with an additional virt.config fragment which disables options unneeded in a virtual configuration. As a first step we just disable all the ARCH_ configuration options, disabling the build of all the SoC specific drivers. This results in a kernel that builds about 25% faster in my testing, if this approach works for people we can add further options. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230203-arm64-defconfigs-v1-3-cd0694a05f13@kernel.org Signed-off-by: Arnd Bergmann commit a63971257e66bbf354e8801623caffa965e9ba5c Author: Mark Brown Date: Fri Feb 10 19:52:48 2023 +0000 kbuild: Provide a version of merge_into_defconfig without override warnings While warning on overridden Kconfig options is a good default for merging config fragements sometimes that is our explicit intent and the warnings are unhelpful, add a new merge_into_defconfig_override which does the merge but with warnings suppressed. Since merge_into_defconfig accepts any number of fragments it is difficult to allow it to accept the flag. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230203-arm64-defconfigs-v1-2-cd0694a05f13@kernel.org Signed-off-by: Arnd Bergmann commit 46dff8d7e381e74a501cbec6285a21dba1d9fccf Author: Mark Brown Date: Fri Feb 10 19:52:47 2023 +0000 scripts: merge_config: Add option to suppress warning on overrides Currently merge_config.sh will unconditionally warn if a fragment overrides any already set symbol. This is generally desirable but is inconvenient in cases where we want to create a fragment which disables unwanted options in the base configuration, for example when attempting to produce a smaller version of another configuration. Add an option -Q which will suppress these warnings. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230203-arm64-defconfigs-v1-1-cd0694a05f13@kernel.org Signed-off-by: Arnd Bergmann commit 17bb7046e7ce038a73ee97eaa804e0300c5199e2 Author: Werner Sembach Date: Mon Feb 13 19:16:53 2023 +0100 ACPI: resource: Do IRQ override on all TongFang GMxRGxx Apply commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15") override for all vendors using this mainboard. Signed-off-by: Werner Sembach Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") Signed-off-by: Rafael J. Wysocki commit ab407a1919d2676ddc5761ed459d4cc5c7be18ed Merge: 7b0f95f28fc74 0051293c53301 Author: Thomas Gleixner Date: Mon Feb 13 19:28:48 2023 +0100 Merge tag 'clocksource.2023.02.06b' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into timers/core Pull clocksource watchdog changes from Paul McKenney: o Improvements to clocksource-watchdog console messages. o Loosening of the clocksource-watchdog skew criteria to match those of NTP (500 parts per million, relaxed from 400 parts per million). If it is good enough for NTP, it is good enough for the clocksource watchdog. o Suspend clocksource-watchdog checking temporarily when high memory latencies are detected. This avoids the false-positive clock-skew events that have been seen on production systems running memory-intensive workloads. o On systems where the TSC is deemed trustworthy, use it as the watchdog timesource, but only when specifically requested using the tsc=watchdog kernel boot parameter. This permits clock-skew events to be detected, but avoids forcing workloads to use the slow HPET and ACPI PM timers. These last two timers are slow enough to cause systems to be needlessly marked bad on the one hand, and real skew does sometimes happen on production systems running production workloads on the other. And sometimes it is the fault of the TSC, or at least of the firmware that told the kernel to program the TSC with the wrong frequency. o Add a tsc=revalidate kernel boot parameter to allow the kernel to diagnose cases where the TSC hardware works fine, but was told by firmware to tick at the wrong frequency. Such cases are rare, but they really have happened on production systems. Link: https://lore.kernel.org/r/20230210193640.GA3325193@paulmck-ThinkPad-P17-Gen-1 commit cb18703c179713056bd7e3bdfc2260ab4e8658f0 Author: Adam Niederer Date: Sat Feb 11 15:13:33 2023 -0500 ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models Fix a regression introduced by commit 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") on MAINGEAR Vector Pro 2 systems, which causes the built-in keyboard to not work. This restores the functionality by adding an IRQ override. No other IRQs were being overridden before, so this should be all that is needed for these systems. I have personally tested this on the 15" model (MG-VCP2-15A3070T), and I have confirmation that the issue is present on the 17" model (MG-VCP2-17A3070T). Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") Signed-off-by: Adam Niederer Signed-off-by: Rafael J. Wysocki commit 7b0f95f28fc74f2a92662c26044d9d31c5ffd1e1 Merge: 5b268d8abaec6 5ccb51b06c8bf Author: Thomas Gleixner Date: Mon Feb 13 19:21:38 2023 +0100 Merge tag 'timers-v6.3-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clocksource/event changes from Daniel Lezcano: - Add rktimer for rv1126 Rockchip based board (Jagan Teki) - Initialize hrtimer based broadcast clock event device on RISC-V before C3STOP can be used (Conor Dooley) - Add DT binding for RISC-V timer and add the C3STOP flag if the DT tells the timer can not wake up the CPU (Anup Patel) - Increase the RISC-V timer rating as it is more efficient than mmio timers (Samuel Holland) - Drop obsolete dependency on COMPILE_TEST on microchip-pit64b as the OF is already depending on it (Jean Delvare) - Mark sh_cmt, sh_tmu, em_sti drivers as non-removable (Uwe Kleine-König) - Add binding description for mediatek,mt8365-systimer (Bernhard Rosenkränzer) - Add compatibles for T-Head's C9xx (Icenowy Zheng) - Restrict the microchip-pit64b compilation to the ARM architecture and add the delay timer (Claudiu Beznea) - Set the static key to select the SBI or Sstc timer sooner to prevent the first call to use the SBI while Sstc must be used (Matt Evans) - Add the CLOCK_EVT_FEAT_DYNIRQ flag to optimize the timer wake up on the sun4i platform (Yangtao Li) Link: https://lore.kernel/org/r/b7d1d982-d717-2930-b353-19b92cbe390f@linaro.org commit 41a337b40e983db4f0e1602308109f2b93687a06 Author: Richard Fitzgerald Date: Mon Feb 13 16:50:05 2023 +0000 PM: Add EXPORT macros for exporting PM functions Add a pair of macros for exporting functions only if CONFIG_PM is enabled. The naming follows the style of the standard EXPORT_SYMBOL_*() macros that they replace. Sometimes a module wants to export PM functions directly to other drivers, not a complete struct dev_pm_ops. A typical example is where a core library exports the generic (shared) implementation and calling code wraps one or more of these in custom code. Signed-off-by: Richard Fitzgerald Signed-off-by: Rafael J. Wysocki commit 39c536acc3cf89b49c22f9e7f3f6578d3332944e Merge: 0b0757244754e ad07f29b9c9a2 Author: Daniel Borkmann Date: Mon Feb 13 19:13:13 2023 +0100 Merge branch 'xdp-ice-mbuf' Alexander Lobakin says: ==================== The set grew from the poor performance of %BPF_F_TEST_XDP_LIVE_FRAMES when the ice-backed device is a sender. Initially there were around 3.3 Mpps / thread, while I have 5.5 on skb-based pktgen ... After fixing 0005 (0004 is a prereq for it) first (strange thing nobody noticed that earlier), I started catching random OOMs. This is how 0002 (and partially 0001) appeared. 0003 is a suggestion from Maciej to not waste time on refactoring dead lines. 0006 is a "cherry on top" to get away with the final 6.7 Mpps. 4.5 of 6 are fixes, but only the first three are tagged, since it then starts being tricky. I may backport them manually later on. TL;DR for the series is that shortcuts are good, but only as long as they don't make the driver miss important things. %XDP_TX is purely driver-local, however .ndo_xdp_xmit() is not, and sometimes assumptions can be unsafe there. With that series and also one core code patch[0], "live frames" and xdp-trafficgen are now safe'n'fast on ice (probably more to come). [0] https://lore.kernel.org/all/20230209172827.874728-1-alexandr.lobakin@intel.com ==================== Signed-off-by: Daniel Borkmann commit ad07f29b9c9a29eba04b19116c6db51387a638d7 Author: Alexander Lobakin Date: Fri Feb 10 18:06:18 2023 +0100 ice: Micro-optimize .ndo_xdp_xmit() path After the recent mbuf changes, ice_xmit_xdp_ring() became a 3-liner. It makes no sense to keep it global in a different file than its caller. Move it just next to the sole call site and mark static. Also, it doesn't need a full xdp_convert_frame_to_buff(). Save several cycles and fill only the fields used by __ice_xmit_xdp_ring() later on. Finally, since it doesn't modify @xdpf anyhow, mark the argument const to save some more (whole -11 bytes of .text! :D). Thanks to 1 jump less and less calcs as well, this yields as many as 6.7 Mpps per queue. `xdp.data_hard_start = xdpf` is fully intentional again (see xdp_convert_buff_to_frame()) and just works when there are no source device's driver issues. Signed-off-by: Alexander Lobakin Signed-off-by: Daniel Borkmann Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20230210170618.1973430-7-alexandr.lobakin@intel.com commit 055d0920685e53ed8c2ad914888724d69dca17c6 Author: Alexander Lobakin Date: Fri Feb 10 18:06:17 2023 +0100 ice: Fix freeing XDP frames backed by Page Pool As already mentioned, freeing any &xdp_frame via page_frag_free() is wrong, as it assumes the frame is backed by either an order-0 page or a page with no "patrons" behind them, while in fact frames backed by Page Pool can be redirected to a device, which's driver doesn't use it. Keep storing a pointer to the raw buffer and then freeing it unconditionally via page_frag_free() for %XDP_TX frames, but introduce a separate type in the enum for frames coming through .ndo_xdp_xmit(), and free them via xdp_return_frame_bulk(). Note that saving xdpf as xdp_buff->data_hard_start is intentional and is always true when everything is configured properly. After this change, %XDP_REDIRECT from a Page Pool based driver to ice becomes zero-alloc as it should be and horrendous 3.3 Mpps / queue turn into 6.6, hehe. Let it go with no "Fixes:" tag as it spans across good 5+ commits and can't be trivially backported. Signed-off-by: Alexander Lobakin Signed-off-by: Daniel Borkmann Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20230210170618.1973430-6-alexandr.lobakin@intel.com commit aa1d3faf71a6a46f9b859daa8ffa5b86fa07217c Author: Alexander Lobakin Date: Fri Feb 10 18:06:16 2023 +0100 ice: Robustify cleaning/completing XDP Tx buffers When queueing frames from a Page Pool for redirecting to a device backed by the ice driver, `perf top` shows heavy load on page_alloc() and page_frag_free(), despite that on a properly working system it must be fully or at least almost zero-alloc. The problem is in fact a bit deeper and raises from how ice cleans up completed Tx buffers. The story so far: when cleaning/freeing the resources related to a particular completed Tx frame (skbs, DMA mappings etc.), ice uses some heuristics only without setting any type explicitly (except for dummy Flow Director packets, which are marked via ice_tx_buf::tx_flags). This kinda works, but only up to some point. For example, currently ice assumes that each frame coming to __ice_xmit_xdp_ring(), is backed by either plain order-0 page or plain page frag, while it may also be backed by Page Pool or any other possible memory models introduced in future. This means any &xdp_frame must be freed properly via xdp_return_frame() family with no assumptions. In order to do that, the whole heuristics must be replaced with setting the Tx buffer/frame type explicitly, just how it's always been done via an enum. Let us reuse 16 bits from ::tx_flags -- 1 bit-and instr won't hurt much -- especially given that sometimes there was a check for %ICE_TX_FLAGS_DUMMY_PKT, which is now turned from a flag to an enum member. The rest of the changes is straightforward and most of it is just a conversion to rely now on the type set in &ice_tx_buf rather than to some secondary properties. For now, no functional changes intended, the change only prepares the ground for starting freeing XDP frames properly next step. And it must be done atomically/synchronously to not break stuff. Signed-off-by: Alexander Lobakin Signed-off-by: Daniel Borkmann Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20230210170618.1973430-5-alexandr.lobakin@intel.com commit 923096b5cec3a68cc4b3816b1b9a50139df62ac7 Author: Alexander Lobakin Date: Fri Feb 10 18:06:15 2023 +0100 ice: Remove two impossible branches on XDP Tx cleaning The tagged commit started sending %XDP_TX frames from XSk Rx ring directly without converting it to an &xdp_frame. However, when XSk is enabled on a queue pair, it has its separate Tx cleaning functions, so neither ice_clean_xdp_irq() nor ice_unmap_and_free_tx_buf() ever happens there. Remove impossible branches in order to reduce the diffstat of the upcoming change. Fixes: a24b4c6e9aab ("ice: xsk: Do not convert to buff to frame for XDP_TX") Suggested-by: Maciej Fijalkowski Signed-off-by: Alexander Lobakin Signed-off-by: Daniel Borkmann Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20230210170618.1973430-4-alexandr.lobakin@intel.com commit 0bd939b60ceaa6cf2894678f40b96f61b2501658 Author: Alexander Lobakin Date: Fri Feb 10 18:06:14 2023 +0100 ice: Fix XDP Tx ring overrun Sometimes, under heavy XDP Tx traffic, e.g. when using XDP traffic generator (%BPF_F_TEST_XDP_LIVE_FRAMES), the machine can catch OOM due to the driver not freeing all of the pages passed to it by .ndo_xdp_xmit(). Turned out that during the development of the tagged commit, the check, which ensures that we have a free descriptor to queue a frame, moved into the branch happening only when a buffer has frags. Otherwise, we only run a cleaning cycle, but don't check anything. ATST, there can be situations when the driver gets new frames to send, but there are no buffers that can be cleaned/completed and the ring has no free slots. It's very rare, but still possible (> 6.5 Mpps per ring). The driver then fills the next buffer/descriptor, effectively overwriting the data, which still needs to be freed. Restore the check after the cleaning routine to make sure there is a slot to queue a new frame. When there are frags, there still will be a separate check that we can place all of them, but if the ring is full, there's no point in wasting any more time. (minor: make `!ready_frames` unlikely since it happens ~1-2 times per billion of frames) Fixes: 3246a10752a7 ("ice: Add support for XDP multi-buffer on Tx side") Signed-off-by: Alexander Lobakin Signed-off-by: Daniel Borkmann Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20230210170618.1973430-3-alexandr.lobakin@intel.com commit bc4db83470034b4644a8bf164a984bdb68b61622 Author: Alexander Lobakin Date: Fri Feb 10 18:06:13 2023 +0100 ice: fix ice_tx_ring:: Xdp_tx_active underflow xdp_tx_active is used to indicate whether an XDP ring has any %XDP_TX frames queued to shortcut processing Tx cleaning for XSk-enabled queues. When !XSk, it simply indicates whether the ring has any queued frames in general. It gets increased on each frame placed onto the ring and counts the whole frame, not each frag. However, currently it gets decremented in ice_clean_xdp_tx_buf(), which is called per each buffer, i.e. per each frag. Thus, on completing multi-frag frames, an underflow happens. Move the decrement to the outer function and do it once per frame, not buf. Also, do that on the stack and update the ring counter after the loop is done to save several cycles. XSk rings are fine since there are no frags at the moment. Fixes: 3246a10752a7 ("ice: Add support for XDP multi-buffer on Tx side") Signed-off-by: Alexander Lobakin Signed-off-by: Daniel Borkmann Acked-by: Maciej Fijalkowski Link: https://lore.kernel.org/bpf/20230210170618.1973430-2-alexandr.lobakin@intel.com commit 3eea2c615e25f7a3a7b40912358ed54b5d2f0ff2 Merge: 9d5dbfe0e170c 801fc159e30d3 Author: Kalle Valo Date: Mon Feb 13 20:08:01 2023 +0200 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for v6.3. Major changes: ath12k * new driver for Qualcomm Wi-Fi 7 devices ath11k * IPQ5018 support * Fine Timing Measurement (FTM) responder role support * channel 177 support ath10k * store WLAN firmware version in SMEM image table commit 273a51e5521213a13e5852e762cc9c03c66b9baa Author: Thomas Weißschuh Date: Thu Feb 9 03:20:10 2023 +0000 f2fs: make kobj_type structures constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definitions to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9d5dbfe0e170cb5d58422b890d4d23c8e70d1f28 Author: Tom Rix Date: Sat Feb 4 12:09:02 2023 -0800 wifi: zd1211rw: remove redundant decls building with W=2 has these errors redundant redeclaration of ‘zd_rf_generic_patch_6m’ [-Werror=redundant-decls] redundant redeclaration of ‘zd_rf_patch_6m_band_edge’ [-Werror=redundant-decls] Remove the second decls. Signed-off-by: Tom Rix Reviewed-by: Simon Horman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230204200902.1709343-1-trix@redhat.com commit 6869ba4911df3a0af4863708c0f61449d54eb199 Author: Ping-Ke Shih Date: Thu Jan 19 19:31:46 2023 +0800 wifi: rtl8xxxu: fix txdw7 assignment of TX DESC v3 Type of txdw7 is __le16, so assign __le32 is wrong. Also, the TXDESC_ANTENNA_SELECT_C is defined for __le32, so shift 16 bits to fit the value. Compile test only. sparse warnings: (new ones prefixed by >>) >> rtl8xxxu_core.c:5198:24: sparse: sparse: invalid assignment: |= >> rtl8xxxu_core.c:5198:24: sparse: left side has type restricted __le16 >> rtl8xxxu_core.c:5198:24: sparse: right side has type restricted __le32 Reported-by: kernel test robot Signed-off-by: Ping-Ke Shih Tested-by: Bitterblue Smith Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119113146.9640-1-pkshih@realtek.com commit 2cef0aeebf2c1e6b49ac7b92f234db8c81e8eb35 Author: Bitterblue Smith Date: Fri Jan 20 17:55:09 2023 +0200 wifi: rtl8xxxu: Add LED control code for RTL8723AU By default the LED will blink when there is some activity. This is only compile tested. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/73323811-aa58-a1be-7867-a5d45b7ae3d6@gmail.com commit ae0a6df673c2ca9a0843127e4a6e72a1c80f1215 Author: Bitterblue Smith Date: Fri Jan 20 17:54:18 2023 +0200 wifi: rtl8xxxu: Add LED control code for RTL8192EU By default the LED will blink when there is some activity. This was tested with a cheap "HT-WR813" from Aliexpress. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/8f7fd5d7-5baa-b38b-ad2a-977dcd9edd81@gmail.com commit 873b3811728b39a83a807fbccaa14d517f740ac8 Author: Bitterblue Smith Date: Fri Jan 20 17:52:40 2023 +0200 wifi: rtl8xxxu: Add LED control code for RTL8188EU By default the LED will blink when there is some activity. This was tested with a TP-Link TL-WN725N. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/34d62bf5-3595-0c77-2ca7-be78555f765d@gmail.com commit 3be01622995bb1a360718f7e5e8cee1879795fa5 Author: Bitterblue Smith Date: Fri Jan 20 17:51:21 2023 +0200 wifi: rtl8xxxu: Register the LED and make it blink If the chip can have an LED, register a struct led_classdev and enable hardware-controlled blinking. When the chip is not transmitting or receiving anything the LED is off. Otherwise the LED will blink faster or slower according to the throughput. The LED can be controlled from userspace by writing 0, 1, or 2 to /sys/class/leds/rtl8xxxu-usbX-Y/brightness: 0 - solid off. 1 - solid on. 2 - hardware-controlled blinking. In this patch none of the chips advertise having an LED. That will be added in the next patches. Signed-off-by: Bitterblue Smith Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/b8235bca-60c3-d0fe-a958-53c6dd3ba3f6@gmail.com commit c6e3dc99fd321b85b9766d51844aebc9ce769059 Author: Peter Lafreniere Date: Wed Jan 18 13:53:53 2023 -0500 wifi: rsi: Avoid defines prefixed with CONFIG Macros prefixed with CONFIG_ are intended to be defined only by Kconfig scripts. Here we remove the prefix from the CONFIG_AUTO_READ_MODE define to avoid confusion when reading the code. This causes no change to functionality. Signed-off-by: Peter Lafreniere Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230118185353.2422-1-peter@n8pjl.ca commit ddf9a2ead1676db46abe8acca3f689fd572a44d1 Author: Zong-Zhe Yang Date: Fri Feb 3 14:51:57 2023 +0800 wifi: rtw89: phy: set TX power according to RF path number by chip Previously, all supported chips had two RF paths. Therefore, these codes used static number for TX power setting. Now, we are planning to support a new chip which has only one RF path. So, we refine the setting codes to refer to chip's RF path number at runtime. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230203065157.8227-1-pkshih@realtek.com commit 5466ee9a7c63e18d3daea0bf80152944648218d2 Author: Ping-Ke Shih Date: Fri Feb 3 14:49:07 2023 +0800 wifi: rtw89: 8852b: correct register mask name of TX power offset For a packet with 1SS rate, it can also transmit via 2 antenna, called 2T mode. For 2T TX power offset, mask should be 2T as well. Fortunately, the mask of 2T and 1T are the same, so it can still work well without this fix. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230203064907.8046-1-pkshih@realtek.com commit 764f07f4565da0c0f94f24d18f9d6f5ddb39ccd8 Author: Zong-Zhe Yang Date: Wed Feb 1 11:20:57 2023 +0800 wifi: rtw89: use passed channel in set_tx_shape_dfir() In path of setting channel and setting TX power, the rtw89_chan instance to be used is controlled by top and passed down. The set_tx_shape_dfir() is in path of setting TX power, so it should use the passed rtw89_chan instead of querying it itself. Otherwise, it might encounter mismatch between parameters if multi-channel. For example, rtw89_8852ce 0000:04:00.0: set tx shape dfir by unknown ch: 155 on 2GHz Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230201032057.7349-1-pkshih@realtek.com commit 3712888e3dba5df2b4f3fb3ba87e20bac6afc7c0 Author: Chin-Yen Lee Date: Thu Jan 26 19:27:15 2023 +0800 wifi: rtw89: 8852be: enable CLKREQ of PCI capability Enable CLKREQ to reduce power consumption for 8852BE. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230126112715.5811-1-pkshih@realtek.com commit 7410bd727584ea9b3e1050c56fdf60d883398956 Author: Ping-Ke Shih Date: Mon Jan 23 14:54:01 2023 +0800 wifi: rtw89: 8852b: try to use NORMAL_CE type firmware first New firmware type NORMAL_CE is introduced to support P2P-PS and hardware scan, but no LPS-PG mode. After this patch, old firmware with NORMAL type can still work well. The use of this new type is the same as before, so we add new type to avoid taking wrong firmware. Then, driver log can also give clear information about this change: rtw89_8852be 0000:03:00.0: Firmware version 0.29.26.0, cmd version 0, type 5 rtw89_8852be 0000:03:00.0: Firmware version 0.29.26.0, cmd version 0, type 3 Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123065401.14174-7-pkshih@realtek.com commit e5624482ba3e98f0c34fc72bca509c6017266253 Author: Ping-Ke Shih Date: Mon Jan 23 14:54:00 2023 +0800 wifi: rtw89: 8852b: don't support LPS-PG mode after firmware 0.29.26.0 Due to firmware size limit of 8852b, LPS-PG mode isn't supported after 0.29.26.0, and then we have more space to support other features, such as P2P-PS, hardware scan and so on. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123065401.14174-6-pkshih@realtek.com commit 2e5a65f5952fe451777066e99531abc6bc684573 Author: Ping-Ke Shih Date: Mon Jan 23 14:53:59 2023 +0800 wifi: rtw89: 8852b: reset IDMEM mode to default value For different firmware type, it could use different IDMEM mode, so reset it to default to avoid encountering error during we bisect firmware version, like rtw89_8852be 0000:03:00.0: Firmware version 0.29.26.0, cmd version 0, type 5 rtw89_8852be 0000:03:00.0: Firmware version 0.29.26.0, cmd version 0, type 3 rtw89_8852be 0000:03:00.0: fw security fail rtw89_8852be 0000:03:00.0: download firmware fail rtw89_8852be 0000:03:00.0: [ERR]fwdl 0x1E0 = 0x62 rtw89_8852be 0000:03:00.0: [ERR]fwdl 0x83F2 = 0x8 rtw89_8852be 0000:03:00.0: [ERR]fw PC = 0xb8931154 rtw89_8852be 0000:03:00.0: [ERR]fw PC = 0xb8931154 rtw89_8852be 0000:03:00.0: [ERR]fw PC = 0xb8931150 rtw89_8852be 0000:03:00.0: [ERR]fw PC = 0xb8931154 Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123065401.14174-5-pkshih@realtek.com commit 5da5ba7e6ec4f13c2abba8de3578a3c197925243 Author: Ping-Ke Shih Date: Mon Jan 23 14:53:58 2023 +0800 wifi: rtw89: add use of pkt_list offload to debug entry Driver can prepare pkt_list for firmware that only uses them to send out the packets in specific situations. To understand the usage of current status, and to check if there is leakage problem, dump bitmap and the indices used by certain function. An example looks like: map: ... pkt_ofld: 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ... [SCAN 0]: 3 [SCAN 1]: 4 [SCAN 3]: 5 VIF [0] xx:xx:xx:xx:xx:xx ... pkt_ofld[GENERAL]: 0 1 2 Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123065401.14174-4-pkshih@realtek.com commit 5c12bb66b79d08b0f7aae99fc2677cab1141d4d2 Author: Chin-Yen Lee Date: Mon Jan 23 14:53:57 2023 +0800 wifi: rtw89: refine packet offload flow For upcoming firmware, driver needs to do packet offload to firmware to ensure LPS protocol work properly, so we update current connection and disconnect flow to maintain packet offload flow, and integrate with current WoWLAN flow which also needs packet offload. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123065401.14174-3-pkshih@realtek.com commit b8e8ff842b1bfe7602409fc71ee812db871ccce6 Author: Chin-Yen Lee Date: Mon Jan 23 14:53:56 2023 +0800 wifi: rtw89: fix potential wrong mapping for pkt-offload When driver fails to send H2C to firmware for pkt-offload, we should not update the pkt_list of driver, and need to release allocated pkt index to avoid wrong mapping between driver and firmware. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123065401.14174-2-pkshih@realtek.com commit d881d0a13c3843d213da23cde99bb73f27e53d1e Author: Kuan-Chung Chen Date: Thu Jan 19 14:46:31 2023 +0800 wifi: rtw89: disallow enter PS mode after create TDLS link Buffer STA on TDLS links are not currently supported. Therefore, it is not allowed to enter the PS mode after TDLS link is established. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119064631.66971-1-pkshih@realtek.com commit 0b0757244754ea1d0721195c824770f5576e119e Author: Ilya Leoshkevich Date: Thu Feb 9 00:12:11 2023 +0100 selftests/bpf: Fix out-of-srctree build Building BPF selftests out of srctree fails with: make: *** No rule to make target '/linux-build//ima_setup.sh', needed by 'ima_setup.sh'. Stop. The culprit is the rule that defines convenient shorthands like "make test_progs", which builds $(OUTPUT)/test_progs. These shorthands make sense only for binaries that are built though; scripts that live in the source tree do not end up in $(OUTPUT). Therefore drop $(TEST_PROGS) and $(TEST_PROGS_EXTENDED) from the rule. The issue exists for a while, but it became a problem only after commit d68ae4982cb7 ("selftests/bpf: Install all required files to run selftests"), which added dependencies on these scripts. Fixes: 03dcb78460c2 ("selftests/bpf: Add simple per-test targets to Makefile") Signed-off-by: Ilya Leoshkevich Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230208231211.283606-1-iii@linux.ibm.com commit 214a98b151b14d3dbfa60136abcf99df5d347a80 Author: Zong-Zhe Yang Date: Thu Jan 19 14:43:42 2023 +0800 wifi: rtw89: refine MCC C2H debug logs To debug channel concurrency more centrally, we add a new debug flag, RTW89_DBG_CHAN, for channel related things, especially channel concurrency. Then, we change MCC (multi-channel concurrency) C2H (chip to host packets) debug flag to it. Besides, refine debug logs to show TSF in u64 directly. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119064342.65391-2-pkshih@realtek.com commit 24d72944d79e6795ba4330c114de0387386bf3aa Author: Zong-Zhe Yang Date: Thu Jan 19 14:43:41 2023 +0800 wifi: rtw89: fix parsing offset for MCC C2H A 8-byte offset is missed during parsing C2Hs (chip to host packets) of MCC (multi-channel concurrent) series. So, we fix it. Fixes: ef9dff4cb491 ("wifi: rtw89: mac: process MCC related C2H") Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119064342.65391-1-pkshih@realtek.com commit 6e81461b06b6a4a24bf97fca37d9b89f72ce8126 Author: Shuah Khan Date: Fri Feb 10 17:20:57 2023 -0700 selftests/ptp: Remove clean target from Makefile Fix the following build warn removing unnecessary clean target from the Makefile. lib.mk handles clean. Makefile:10: warning: overriding recipe for target clean ../lib.mk:124: warning: ignoring old recipe for target clean In addition, fix to use TEST_GEN_PROGS for generated test executables and TES_PROGS for the shell script. Ger rid of all target as lib.mk handles it. Signed-off-by: Shuah Khan commit f5d98831badb89172515ac73015d0e7475a285c1 Author: Zong-Zhe Yang Date: Thu Jan 19 14:35:29 2023 +0800 wifi: rtw89: deal with RXI300 error RXI300 is a HW design to maintain stuffs across BUS, e.g. AXI, AHB, APB. It will feedback an error when host does an invalid BUS operation. For example, * BUS master request without power/clock on. * host reads/writes/accesses an invalid address. They might lead to problems such as BUS timeout, platform hang, etc. So, once if RXI300 feedback an error, it notifies that driver need a L2 SER (system error recovery) to reset things. Previously, driver did not parse the error scenario for RXI300. We add it and assign a corresponding error code which will make SER flow do L2 reset. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119063529.61563-3-pkshih@realtek.com commit c074da21dd346e0cfef5d08b0715078d7aea7f8d Author: Zong-Zhe Yang Date: Thu Jan 19 14:35:28 2023 +0800 wifi: rtw89: debug: avoid invalid access on RTW89_DBG_SEL_MAC_30 Only 8852C chip has valid pages on RTW89_DBG_SEL_MAC_30. To other chips, this section is an address hole. It will lead to crash if trying to access this section on chips except for 8852C. So, we avoid that. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119063529.61563-2-pkshih@realtek.com commit 76f478a34dafcee28165022b2f73d0ee1f0f47e5 Author: Zong-Zhe Yang Date: Thu Jan 19 14:24:53 2023 +0800 wifi: rtw89: mac: add function to get TSF Add mac function rtw89_mac_port_get_tsf() to get TSF by port. It will be used when MCC (multi-channel concurrency) calculates timing things. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119062453.58341-4-pkshih@realtek.com commit 42db7edd5c0523b43a004779caf36e1ebac80b40 Author: Zong-Zhe Yang Date: Thu Jan 19 14:24:52 2023 +0800 wifi: rtw89: split out generic part of rtw89_mac_port_tsf_sync() Originally, rtw89_mac_port_tsf_sync() contains randomization logic internally. However, not all situation, we need the randomization. So, split out the generic part from it. And, make the full logic of original one contained in rtw89_mac_port_tsf_sync_rand(). It will still be used by its original caller as before. Then, the generic one will be used in MCC (multi-channel concurrency) management flow. MCC will implement its logic to decide the offset for TSF sync. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119062453.58341-3-pkshih@realtek.com commit 1120e6a6c5cd1144694209d6aa6a225af064950a Author: Zong-Zhe Yang Date: Thu Jan 19 14:24:51 2023 +0800 wifi: rtw89: correct unit for port offset and refine macro Strictly speaking, the unit of the offset should be TU instead of ms. So, correct it and the macro for calculation. Then, to make the macro generic, the factor n is moved outside. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230119062453.58341-2-pkshih@realtek.com commit de06588cb95cb3bbece81e9838547c1a3c2aa023 Author: Ching-Te Ku Date: Tue Jan 17 19:41:09 2023 +0800 wifi: rtw89: coex: Update Wi-Fi Bluetooth coexistence version to 7.0.0 Should update the driver with the supported firmware version of the below item. Bluetooth firmware BT_Coex_Ver: 0x07 Wi-Fi firmware version: RTL8852C->v0.27.56.10, RTL8852A->v0.24.36 Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-9-pkshih@realtek.com commit 4b3e7e813bba53402af13ecd5343ac9667ca7608 Author: Ching-Te Ku Date: Tue Jan 17 19:41:08 2023 +0800 wifi: rtw89: coex: Fix test fail when coexist with raspberryPI A2DP idle The origin code will enable TDMA WL:BT = 50:50 to prevent Wi-Fi throughput suddenly drop to 0 in the moment while A2DP pause. And this protection just a short moment, and will turn to Bluetooth idle case when A2DP turn into sniff mode. But the raspberryPI simulated A2DP device will not turn into sniff mode. So the protection will bring the throughput drop. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-8-pkshih@realtek.com commit c7d2b22f52bd0088cd39dba57bb7c1e8f3df5489 Author: Ching-Te Ku Date: Tue Jan 17 19:41:07 2023 +0800 wifi: rtw89: coex: Correct A2DP exist variable source When Wi-Fi enter and leave LPS, coexistence driver need to know is there A2DP exist or not. And when Wi-Fi sleep in deep power save state will not able to receive mailbox sent from Bluetooth. So update the A2DP exist information from reading register. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-7-pkshih@realtek.com commit 6d2a479c1f9e957908d0fc9d56b9831a48f5ce80 Author: Ching-Te Ku Date: Tue Jan 17 19:41:06 2023 +0800 wifi: rtw89: coex: Set Bluetooth background scan PTA request priority When Wi-Fi is RX, set Bluetooth background scan to low-priority and not to break Wi-Fi packet. Bluetooth can RX depend on hardware ability even RX request has been rejected. This way can improve Wi-Fi RX throughput performance. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-6-pkshih@realtek.com commit 7cd8200555d4f01183f0b9071e0760c389a51816 Author: Ching-Te Ku Date: Tue Jan 17 19:41:05 2023 +0800 wifi: rtw89: coex: Refine coexistence log Adjust the log format and correct variable reference to make the log more readable. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-5-pkshih@realtek.com commit 3f857b23dd8dae2c7301476e8e183628edc694d1 Author: Ching-Te Ku Date: Tue Jan 17 19:41:04 2023 +0800 wifi: rtw89: coex: Force to update TDMA parameter when radio state change Force firmware to update TDMA parameter when enter/exit power saving. The TDMA instant feature will make firmware force update TDMA parameter immediately when the TDMA parameter H2C to firmware. Without this feature, it will have a low fail rate trigger Bluetooth audio sound glitch when Wi-Fi is under power saving. Or Wi-Fi fail to turn in to power save state. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-4-pkshih@realtek.com commit aae256c0f2334691645d52e7cc965bf4241b599b Author: Ching-Te Ku Date: Tue Jan 17 19:41:03 2023 +0800 wifi: rtw89: coex: Clear Bluetooth HW PTA counter when radio state change Reset the counter no matter Wi-Fi is notified turning into power save or not. With rest the counter coexistence will recognize Bluetooth is hanged easily. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-3-pkshih@realtek.com commit 1742fbae7a49b067649b7c2958d9468711149e37 Author: Ching-Te Ku Date: Tue Jan 17 19:41:02 2023 +0800 wifi: rtw89: coex: Update Wi-Fi external control TDMA parameters/tables This patch update the external control (Wi-Fi firmware control) type of TDMA related parameters, almost all of these case were related to Wi-Fi multi-role situations & AP mode. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230117114109.4298-2-pkshih@realtek.com commit 5fac18583a00dcdc7402d570e22a8d405fe2bde0 Author: Arend van Spriel Date: Tue Jan 3 13:41:17 2023 +0100 wifi: brcmfmac: change cfg80211_set_channel() name and signature The function cfg80211_set_channel() is an static function in brcmfmac but the name is misleading. Hence rename it with 'brcmf' prefix. Also changing the parameters to avoid additional conversions. Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230103124117.271988-4-arend.vanspriel@broadcom.com commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 Author: Dan Carpenter Date: Mon Feb 6 17:41:33 2023 +0300 wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() This code re-uses "i" to be the iterator for both the inside and outside loops. It means the outside loop will exit earlier than intended. Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/Y+ERnaDaZD7RtLvX@kili commit 235fd607c6cbd0f3922298200573b2b5f86295df Author: Gustavo A. R. Silva Date: Thu Feb 2 19:34:05 2023 -0600 wifi: mwifiex: Replace one-element array with flexible-array member One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct mwifiex_ie_types_rates_param_set. These are the only binary differences I see after the change: mwifiex.o _@@ -50154,7 +50154,7 @@ 23514: R_X86_64_32S kmalloc_caches+0x50 23518: call 2351d 23519: R_X86_64_PLT32 __tsan_read8-0x4 - 2351d: mov $0x225,%edx + 2351d: mov $0x224,%edx 23522: mov $0xdc0,%esi 23527: mov 0x0(%rip),%rdi # 2352e 2352a: R_X86_64_PC32 kmalloc_caches+0x4c scan.o _@@ -5582,7 +5582,7 @@ 4394: R_X86_64_32S kmalloc_caches+0x50 4398: call 439d 4399: R_X86_64_PLT32 __tsan_read8-0x4 - 439d: mov $0x225,%edx + 439d: mov $0x224,%edx 43a2: mov $0xdc0,%esi 43a7: mov 0x0(%rip),%rdi # 43ae 43aa: R_X86_64_PC32 kmalloc_caches+0x4c and the reason for that is the following line: drivers/net/wireless/marvell/mwifiex/scan.c: 1517 scan_cfg_out = kzalloc(sizeof(union mwifiex_scan_cmd_config_tlv), 1518 GFP_KERNEL); sizeof(union mwifiex_scan_cmd_config_tlv) is now one-byte smaller due to the flex-array transformation: 46 union mwifiex_scan_cmd_config_tlv { 47 /* Scan configuration (variable length) */ 48 struct mwifiex_scan_cmd_config config; 49 /* Max allocated block */ 50 u8 config_alloc_buf[MAX_SCAN_CFG_ALLOC]; 51 }; Notice that MAX_SCAN_CFG_ALLOC is defined in terms of sizeof(struct mwifiex_ie_types_rates_param_set), see: 26 /* Memory needed to store supported rate */ 27 #define RATE_TLV_MAX_SIZE (sizeof(struct mwifiex_ie_types_rates_param_set) \ 28 + HOSTCMD_SUPPORTED_RATES) 37 /* Maximum memory needed for a mwifiex_scan_cmd_config with all TLVs at max */ 38 #define MAX_SCAN_CFG_ALLOC (sizeof(struct mwifiex_scan_cmd_config) \ 39 + sizeof(struct mwifiex_ie_types_num_probes) \ 40 + sizeof(struct mwifiex_ie_types_htcap) \ 41 + CHAN_TLV_MAX_SIZE \ 42 + RATE_TLV_MAX_SIZE \ 43 + WILDCARD_SSID_TLV_MAX_SIZE) This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/252 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/Y9xkjXeElSEQ0FPY@work commit 7fcae8f7f8158d22e667ed55a40e6a1829cc55b0 Author: Gustavo A. R. Silva Date: Thu Feb 2 19:32:00 2023 -0600 wifi: mwifiex: Replace one-element arrays with flexible-array members One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element arrays with flexible-array members in multiple structures. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/256 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/Y9xkECG3uTZ6T1dN@work commit 552ac55ee9bc8a30edc87c284a4562ce703f972b Author: Gustavo A. R. Silva Date: Thu Feb 2 19:29:47 2023 -0600 wifi: brcmfmac: Replace one-element array with flexible-array member One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct brcmf_tlv. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/253 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/Y9xjizhMujNEtpB4@work commit 7715d79553de553532219d82c0fea89fba5f7c79 Author: Lukas Wunner Date: Fri Jan 27 15:03:00 2023 +0100 wifi: mwifiex: Support firmware hotfix version in GET_HW_SPEC responses Support the firmware hotfix version in GET_HW_SPEC responses to avoid an irritating "Unknown api_id: 5" message on probe. Based on this commit in NXP's GPLv2-licensed out-of-tree driver: https://github.com/nxp-imx/mwifiex/commit/27fd8ecca504 Signed-off-by: Lukas Wunner Cc: Sherry Sun Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/111c7ee895f12d951e95a2edcd06d87ca26a7d0f.1674827105.git.lukas@wunner.de commit bba047f15851c8b053221f1b276eb7682d59f755 Author: Lukas Wunner Date: Fri Jan 27 15:02:00 2023 +0100 wifi: mwifiex: Support SD8978 chipset The Marvell SD8978 (aka NXP IW416) uses identical registers as SD8987, so reuse the existing mwifiex_reg_sd8987 definition. Note that mwifiex_reg_sd8977 and mwifiex_reg_sd8997 are likewise identical, save for the fw_dump_ctrl register: They define it as 0xf0 whereas mwifiex_reg_sd8987 defines it as 0xf9. I've verified that 0xf9 is the correct value on SD8978. NXP's out-of-tree driver uses 0xf9 for all of them, so there's a chance that 0xf0 is not correct in the mwifiex_reg_sd8977 and mwifiex_reg_sd8997 definitions. I cannot test that for lack of hardware, hence am leaving it as is. NXP has only released a firmware which runs Bluetooth over UART. Perhaps Bluetooth over SDIO is unsupported by this chipset. Consequently, only an "sdiouart" firmware image is referenced, not an alternative "sdsd" image. Signed-off-by: Lukas Wunner Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/536b4f17a72ca460ad1b07045757043fb0778988.1674827105.git.lukas@wunner.de commit 36dd7a4c6226133b0b7aa92b8e604e688d958d0c Author: Lukas Wunner Date: Fri Jan 27 15:01:00 2023 +0100 wifi: mwifiex: Add missing compatible string for SD8787 Commit e3fffc1f0b47 ("devicetree: document new marvell-8xxx and pwrseq-sd8787 options") documented a compatible string for SD8787 in the devicetree bindings, but neglected to add it to the mwifiex driver. Fixes: e3fffc1f0b47 ("devicetree: document new marvell-8xxx and pwrseq-sd8787 options") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v4.11+ Cc: Matt Ranostay Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/320de5005ff3b8fd76be2d2b859fd021689c3681.1674827105.git.lukas@wunner.de commit 6a142f70774fd10350a52a10ba1297d52da46780 Author: Hector Martin Date: Sun Feb 12 15:38:13 2023 +0900 wifi: brcmfmac: pcie: Perform correct BCM4364 firmware selection This chip exists in two revisions (B2=r3 and B3=r4) on different platforms, and was added without regard to doing proper firmware selection or differentiating between them. Fix this to have proper per-revision firmwares and support Apple NVRAM selection. Revision B2 is present on at least these Apple T2 Macs: kauai: MacBook Pro 15" (Touch/2018-2019) maui: MacBook Pro 13" (Touch/2018-2019) lanai: Mac mini (Late 2018) ekans: iMac Pro 27" (5K, Late 2017) And these non-T2 Macs: nihau: iMac 27" (5K, 2019) Revision B3 is present on at least these Apple T2 Macs: bali: MacBook Pro 16" (2019) trinidad: MacBook Pro 13" (2020, 4 TB3) borneo: MacBook Pro 16" (2019, 5600M) kahana: Mac Pro (2019) kahana: Mac Pro (2019, Rack) hanauma: iMac 27" (5K, 2020) kure: iMac 27" (5K, 2020, 5700/XT) Also fix the firmware interface for 4364, from BCA to WCC. Fixes: 24f0bd136264 ("brcmfmac: add the BRCM 4364 found in MacBook Pro 15,2") Reviewed-by: Linus Walleij Reviewed-by: Arend van Spriel Signed-off-by: Hector Martin Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230212063813.27622-5-marcan@marcan.st commit bf8bbd903f07aabfef8d4cb3b513163a3e974d2b Author: Hector Martin Date: Sun Feb 12 15:38:12 2023 +0900 wifi: brcmfmac: pcie: Add IDs/properties for BCM4377 This chip is present on at least these Apple T2 Macs: * tahiti: MacBook Pro 13" (2020, 2 TB3) * formosa: MacBook Pro 13" (Touch/2019) * fiji: MacBook Air 13" (Scissor, 2020) Reviewed-by: Linus Walleij Reviewed-by: Arend van Spriel Signed-off-by: Hector Martin Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230212063813.27622-4-marcan@marcan.st commit 69005e67ce54cb837b8218b002c1bb868c83b7a9 Author: Hector Martin Date: Sun Feb 12 15:38:11 2023 +0900 wifi: brcmfmac: pcie: Add IDs/properties for BCM4355 This chip is present on at least these Apple T2 Macs: * hawaii: MacBook Air 13" (Late 2018) * hawaii: MacBook Air 13" (True Tone, 2019) Users report seeing PCI revision ID 12 for this chip, which Arend reports should be revision C2, but Apple has the firmware tagged as revision C1. Assume the right cutoff point for firmware versions is revision ID 11 then, and leave older revisions using the non-versioned firmware filename (Apple only uses C1 firmware builds). Reviewed-by: Arend van Spriel Signed-off-by: Hector Martin Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230212063813.27622-3-marcan@marcan.st commit 54f01f56cf63ebb92ac37450d65c7e4da379d4ca Author: Hector Martin Date: Sun Feb 12 15:38:10 2023 +0900 wifi: brcmfmac: Rename Cypress 89459 to BCM4355 The commit that introduced support for this chip incorrectly claimed it is a Cypress-specific part, while in actuality it is just a variant of BCM4355 silicon (as evidenced by the chip ID). The relationship between Cypress products and Broadcom products isn't entirely clear but given what little information is available and prior art in the driver, it seems the convention should be that originally Broadcom parts should retain the Broadcom name. Thus, rename the relevant constants and firmware file. Also rename the specific 89459 PCIe ID to BCM43596, which seems to be the original subvariant name for this PCI ID (as defined in the out-of-tree bcmdhd driver). Since Cypress added this part and will presumably be providing its supported firmware, we keep the CYW designation for this device. We also drop the RAW device ID in this commit. We don't do this for the other chips since apparently some devices with them exist in the wild, but there is already a 4355 entry with the Broadcom subvendor and WCC firmware vendor, so adding a generic fallback to Cypress seems redundant (no reason why a device would have the raw device ID *and* an explicitly programmed subvendor). Fixes: dce45ded7619 ("brcmfmac: Support 89459 pcie") Reviewed-by: Arend van Spriel Signed-off-by: Hector Martin Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230212063813.27622-2-marcan@marcan.st commit 0243d3dfe274832aa0a16214499c208122345173 Author: Alan Maguire Date: Thu Feb 9 13:28:51 2023 +0000 bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25 v1.25 of pahole supports filtering out functions with multiple inconsistent function prototypes or optimized-out parameters from the BTF representation. These present problems because there is no additional info in BTF saying which inconsistent prototype matches which function instance to help guide attachment, and functions with optimized-out parameters can lead to incorrect assumptions about register contents. So for now, filter out such functions while adding BTF representations for functions that have "."-suffixes (foo.isra.0) but not optimized-out parameters. This patch assumes that below linked changes land in pahole for v1.25. Signed-off-by: Alan Maguire Signed-off-by: Daniel Borkmann Tested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/1675790102-23037-1-git-send-email-alan.maguire@oracle.com Link: https://lore.kernel.org/bpf/1675949331-27935-1-git-send-email-alan.maguire@oracle.com commit d588adae3b97241ee2e837a4dd74674b9a209cd6 Author: Filipe Manana Date: Wed Jan 11 11:36:17 2023 +0000 btrfs: add an api to delete a specific entry from the lru cache In order to replace the open coded name cache in send with the lru cache, we need an API for the lru cache to delete a specific entry for which we did a previous lookup. This adds the API for it, and a next patch in the series will use it. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0da0c5605ed1e6c8138d9c40e5fcc84d3c99ad7b Author: Filipe Manana Date: Wed Jan 11 11:36:16 2023 +0000 btrfs: allow a generation number to be associated with lru cache entries This allows an optional generation number to be associated to each entry of the lru cache. Entries with the same key but different generations, are stored in the linked list to which the maple tree points to. This is meant to be used when there's a small number of different generations, so the impact of searching a linked list is negligible. The goal is to get rid of the open coded name cache in the send code (which uses a radix tree and a similar linked list of values/entries) and use instead the lru cache module. For that particular use case we have at most 2 generations that are associated to each key (inode number): one generation for the send root and another generation for the parent root. The actual migration of the send name cache is done in the next patch in the series. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e8a7f49d9bfce2fc359cc698d98c8b95dce24c6f Author: Filipe Manana Date: Wed Jan 11 11:36:15 2023 +0000 btrfs: send: cache information about created directories During an incremental send, when processing the reference for an inode we need to check if the directory where the new reference is located was already created before creating the new reference. This check, which is done by the helper did_create_dir(), can be expensive if the directory has many entries, since it consists in searching the send root's b+tree and visiting every single dir index key until we either find one which points to an inode with a number smaller than the current inode's number or until we visited all index keys. So it doesn't scale well for very large directories. So improve on this by caching created directories using a lru cache, and limiting its size to 64 entries, which results in using at most 4096 bytes of memory. The caching is optional, if we fail to allocate memory, we just proceed as before and use the existing slower path. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6273ee621f3d5829667943c1f53d8115752b45aa Author: Filipe Manana Date: Wed Jan 11 11:36:14 2023 +0000 btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems The lru cache is backed by a maple tree, which uses the unsigned long type for keys, and that type has a width of 32 bits on 32 bits systems and a width of 64 bits on 64 bits systems. Currently there is only one user of the lru cache, the send backref cache, which uses a sector number as a key, a logical address right shifted by fs_info->sectorsize_bits, so a 32 bits width is not yet a problem (the same happens with the radix tree we use to track extent buffers, fs_info->buffer_radix). However the next patches in the series will start using the lru cache for cases where inode numbers are the keys, and the inode numbers are always 64 bits, even if we are running on a 32 bits system. So adapt the lru cache to allow multiple values under the same key, by having the maple tree store a head entry that points to a list of entries instead of pointing to a single entry. This is a similar approach to what we currently do for the name cache in send (which uses a radix tree that has indexes with an unsigned long type as well), and will allow later to use the lru cache for the send name cache as well. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 90b90d4ac03cbaaa87a81ee04e9cdd9b4225cdd4 Author: Filipe Manana Date: Wed Jan 11 11:36:13 2023 +0000 btrfs: send: genericize the backref cache to allow it to be reused The backref cache is a cache backed by a maple tree and a linked list to keep track of temporal access to cached entries (the LRU entry always at the head of the list). This type of caching method is going to be useful in other scenarios, so make the cache implementation more generic and move it into its own header and source files. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d307d2f35ca5c57ef2966d2a7ccb2de1118f61f4 Author: Filipe Manana Date: Wed Jan 11 11:36:12 2023 +0000 btrfs: send: initialize all the red black trees earlier After we allocate the send context object and before we initialize all the red black trees, we can jump to the 'out' label if some errors happen, and then under the 'out' label we use RB_EMPTY_ROOT() against some of the those trees, which we have not yet initialized. This happens to work out ok because the send context object was initialized to zeroes with kzalloc and the RB_ROOT initializer just happens to have the following definition: #define RB_ROOT (struct rb_root) { NULL, } But it's really neither clean nor a good practice as RB_ROOT is supposed to be opaque and in case it changes or we change those red black trees to some other data structure, it leaves us in a precarious situation. So initialize all the red black trees immediately after allocating the send context and before any jump into the 'out' label. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8c139e1d780665648c74811d36719ef467c32306 Author: Filipe Manana Date: Wed Jan 11 11:36:10 2023 +0000 btrfs: send: iterate waiting dir move rbtree only once when processing refs When processing the new references for an inode, we unnecessarily iterate twice the waiting dir moves rbtree, once with is_waiting_for_move() and if we found an entry in the rbtree, we iterate it again with a call to get_waiting_dir_move(). This is pointless, we can make this simpler and more efficient by calling only get_waiting_dir_move(), so just do that. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 474e4761f6e8b700612d409327661290d7e58d77 Author: Filipe Manana Date: Wed Jan 11 11:36:09 2023 +0000 btrfs: send: reduce searches on parent root when checking if dir can be removed During an incremental send, every time we remove a reference (dentry) for an inode and the parent directory does not exists anymore in the send root, we go check if we can remove the directory by making a call to can_rmdir(). This helper can only return true (value 1) if all dentries were already removed, and for that it always does a search on the parent root for dir index keys - if it finds any dentry referring to an inode with a number higher then the inode currently being processed, then the directory can not be removed and it must return false (value 0). However that means if a directory that was deleted had 1000 dentries, and each one pointed to an inode with a number higher then the number of the directory's inode, we end up doing 1000 searches on the parent root. Typically files are created in a directory after the directory was created and therefore they get an higher inode number than the directory. It's also common to have the each dentry pointing to an inode with a higher number then the inodes the previous dentries point to, for example when creating a series of files inside a directory, a very common pattern. So improve on that by having the first call to can_rmdir() for a directory to check the number of the inode that the last dentry points to and cache that inode number in the orphan dir structure. Then every subsequent call to can_rmdir() can avoid doing a search on the parent root if the number of the inode currently being processed is smaller than cached inode number at the directory's orphan dir structure. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 78cf1a954da52a4b290992f2c32dfbf0ffc9ba45 Author: Filipe Manana Date: Wed Jan 11 11:36:08 2023 +0000 btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() At can_rmdir() we start by searching the orphan dirs rbtree for an orphan dir object for the target directory. Later when iterating over the dir index keys, if we find that any dir entry points to inode for which there is a pending dir move or the inode was not yet processed, we exit because we can't remove the directory yet. However we end up always calling add_orphan_dir_info(), which will iterate again the rbtree and if there is already an orphan dir object (created by the first call to can_rmdir()), it returns the existing object. This is unnecessary work because in case there is already an existing orphan dir object, we got a reference to it at the start of can_rmdir(). So skip the call to add_orphan_dir_info() if we already have a reference for an orphan dir object. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d921b9cf91e1f84a39f4beab5c824b9c8ad87c0c Author: Filipe Manana Date: Wed Jan 11 11:36:07 2023 +0000 btrfs: send: avoid duplicated orphan dir allocation and initialization At can_rmdir() we are allocating and initializing an orphan dir object twice. This can be deduplicated outside of the loop that iterates over the dir index keys. So deduplicate that code, even because other patch in the series will need to add more initialization code and another one will add one more condition. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 24970ccb2489c8c087d12659df7f74ef1a966a67 Author: Filipe Manana Date: Wed Jan 11 11:36:06 2023 +0000 btrfs: send: remove send_progress argument from can_rmdir() All callers of can_rmdir() pass sctx->cur_ino as the value for the send_progress argument, so remove the argument and directly use sctx->cur_ino. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 498581f33c9e60bfdfd28a8565e0ea81a1748aa3 Author: Filipe Manana Date: Wed Jan 11 11:36:05 2023 +0000 btrfs: send: avoid extra b+tree searches when checking reference overrides During an incremental send, when processing the new references of an inode (either it's a new inode or an existing one renamed/moved), he will search the b+tree of the send or parent roots in order to find out the inode item of the parent directory and extract its generation. However we are doing that search twice, once with is_inode_existent() -> get_cur_inode_state() and then again at did_overwrite_ref() or will_overwrite_ref(). So avoid that and get the generation at get_cur_inode_state() and then propagate it up to did_overwrite_ref() and will_overwrite_ref(). This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b3047a42f55d8524b23d58c6ee1c75024d901823 Author: Filipe Manana Date: Wed Jan 11 11:36:04 2023 +0000 btrfs: send: directly return from will_overwrite_ref() and simplify it There are no resources to release before will_overwrite_ref() returns, so we don't really need the 'out' label and jumping to it when conditions are met - we can directly return and get rid of the label and jumps. Also we can deal with -ENOENT and other errors in a single if-else logic, as it's more straightforward. This helps the next patch in the series to be more simple as well. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cb689481947a36c4b0e885d21a315ff9ffbb87ab Author: Filipe Manana Date: Wed Jan 11 11:36:03 2023 +0000 btrfs: send: avoid unnecessary generation search at did_overwrite_ref() At did_overwrite_ref() we always call get_inode_gen() to find out the generation of the inode 'ow_inode'. However we don't always need to use that generation, and in fact it's very common to not use it, so we end up doing a b+tree search on the send root, allocating a path, etc, for nothing. So improve on this by getting the generation only if we need to use it. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e739ba307f3a467cd92b37ca92b64571fcfd7cfe Author: Filipe Manana Date: Wed Jan 11 11:36:02 2023 +0000 btrfs: send: directly return from did_overwrite_ref() and simplify it There are no resources to release before did_overwrite_ref() returns, so we don't really need the 'out' label and jumping to it when conditions are met - we can directly return and get rid of the label and jumps. Also we can deal with -ENOENT and other errors in a single if-else logic, as it's more straightforward. This helps the next patch in the series to be more simple as well. This patch is part of a larger patchset and the changelog of the last patch in the series contains a sample performance test and results. The patches that comprise the patchset are the following: btrfs: send: directly return from did_overwrite_ref() and simplify it btrfs: send: avoid unnecessary generation search at did_overwrite_ref() btrfs: send: directly return from will_overwrite_ref() and simplify it btrfs: send: avoid extra b+tree searches when checking reference overrides btrfs: send: remove send_progress argument from can_rmdir() btrfs: send: avoid duplicated orphan dir allocation and initialization btrfs: send: avoid unnecessary orphan dir rbtree search at can_rmdir() btrfs: send: reduce searches on parent root when checking if dir can be removed btrfs: send: iterate waiting dir move rbtree only once when processing refs btrfs: send: initialize all the red black trees earlier btrfs: send: genericize the backref cache to allow it to be reused btrfs: adapt lru cache to allow for 64 bits keys on 32 bits systems btrfs: send: cache information about created directories btrfs: allow a generation number to be associated with lru cache entries btrfs: add an api to delete a specific entry from the lru cache btrfs: send: use the lru cache to implement the name cache btrfs: send: update size of roots array for backref cache entries btrfs: send: cache utimes operations for directories if possible Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b7625f461da6734a21c38ba6e7558538a116a2e3 Author: Qu Wenruo Date: Fri Jan 13 19:11:39 2023 +0800 btrfs: sysfs: update fs features directory asynchronously [BUG] Since the introduction of per-fs feature sysfs interface (/sys/fs/btrfs//features/), the content of that directory is never updated. Thus for the following case, that directory will not show the new features like RAID56: # mkfs.btrfs -f $dev1 $dev2 $dev3 # mount $dev1 $mnt # btrfs balance start -f -mconvert=raid5 $mnt # ls /sys/fs/btrfs/$uuid/features/ extended_iref free_space_tree no_holes skinny_metadata While after unmount and mount, we got the correct features: # umount $mnt # mount $dev1 $mnt # ls /sys/fs/btrfs/$uuid/features/ extended_iref free_space_tree no_holes raid56 skinny_metadata [CAUSE] Because we never really try to update the content of per-fs features/ directory. We had an attempt to update the features directory dynamically in commit 14e46e04958d ("btrfs: synchronize incompat feature bits with sysfs files"), but unfortunately it get reverted in commit e410e34fad91 ("Revert "btrfs: synchronize incompat feature bits with sysfs files""). The problem in the original patch is, in the context of btrfs_create_chunk(), we can not afford to update the sysfs group. The exported but never utilized function, btrfs_sysfs_feature_update() is the leftover of such attempt. As even if we go sysfs_update_group(), new files will need extra memory allocation, and we have no way to specify the sysfs update to go GFP_NOFS. [FIX] This patch will address the old problem by doing asynchronous sysfs update in the cleaner thread. This involves the following changes: - Make __btrfs_(set|clear)_fs_(incompat|compat_ro) helpers to set BTRFS_FS_FEATURE_CHANGED flag when needed - Update btrfs_sysfs_feature_update() to use sysfs_update_group() And drop unnecessary arguments. - Call btrfs_sysfs_feature_update() in cleaner_kthread If we have the BTRFS_FS_FEATURE_CHANGED flag set. - Wake up cleaner_kthread in btrfs_commit_transaction if we have BTRFS_FS_FEATURE_CHANGED flag By this, all the previously dangerous call sites like btrfs_create_chunk() need no new changes, as above helpers would have already set the BTRFS_FS_FEATURE_CHANGED flag. The real work happens at cleaner_kthread, thus we pay the cost of delaying the update to sysfs directory, but the delayed time should be small enough that end user can not distinguish though it might get delayed if the cleaner thread is busy with removing subvolumes or defrag. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Anand Jain Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 58e36c2a0191768ddfc0c529f2bfb1630b18c10b Author: ye xingchen Date: Mon Jan 16 15:58:44 2023 +0800 btrfs: remove duplicate include header in extent-tree.c extent-tree.h is included more than once, added in a0231804affe ("btrfs: move extent-tree helpers into their own header file"). Signed-off-by: ye xingchen Reviewed-by: David Sterba Signed-off-by: David Sterba commit 28232909ba43561887508a6ef46d7f33a648f375 Author: Qu Wenruo Date: Sat Dec 17 10:34:29 2022 +0800 btrfs: scrub: improve tree block error reporting [BUG] When debugging a scrub related metadata error, it turns out that our metadata error reporting is not ideal. The only 3 error messages are: - BTRFS error (device dm-2): bdev /dev/mapper/test-scratch1 errs: wr 0, rd 0, flush 0, corrupt 0, gen 1 Showing we have metadata generation mismatch errors. - BTRFS error (device dm-2): unable to fixup (regular) error at logical 7110656 on dev /dev/mapper/test-scratch1 Showing which tree blocks are corrupted. - BTRFS warning (device dm-2): checksum/header error at logical 24772608 on dev /dev/mapper/test-scratch2, physical 3801088: metadata node (level 1) in tree 5 Showing which physical range the corrupted metadata is at. We have to combine the above 3 to know we have a corrupted metadata with generation mismatch. And this is already the better case, if we have other problems, like fsid mismatch, we can not even know the cause. [CAUSE] The problem is caused by the fact that, scrub_checksum_tree_block() never outputs any error message. It just return two bits for scrub: sblock->header_error, and sblock->generation_error. And later we report error in scrub_print_warning(), but unfortunately we only have two bits, there is not really much thing we can done to print any detailed errors. [FIX] This patch will do the following to enhance the error reporting of metadata scrub: - Add extra warning (ratelimited) for every error we hit This can help us to distinguish the different types of errors. Some errors can help us to know what's going wrong immediately, like bytenr mismatch. - Re-order the checks Currently we check bytenr first, then immediately generation. This can lead to false generation mismatch reports, while the fsid mismatches. Here is the new output for the bug I'm debugging (we forgot to writeback tree blocks for commit roots): BTRFS warning (device dm-2): tree block 24117248 mirror 1 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc BTRFS warning (device dm-2): tree block 24117248 mirror 0 has bad fsid, has b77cd862-f150-4c71-90ec-7baf0544d83f want 17df6abf-23cd-445f-b350-5b3e40bfd2fc Now we can immediately know it's some tree blocks didn't even get written back, other than the original confusing generation mismatch. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit cb0922f264643f03b04352f7a04abb913c609369 Author: Boris Burkov Date: Thu Dec 15 16:06:35 2022 -0800 btrfs: don't use size classes for zoned file systems When a file system has ZNS devices which are constrained by a maximum number of active block groups, then not being able to use all the block groups for every allocation is not ideal, and could cause us to loop a ton with mixed size allocations. In general, since zoned doesn't write into gaps behind where block groups are writing, it is not susceptible to the same sort of fragmentation that size classes are designed to solve, so we can skip size classes for zoned file systems in general, even though there would probably be no harm for SMR devices. Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit c7eec3d9aa955cbd00470f874f34bdba946bd101 Author: Boris Burkov Date: Thu Dec 15 16:06:34 2022 -0800 btrfs: load block group size class when caching Since the size class is an artifact of an arbitrary anti fragmentation strategy, it doesn't really make sense to persist it. Furthermore, most of the size class logic assumes fresh block groups. That is of course not a reasonable assumption -- we will be upgrading kernels with existing filesystems whose block groups are not classified. To work around those issues, implement logic to compute the size class of the block groups as we cache them in. To perfectly assess the state of a block group, we would have to read the entire extent tree (since the free space cache mashes together contiguous extent items) which would be prohibitively expensive for larger file systems with more extents. We can do it relatively cheaply by implementing a simple heuristic of sampling a handful of extents and picking the smallest one we see. In the happy case where the block group was classified, we will only see extents of the correct size. In the unhappy case, we will hopefully find one of the smaller extents, but there is no perfect answer anyway. Autorelocation will eventually churn up the block group if there is significant freeing anyway. There was no regression in mount performance at end state of the fsperf test suite, and the delay until the block group is marked cached is minimized by the constant number of extent samples. Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 52bb7a2166af490317ce2cca1865b6630e86aca8 Author: Boris Burkov Date: Thu Dec 15 16:06:33 2022 -0800 btrfs: introduce size class to block group allocator The aim of this patch is to reduce the fragmentation of block groups under certain unhappy workloads. It is particularly effective when the size of extents correlates with their lifetime, which is something we have observed causing fragmentation in the fleet at Meta. This patch categorizes extents into size classes: - x < 128KiB: "small" - 128KiB < x < 8MiB: "medium" - x > 8MiB: "large" and as much as possible reduces allocations of extents into block groups that don't match the size class. This takes advantage of any (possible) correlation between size and lifetime and also leaves behind predictable re-usable gaps when extents are freed; small writes don't gum up bigger holes. Size classes are implemented in the following way: - Mark each new block group with a size class of the first allocation that goes into it. - Add two new passes to ffe: "unset size class" and "wrong size class". First, try only matching block groups, then try unset ones, then allow allocation of new ones, and finally allow mismatched block groups. - Filtering is done just by skipping inappropriate ones, there is no special size class indexing. Other solutions I considered were: - A best fit allocator with an rb-tree. This worked well, as small writes didn't leak big holes from large freed extents, but led to regressions in ffe and write performance due to lock contention on the rb-tree with every allocation possibly updating it in parallel. Perhaps something clever could be done to do the updates in the background while being "right enough". - A fixed size "working set". This prevents freeing an extent drastically changing where writes currently land, and seems like a good option too. Doesn't take advantage of size in any way. - The same size class idea, but implemented with xarray marks. This turned out to be slower than looping the linked list and skipping wrong block groups, and is also less flexible since we must have only 3 size classes (max #marks). With the current approach we can have as many as we like. Performance testing was done via: https://github.com/josefbacik/fsperf Of particular relevance are the new fragmentation specific tests. A brief summary of the testing results: - Neutral results on existing tests. There are some minor regressions and improvements here and there, but nothing that truly stands out as notable. - Improvement on new tests where size class and extent lifetime are correlated. Fragmentation in these cases is completely eliminated and write performance is generally a little better. There is also significant improvement where extent sizes are just a bit larger than the size class boundaries. - Regression on one new tests: where the allocations are sized intentionally a hair under the borders of the size classes. Results are neutral on the test that intentionally attacks this new scheme by mixing extent size and lifetime. The full dump of the performance results can be found here: https://bur.io/fsperf/size-class-2022-11-15.txt (there are ANSI escape codes, so best to curl and view in terminal) Here is a snippet from the full results for a new test which mixes buffered writes appending to a long lived set of files and large short lived fallocates: bufferedappendvsfallocate results metric baseline current stdev diff ====================================================================================== avg_commit_ms 31.13 29.20 2.67 -6.22% bg_count 14 15.60 0 11.43% commits 11.10 12.20 0.32 9.91% elapsed 27.30 26.40 2.98 -3.30% end_state_mount_ns 11122551.90 10635118.90 851143.04 -4.38% end_state_umount_ns 1.36e+09 1.35e+09 12248056.65 -1.07% find_free_extent_calls 116244.30 114354.30 964.56 -1.63% find_free_extent_ns_max 599507.20 1047168.20 103337.08 74.67% find_free_extent_ns_mean 3607.19 3672.11 101.20 1.80% find_free_extent_ns_min 500 512 6.67 2.40% find_free_extent_ns_p50 2848 2876 37.65 0.98% find_free_extent_ns_p95 4916 5000 75.45 1.71% find_free_extent_ns_p99 20734.49 20920.48 1670.93 0.90% frag_pct_max 61.67 0 8.05 -100.00% frag_pct_mean 43.59 0 6.10 -100.00% frag_pct_min 25.91 0 16.60 -100.00% frag_pct_p50 42.53 0 7.25 -100.00% frag_pct_p95 61.67 0 8.05 -100.00% frag_pct_p99 61.67 0 8.05 -100.00% fragmented_bg_count 6.10 0 1.45 -100.00% max_commit_ms 49.80 46 5.37 -7.63% sys_cpu 2.59 2.62 0.29 1.39% write_bw_bytes 1.62e+08 1.68e+08 17975843.50 3.23% write_clat_ns_mean 57426.39 54475.95 2292.72 -5.14% write_clat_ns_p50 46950.40 42905.60 2101.35 -8.62% write_clat_ns_p99 148070.40 143769.60 2115.17 -2.90% write_io_kbytes 4194304 4194304 0 0.00% write_iops 2476.15 2556.10 274.29 3.23% write_lat_ns_max 2101667.60 2251129.50 370556.59 7.11% write_lat_ns_mean 59374.91 55682.00 2523.09 -6.22% write_lat_ns_min 17353.10 16250 1646.08 -6.36% There are some mixed improvements/regressions in most metrics along with an elimination of fragmentation in this workload. On the balance, the drastic 1->0 improvement in the happy cases seems worth the mix of regressions and improvements we do observe. Some considerations for future work: - Experimenting with more size classes - More hinting/search ordering work to approximate a best-fit allocator Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 854c2f365d7e0b5b1250953e03860f09a7847c39 Author: Boris Burkov Date: Thu Dec 15 16:06:32 2022 -0800 btrfs: add more find_free_extent tracepoints find_free_extent is a complicated function. It consists (at least) of: - a hint that jumps into the middle of a for loop macro - a middle loop trying every raid level - an outer loop ascending through ffe loop levels - complicated logic for skipping some of those ffe loop levels - multiple underlying in-bg allocators (zoned, cluster, no cluster) Which is all to say that more tracing is helpful for debugging its behavior. Add two new tracepoints: at the entrance to the block_groups loop (hit for every raid level and every ffe_ctl loop) and at the point we seriously consider a block_group for allocation. This way we can see the whole path through the algorithm, including hints, multiple loops, etc. Reviewed-by: Johannes Thumshirn Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit cfc2de0fce015d4249c674ef9f5e0b4817ba5c53 Author: Boris Burkov Date: Thu Dec 15 16:06:31 2022 -0800 btrfs: pass find_free_extent_ctl to allocator tracepoints The allocator tracepoints currently have a pile of values from ffe_ctl. In modifying the allocator and adding more tracepoints, I found myself adding to the already long argument list of the tracepoints. It makes it a lot simpler to just send in the ffe_ctl itself. Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 36d4556745fe60e0e3c8d9933c2610b1c641b2f0 Author: Christoph Hellwig Date: Mon Dec 12 08:12:43 2022 +0100 btrfs: remove the wait argument to btrfs_start_ordered_extent Given that wait is always set to 1, so remove the argument. Last use of wait with 0 was in 0c304304feab ("Btrfs: remove csum_bytes_left"). Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 235e1c7b872f9cf16e8a3e6050a05774b8763c58 Author: Filipe Manana Date: Tue Jan 10 14:56:41 2023 +0000 btrfs: use a single variable to track return value for log_dir_items() We currently use 'ret' and 'err' to track the return value for log_dir_items(), which is confusing and likely the cause for previous bugs where log_dir_items() did not return an error when it should, fixed in previous patches. So change this and use only a single variable, 'ret', to track the return value. This is simpler and makes it similar to most of the existing code. Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 5cce1780dc47906fa06c7be850532c4d1a43822c Author: Filipe Manana Date: Tue Jan 10 14:56:40 2023 +0000 btrfs: use a negative value for BTRFS_LOG_FORCE_COMMIT Currently we use the value 1 for BTRFS_LOG_FORCE_COMMIT, but that value has a few inconveniences: 1) If it's ever used by btrfs_log_inode(), or any function down the call chain, we have to remember to btrfs_set_log_full_commit(), which is repetitive and has a chance to be forgotten in future use cases. btrfs_log_inode_parent() only calls btrfs_set_log_full_commit() when it gets a negative value from btrfs_log_inode(); 2) Down the call chain of btrfs_log_inode(), we may have functions that need to force a log commit, but can return either an error (negative value), false (0) or true (1). So they are forced to return some random negative to force a log commit - using BTRFS_LOG_FORCE_COMMIT would make the intention more clear. Currently the only example is flush_dir_items_batch(). So turn BTRFS_LOG_FORCE_COMMIT into a negative value. The chosen value is -(MAX_ERRNO + 1), so that it does not overlap any errno value and makes it easier to debug. Reviewed-by: Josef Bacik Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ce394a7f39032bc2a85b070af608e3ae8b2cefda Author: Yushan Zhou Date: Tue Jan 3 13:11:37 2023 +0800 btrfs: use PAGE_{ALIGN, ALIGNED, ALIGN_DOWN} macro The header file linux/mm.h provides PAGE_ALIGN, PAGE_ALIGNED, PAGE_ALIGN_DOWN macros. Use these macros to make code more concise. Signed-off-by: Yushan Zhou Reviewed-by: David Sterba Signed-off-by: David Sterba commit d31de3785047a24959eda835b0bafb1f8629f8a9 Author: Peng Hao Date: Mon Jan 9 21:08:31 2023 +0100 btrfs: go to matching label when cleaning em in btrfs_submit_direct When btrfs_get_chunk_map fails to allocate a new em the cleanup does not need to be done so the goto target is out_err, which is consistent with current coding style. Signed-off-by: Peng Hao Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba commit 1ec49744ba83f0429c5c706708610f7821a7b6f4 Author: Josef Bacik Date: Fri Dec 16 15:15:58 2022 -0500 btrfs: turn on -Wmaybe-uninitialized We had a recent bug that would have been caught by a newer compiler with -Wmaybe-uninitialized and would have saved us a month of failing tests that I didn't have time to investigate. Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit a6ca692ec22bdac5ae700e82ff575a1b5141fa40 Author: Josef Bacik Date: Fri Dec 16 15:15:51 2022 -0500 btrfs: fix uninitialized variable warning in run_one_async_start With -Wmaybe-uninitialized compiler complains about ret being possibly uninitialized, which isn't possible as the WQ_ constants are set only from our code, however we can handle the default case and get rid of the warning. The value is set to BLK_STS_IOERR so it does not issue any IO and could be potentially detected, but this is basically a "cannot happen" error. To catch any problems during development use the assert. Signed-off-by: Josef Bacik Reviewed-by: David Sterba [ set the error in default: ] Signed-off-by: David Sterba commit cd30d3bc78d9acbd505d0d6a4cff3b87e40a8187 Author: Naohiro Aota Date: Wed Dec 21 16:47:45 2022 +0000 btrfs: zoned: fix uninitialized variable warning in btrfs_get_dev_zones Fix an uninitialized warning we get with -Wmaybe-uninitialized where it thought zno may have been uninitialized, in both cases it depends on zinfo->zone_cache but we know the value won't change between checks. Reported-by: Josef Bacik Link: https://lore.kernel.org/linux-btrfs/af6c527cbd8bdc782e50bd33996ee83acc3a16fb.1671221596.git.josef@toxicpanda.com/ Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit 12adffe6cfb8e279e8ab49504501d894ff79822a Author: Josef Bacik Date: Fri Dec 16 15:15:57 2022 -0500 btrfs: fix uninitialized variable warning in btrfs_sb_log_location We only have 3 possible mirrors, and we have ASSERT()'s to make sure we're not passing in an invalid super mirror into this function, so technically this value isn't uninitialized. However -Wmaybe-uninitialized will complain, so set it to U64_MAX so if we don't have ASSERT()'s turned on it'll error out later on when it see's the zone is beyond our maximum zones. Reviewed-by: Naohiro Aota Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 598643250c47c2a2e2339f25e2be36165eb229a9 Author: Josef Bacik Date: Fri Dec 16 15:15:55 2022 -0500 btrfs: fix uninitialized variable warnings in __set_extent_bit and convert_extent_bit We will pass in the parent and p pointer into our tree_search function to avoid doing a second search when inserting a new extent state into the tree. However because this is conditional upon passing in these pointers the compiler seems to think these values can be uninitialized if we're using -Wmaybe-uninitialized. Fix this by initializing these values. Reviewed-by: Qu Wenruo Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit efbf35a102b20246cfe4409c6ae92e72ecb67ab8 Author: Josef Bacik Date: Fri Dec 16 15:15:54 2022 -0500 btrfs: fix uninitialized variable warning in btrfs_update_block_group reclaim isn't set in the alloc case, however we only care about reclaim in the !alloc case. This isn't an actual problem, however -Wmaybe-uninitialized will complain, so initialize reclaim to quiet the compiler. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit ab199013592abb3499b8316a800a39ab61e6719f Author: Josef Bacik Date: Fri Dec 16 15:15:53 2022 -0500 btrfs: fix uninitialized variable warning in get_inode_gen Anybody that calls get_inode_gen() can have an uninitialized gen if there's an error. This isn't a big deal because all the users just exit if they get an error, however it makes -Wmaybe-uninitialized complain, so fix this up to always initialize the passed in gen, this quiets all of the uninitialized warnings in send.c. Reviewed-by: Qu Wenruo Reviewed-by: Qu Wenruo Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0e47b25cafb29338722f68e8c5a260aaf18ce92c Author: Josef Bacik Date: Fri Dec 16 15:15:52 2022 -0500 btrfs: fix uninitialized variable warning in btrfs_cleanup_ordered_extents We can conditionally pass in a locked page, and then we'll use that page range to skip marking errors as that will happen in another layer. However this causes the compiler to complain because it doesn't understand we only use these values when we have the page. Make the compiler stop complaining by setting these values to 0. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit fccf0c842ed4857cff8067b72a79fcf64d972c2f Author: Josef Bacik Date: Wed Dec 7 10:18:04 2022 -0500 btrfs: move btrfs_abort_transaction to transaction.c While trying to sync messages.[ch] I ended up with this dependency on messages.h in the rest of btrfs-progs code base because it's where btrfs_abort_transaction() was now held. We want to keep messages.[ch] limited to the kernel code, and the btrfs_abort_transaction() code better fits in the transaction code and not in messages. Reviewed-by: Johannes Thumshirn Signed-off-by: Josef Bacik Reviewed-by: David Sterba [ move the __cold attributes ] Signed-off-by: David Sterba commit 0c555c97ef5a96b57c8955bb3cc1be9d3fbf166e Author: Johannes Thumshirn Date: Mon Dec 12 01:02:49 2022 -0800 btrfs: directly pass in fs_info to btrfs_merge_delayed_refs Now that none of the functions called by btrfs_merge_delayed_refs() needs a btrfs_trans_handle, directly pass in a btrfs_fs_info to btrfs_merge_delayed_refs(). Reviewed-by: Qu Wenruo Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit afe2d748b08ad15ae945ad3b0c2408f8b7ecea22 Author: Johannes Thumshirn Date: Mon Dec 12 01:02:48 2022 -0800 btrfs: drop trans parameter of insert_delayed_ref Now that drop_delayed_ref() doesn't need a btrfs_trans_handle, drop it from insert_delayed_ref() as well. Reviewed-by: Qu Wenruo Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit f09f7851b78b2fdb9d4c3bd5b1a086ab2ab955dd Author: Johannes Thumshirn Date: Mon Dec 12 01:02:47 2022 -0800 btrfs: remove trans parameter of merge_ref Now that drop_delayed_ref() doesn't get the btrfs_trans_handle passed in anymore, we can get rid of it in merge_ref() as well. Reviewed-by: Qu Wenruo Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4c89493f35c4a8143b7bdc23ff446ddbadfb39d9 Author: Johannes Thumshirn Date: Mon Dec 12 01:02:46 2022 -0800 btrfs: drop unused trans parameter of drop_delayed_ref drop_delayed_ref() doesn't use the btrfs_trans_handle it gets passed in, so remove it. Reviewed-by: Qu Wenruo Reviewed-by: Josef Bacik Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1c30e9c0c8ebce7e0ad12a8b01804253823b21f6 Author: Krzysztof Kozlowski Date: Wed Jan 18 18:54:13 2023 +0100 dt-bindings: net: wireless: minor whitespace and name cleanups Minor cleanups: - Drop redundant blank lines, - Correct indentaion in examples, - Correct node names in examples to drop underscore and use generic name. No functional impact except adjusting to preferred coding style. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230118175413.360153-1-krzysztof.kozlowski@linaro.org commit 037d05af382e2915f0a9d028019152b4e2a23ec3 Author: Vinod Koul Date: Mon Feb 13 10:39:26 2023 +0530 phy: qcom: snps-eusb2: Add missing headers The driver was missing to include couple of headers explictly which causes build to fail on other archs drivers/phy/qualcomm/phy-qcom-snps-eusb2.c: In function 'qcom_snps_eusb2_hsphy_write_mask': drivers/phy/qualcomm/phy-qcom-snps-eusb2.c:147:15: error: implicit declaration of function 'readl_relaxed' [-Werror=implicit-function-declaration] 147 | reg = readl_relaxed(base + offset); | ^~~~~~~~~~~~~ drivers/phy/qualcomm/phy-qcom-snps-eusb2.c:150:9: error: implicit declaration of function 'writel_relaxed' [-Werror=implicit-function-declaration] 150 | writel_relaxed(reg, base + offset); | ^~~~~~~~~~~~~~ drivers/phy/qualcomm/phy-qcom-snps-eusb2.c: In function 'qcom_eusb2_default_parameters': drivers/phy/qualcomm/phy-qcom-snps-eusb2.c:161:42: error: implicit declaration of function 'FIELD_PREP' [-Werror=implicit-function-declaration] 161 | FIELD_PREP(PHY_CFG_TX_PREEMP_TUNE_MASK, 0)); | ^~~~~~~~~~ Fix this by adding bitfield.h and iopoll.h explictly Fixes: 80090810f5d3 ("phy: qcom: Add QCOM SNPS eUSB2 driver") Reported-by: Stephen Rothwell Reported-by: kernel test robot Signed-off-by: Vinod Koul commit f9901f64536c39f699e6ed228c5e64e7e7ce8708 Author: Krzysztof Kozlowski Date: Wed Jan 25 12:34:18 2023 +0100 cpuidle: psci: Do not suspend topology CPUs on PREEMPT_RT The runtime Power Management of CPU topology is not compatible with PREEMPT_RT: 1. Core cpuidle path disables IRQs. 2. Core cpuidle calls cpuidle-psci. 3. cpuidle-psci in __psci_enter_domain_idle_state() calls pm_runtime_put_sync_suspend() and pm_runtime_get_sync() which use spinlocks (which are sleeping on PREEMPT_RT). Deep sleep modes are not a priority of Realtime kernels because the latencies might become unpredictable. On the other hand the PSCI CPU idle power domain is a parent of other devices and power domain controllers, thus it cannot be simply skipped (e.g. on Qualcomm SM8250). Disable the idle callbacks in cpuidle-psci and mark the domain as always on. This is a trade-off between making PREEMPT_RT working and still having a proper power domain hierarchy in the system. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Ulf Hansson Tested-by: Adrien Thierry Signed-off-by: Rafael J. Wysocki commit e947925f10c250ba3ad2d905006b2e632510310c Author: Keguang Zhang Date: Fri Feb 10 19:09:34 2023 +0800 MIPS: loongson32: Drop obsolete cpufreq platform device The obsolete cpufreq driver was removed, drop the platform device and data accordingly. Link: https://lore.kernel.org/all/20230112135342.3927338-1-keguang.zhang@gmail.com Signed-off-by: Keguang Zhang Signed-off-by: Rafael J. Wysocki commit 9e34fad00fc889abbb99d751a4c22cf2bded10df Author: Guillaume Tucker Date: Thu Feb 9 09:55:36 2023 +0100 selftests: use printf instead of echo -ne Rather than trying to guess which implementation of "echo" to run with support for "-ne" options, use "printf" instead of "echo -ne". It handles escape characters as a standard feature and it is widespread among modern shells. Reported-by: "kernelci.org bot" Suggested-by: David Laight Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile") Fixes: 79c16b1120fe ("selftests: find echo binary to use -ne options") Signed-off-by: Guillaume Tucker Reviewed-by: Guenter Roeck Signed-off-by: Shuah Khan commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 Author: Masami Hiramatsu (Google) Date: Sun Jan 22 08:32:50 2023 +0900 selftests/ftrace: Fix bash specific "==" operator Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") introduced bash specific "==" comparation operator, that test will fail when we run it on a posix-shell. `checkbashisms` warned it as below. possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'): if [ "$e" == $val ]; then This replaces it with "=". Fixes: a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) Signed-off-by: Shuah Khan commit 787fccb321dd6c1c464bb11d952074edbde5de36 Author: Tzung-Bi Shih Date: Fri Feb 3 18:14:30 2023 +0800 selftests: tpm2: remove redundant ord() When testing with FLAG_DEBUG enabled client, it emits the following error messages: File "/root/tpm2/tpm2.py", line 347, in hex_dump d = [format(ord(x), '02x') for x in d] File "/root/tpm2/tpm2.py", line 347, in d = [format(ord(x), '02x') for x in d] TypeError: ord() expected string of length 1, but int found The input of hex_dump() should be packed binary data. Remove the ord(). Signed-off-by: Tzung-Bi Shih Signed-off-by: Shuah Khan commit 4ebe33398c40c1118b4d8546978036c0e0032d1b Author: Guillaume Tucker Date: Fri Feb 3 16:26:03 2023 +0100 selftests: find echo binary to use -ne options Find the actual echo binary using $(which echo) and use it for formatted output with -ne. On some systems, the default echo command doesn't handle the -e option and the output looks like this (arm64 build): -ne Emit Tests for alsa -ne Emit Tests for amd-pstate -ne Emit Tests for arm64 This is for example the case with the KernelCI Docker images e.g. kernelci/gcc-10:x86-kselftest-kernelci. With the actual echo binary (e.g. in /bin/echo), the output is formatted as expected (x86 build this time): Emit Tests for alsa Emit Tests for amd-pstate Skipping non-existent dir: arm64 Only the install target is using "echo -ne" so keep the $ECHO variable local to it. Reported-by: "kernelci.org bot" Fixes: 3297a4df805d ("kselftests: Enable the echo command to print newlines in Makefile") Signed-off-by: Guillaume Tucker Signed-off-by: Shuah Khan commit 4b225d4f067f544b7594ce8a18216e19f0c1d692 Author: Colin Ian King Date: Thu Feb 2 12:56:21 2023 +0000 selftests: Fix spelling mistake "allright" -> "all right" There are two spelling mistakes in the test messages. Fix them. Signed-off-by: Colin Ian King Signed-off-by: Shuah Khan commit 5adbe55c8ba5c2d03add62386e4722d273e5b893 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:55 2023 -0500 selftests: tdx: Use installed kernel headers search path Use $(KHDR_INCLUDES) as lookup path for installed kernel headers rather than using kernel headers in include/uapi from the source kernel tree kernel headers. Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Signed-off-by: Shuah Khan commit 4c983a14238d6d4e95c5783b9d93dd4d4aeccdd9 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:54 2023 -0500 selftests: ptrace: Use installed kernel headers search path Use $(KHDR_INCLUDES) as lookup path for installed kernel headers rather than using kernel headers in include/uapi from the source kernel tree kernel headers. Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Signed-off-by: Shuah Khan commit a24ebb4937034e3b9459a5faf353c26af27f62be Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:53 2023 -0500 selftests: memfd: Use installed kernel headers search path Use $(KHDR_INCLUDES) as lookup path for installed kernel headers rather than using kernel headers in include/uapi from the source kernel tree kernel headers. Remove bogus ../../../../include/ from the search path, because kernel source headers are not needed by those user-space selftests, and it causes issues because -I paths are searched before -isystem paths, and conflicts for files appearing both in kernel sources and in uapi headers with incompatible semantics (e.g. types.h). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Signed-off-by: Shuah Khan commit 0d7a91678aaacf8e2f532c3e04a276af06b42d1c Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:52 2023 -0500 selftests: iommu: Use installed kernel headers search path Use $(KHDR_INCLUDES) as lookup path for installed kernel headers rather than using kernel headers in include/uapi from the source kernel tree kernel headers. Remove bogus ../../../../include/ from the search path, because kernel source headers are not needed by those user-space selftests, and it causes issues because -I paths are searched before -isystem paths, and conflicts for files appearing both in kernel sources and in uapi headers with incompatible semantics (e.g. types.h). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Signed-off-by: Shuah Khan commit ac5ec90e94fe8eddb4499e51398640fa6a89d657 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:50 2023 -0500 selftests: x86: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 8eb3751c73bec746f61fb6bada60d1074d92b8c3 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:49 2023 -0500 selftests: vm: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit f3886fd28987c119a98493f625cb9940b5f1c9a0 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:48 2023 -0500 selftests: user_events: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 5ad0c8e42c13623bd996e19ce76f2596e16eb0db Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:47 2023 -0500 selftests: sync: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Acked-by: Shuah Khan Signed-off-by: Shuah Khan commit 07d42dd854446ba3177ad7a217870a5b4edee165 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:46 2023 -0500 selftests: seccomp: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 0d2cace5af50806a6b32ab73d367b80e46acda0f Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:45 2023 -0500 selftests: sched: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 2279bfc03211045c8f43a76b01889a5ca86acd5a Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:44 2023 -0500 selftests: rseq: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 01ede99e9de16e7a1ed689c99f41022aa878f2f4 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:43 2023 -0500 selftests: ptp: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 3f7d71768795c386019f2295c1986d00035c9f0f Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:41 2023 -0500 selftests: pidfd: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit e81ff69f66969a16a98a2e0977c1860f1c182c74 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:40 2023 -0500 selftests: pid_namespace: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 465cbb1b9a9fd5f6907adb2d761facaf1a46bfbe Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:39 2023 -0500 selftests: perf_events: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 65c68af0131bfef8e395c325735b6c40638cb931 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:37 2023 -0500 selftests: move_mount_set_group: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 5d11f2d0eb39d2b5c5e8f05e1f650c4a4de69918 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:36 2023 -0500 selftests: mount_setattr: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 498bb027726371ba4a94686d251f9be1d437573e Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:35 2023 -0500 selftests: membarrier: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit f2f9592b736087f695230410fb8dc1afd3cafbbb Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:34 2023 -0500 selftests: media_tests: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 5d74231a2caad259f6669d8d6112814cef6bcd60 Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:33 2023 -0500 selftests: kcmp: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit ecf9fdb5c2a9d63c732acccb6318feb73dd1589f Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:32 2023 -0500 selftests: ipc: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 8bb9c1808628babcc7b99ec2439bf102379bd4ac Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:31 2023 -0500 selftests: gpio: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 24c55275ba0d538def2b1220002d0e808a85d50f Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:30 2023 -0500 selftests: futex: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit c2d3cf3653a8ff6e4b402d55e7f84790ac08a8ad Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:29 2023 -0500 selftests: filesystems: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit 07f0148aafe8c95a3a76cd59e9e75b4d78d1d31d Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:28 2023 -0500 selftests: drivers: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit f80f09b59fdd45753dd80ac623981ad00ece4c2d Author: Mathieu Desnoyers Date: Fri Jan 27 08:57:27 2023 -0500 selftests: dmabuf-heaps: Fix incorrect kernel headers search path Use $(KHDR_INCLUDES) as lookup path for kernel headers. This prevents building against kernel headers from the build environment in scenarios where kernel headers are installed into a specific output directory (O=...). Signed-off-by: Mathieu Desnoyers Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: Ingo Molnar Cc: # 5.18+ Signed-off-by: Shuah Khan commit cf835b005b2857c2fd763a006c1957f332e5254b Author: Zhang Rui Date: Sat Feb 11 11:17:10 2023 +0800 powercap: intel_rapl: Fix handling for large time window When setting the power limit time window, software updates the 'y' bits and 'f' bits in the power limit register, and the value hardware takes follows the formula below Time window = 2 ^ y * (1 + f / 4) * Time_Unit When handling large time window input from userspace, using left shifting breaks in two cases: 1. when ilog2(value) is bigger than 31, in expression "1 << y", left shifting by more than 31 bits has undefined behavior. This breaks 'y'. For example, on an Alderlake platform, "1 << 32" returns 1. 2. when ilog2(value) equals 31, "1 << 31" returns negative value because '1' is recognized as signed int. And this breaks 'f'. Given that 'y' has 5 bits and hardware can never take a value larger than 31, fix the first problem by clamp the time window to the maximum possible value that the hardware can take. Fix the second problem by using unsigned bit left shift. Note that hardware has its own maximum time window limitation, which may be lower than the time window value retrieved from the power limit register. When this happens, hardware clamps the input to its maximum time window limitation. That is why a software clamp is preferred to handle the problem on hand. Signed-off-by: Zhang Rui [ rjw: Adjusted the comment added by this change ] Signed-off-by: Rafael J. Wysocki commit 2f1e07dda1e1310873647abc40bbc49eaf3b10e3 Author: Liu Xiaodong Date: Fri Feb 10 09:13:56 2023 -0500 block: ublk: check IO buffer based on flag need_get_data Currently, uring_cmd with UBLK_IO_FETCH_REQ or UBLK_IO_COMMIT_AND_FETCH_REQ is always checked whether userspace server has provided IO buffer even flag UBLK_F_NEED_GET_DATA is configured. This is a excessive check. If UBLK_F_NEED_GET_DATA is configured, FETCH_RQ doesn't need to provide IO buffer; COMMIT_AND_FETCH_REQ also doesn't need to do that if the IO type is not READ. Check ub_cmd->addr together with ublk_need_get_data() and IO type in ublk_ch_uring_cmd(). With this fix, userspace server doesn't need to preserve buffers for every ublk_io when flag UBLK_F_NEED_GET_DATA is configured, in order to save memory. Signed-off-by: Liu Xiaodong Fixes: c86019ff75c1 ("ublk_drv: add support for UBLK_IO_NEED_GET_DATA") Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20230210141356.112321-1-xiaodong.liu@intel.com Signed-off-by: Jens Axboe commit fef1f0be10c61dd16fd370964c316c399483448f Author: Bagas Sanjaya Date: Mon Feb 13 17:08:01 2023 +0700 Documentation: powerclamp: Fix numbered lists formatting Texts in numbered lists are rendered as continous paragraph when there should have been breaks between first line text in the beginning of list item and the description. Fix this by adding appropriate line breaks and indent the rest of lines to match the first line of numbered list item. Fixes: d6d71ee4a14ae6 ("PM: Introduce Intel PowerClamp Driver") Fixes: 6bbe6f5732faea ("docs: thermal: convert to ReST") Signed-off-by: Bagas Sanjaya Signed-off-by: Rafael J. Wysocki commit e8b703ed75ef859d9b8c77f0ff92558011907b7f Author: Bagas Sanjaya Date: Mon Feb 13 17:08:00 2023 +0700 Documentation: powerclamp: Escape wildcard in cpumask description kernel test robot reported htmldocs warning: Documentation/admin-guide/thermal/intel_powerclamp.rst:328: WARNING: Inline emphasis start-string without end-string. The mistaken asterisk in /proc/irq/*/smp_affinity is rendered as hyperlink as the result. Escape the asterisk to fix above warning. Link: https://lore.kernel.org/linux-doc/202302122247.N4S791c4-lkp@intel.com/ Fixes: ebf51971021881 ("thermal: intel: powerclamp: Add two module parameters") Reported-by: kernel test robot Signed-off-by: Bagas Sanjaya Signed-off-by: Rafael J. Wysocki commit e63273c1bc637fad711488afe9c2f1ab58a7ae86 Author: Bagas Sanjaya Date: Mon Feb 13 17:07:59 2023 +0700 Documentation: admin-guide: Add toctree entry for thermal docs kernel test robot reported htmldocs warnings: Documentation/admin-guide/index.rst:62: WARNING: toctree contains reference to nonexisting document 'admin-guide/thermal' Documentation/admin-guide/thermal/intel_powerclamp.rst: WARNING: document isn't included in any toctree Add toctree entry for thermal/ docs to fix these warnings. Link: https://lore.kernel.org/linux-doc/202302121759.MmJgDTxc-lkp@intel.com/ Fixes: 707bf8e1dfd51d ("Documentation: admin-guide: Move intel_powerclamp documentation") Reported-by: kernel test robot Signed-off-by: Bagas Sanjaya Signed-off-by: Rafael J. Wysocki commit 68907175ec5e6a240e724a8e3fa0064baf392b4c Merge: 01e9d2c6bea98 b0bc8c893ae07 Author: Arnd Bergmann Date: Mon Feb 13 16:22:32 2023 +0100 Merge tag 'qcom-drivers-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for 6.3 The qcom_scm.h file is moved into firmware/qcom, to avoid having any Qualcomm-specific files directly in include/linux. Support for PMIC GLINK is introduced, which on newer Qualcomm platforms provides an interface to the firmware implementing battery management and USB Type-C handling. Together with the base driver comes the custom altmode support driver. SMD RPM gains support for IPQ9574, and socinfo is extended with support for revision 17 of the information format and soc_id for IPQ5332 and IPQ8064 are added. The qcom_stats is changes not to fail when not all parts are initialized. * tag 'qcom-drivers-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: socinfo: Add IDs for IPQ5332 and its variant dt-bindings: arm: qcom,ids: Add IDs for IPQ5332 and its variant dt-bindings: power: qcom,rpmpd: add RPMH_REGULATOR_LEVEL_LOW_SVS_L1 firmware: qcom_scm: Move qcom_scm.h to include/linux/firmware/qcom/ MAINTAINERS: Update qcom CPR maintainer entry dt-bindings: firmware: document Qualcomm SM8550 SCM dt-bindings: firmware: qcom,scm: add qcom,scm-sa8775p compatible soc: qcom: socinfo: Add Soc IDs for IPQ8064 and variants dt-bindings: arm: qcom,ids: Add Soc IDs for IPQ8064 and variants soc: qcom: socinfo: Add support for new field in revision 17 soc: qcom: smd-rpm: Add IPQ9574 compatible soc: qcom: pmic_glink: remove redundant calculation of svid soc: qcom: stats: Populate all subsystem debugfs files dt-bindings: soc: qcom,rpmh-rsc: Update to allow for generic nodes soc: qcom: pmic_glink: add CONFIG_NET/CONFIG_OF dependencies soc: qcom: pmic_glink: Introduce altmode support soc: qcom: pmic_glink: Introduce base PMIC GLINK driver dt-bindings: soc: qcom: Introduce PMIC GLINK binding soc: qcom: dcc: Drop driver for now Link: https://lore.kernel.org/r/20230210182242.2023901-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 01e9d2c6bea9823103958bd3d71f61b9900ef5be Merge: 4a54ecf3031c6 6bf3259922363 Author: Arnd Bergmann Date: Mon Feb 13 16:19:55 2023 +0100 Merge tag 'qcom-drivers-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v6.3 This introduces a new driver for the Data Capture and Compare block, which provides a mechanism for capturing hardware state (access MMIO registers) either upon request of triggered automatically e.g. upon a watchdog bite, for post mortem analysis. The remote filesystem memory share driver gains support for having its memory bound to more than a single VMID. The SCM driver gains the minimal support needed to support a new mechanism where secure world can put calls on hold and later request them to be retried. Support for the new SA8775P platform is added to rpmhpd, QDU1000 is added to the SCM driver and a long list of platforms are added to the socinfo driver. Support for socinfo data revision 16 is also introduced. Lastly a driver to program the ramp controller in MSM8976 is introduced. * tag 'qcom-drivers-for-6.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (33 commits) firmware: qcom: scm: Add wait-queue handling logic dt-bindings: firmware: qcom,scm: Add optional interrupt Revert "dt-bindings: power: rpmpd: Add SM4250 support" Revert "soc: qcom: rpmpd: Add SM4250 support" soc: qcom: socinfo: Add a bunch of older SoCs dt-bindings: arm: qcom,ids: Add a bunch of older SoCs dt-bindings: arm: qcom,ids: Add QRD board ID soc: qcom: socinfo: Fix soc_id order dt-bindings: soc: qcom: smd-rpm: Exclude MSM8936 from glink-channels dt-bindings: firmware: qcom: scm: Separate VMIDs from header to bindings soc: qcom: rmtfs: Optionally map RMTFS to more VMs dt-bindings: reserved-memory: rmtfs: Make qcom,vmid an array dt-bindings: firmware: scm: Add QDU1000/QRU1000 compatible dt-bindings: firmware: qcom,scm: narrow clocks and interconnects dt-bindings: firmware: qcom,scm: document MSM8226 clocks soc: qcom: ramp_controller: Make things static soc: qcom: rmphpd: add power domains for sa8775p dt-bindings: power: qcom,rpmpd: document sa8775p PM: AVS: qcom-cpr: Fix an error handling path in cpr_probe() soc: qcom: dcc: rewrite description of dcc sysfs files ... Link: https://lore.kernel.org/r/20230126163008.3676950-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 Author: Jiasheng Jiang Date: Thu Feb 9 09:07:48 2023 +0800 wifi: iwl4965: Add missing check for create_singlethread_workqueue() Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference. Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") Signed-off-by: Jiasheng Jiang Acked-by: Stanislaw Gruszka Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230209010748.45454-1-jiasheng@iscas.ac.cn commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb Author: Jiasheng Jiang Date: Wed Feb 8 14:30:32 2023 +0800 wifi: iwl3945: Add missing check for create_singlethread_workqueue Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference. Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") Signed-off-by: Jiasheng Jiang Acked-by: Stanislaw Gruszka Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230208063032.42763-2-jiasheng@iscas.ac.cn commit 24d54855ff36c7c6256cb48b735a927090142a51 Author: Martin Blumenstingl Date: Sun Feb 5 00:30:01 2023 +0100 wifi: rtw88: mac: Use existing macros in rtw_pwr_seq_parser() Replace the magic numbers for the intf_mask with their existing RTW_PWR_INTF_PCI_MSK and RTW_PWR_INTF_USB_MSK macros to make the code easier to understand. Acked-by: Ping-Ke Shih Signed-off-by: Martin Blumenstingl Reviewed-by: Simon Horman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230204233001.1511643-5-martin.blumenstingl@googlemail.com commit 7b6e9df91133e13ce7d980fcdb55cc7f26099106 Author: Martin Blumenstingl Date: Sun Feb 5 00:30:00 2023 +0100 wifi: rtw88: Move enum rtw_tx_queue_type mapping code to tx.{c,h} This code is not specific to the PCIe bus type but can be re-used by USB and SDIO bus types. Move it to tx.{c,h} to avoid code-duplication in the future. While here, add checking of the ac argument in rtw_tx_ac_to_hwq() so we're not accessing entries beyond the end of the array. Signed-off-by: Martin Blumenstingl Reviewed-by: Simon Horman Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230204233001.1511643-4-martin.blumenstingl@googlemail.com commit c90897960c19f5bad59fcd391901ac1b7787c50b Author: Martin Blumenstingl Date: Sun Feb 5 00:29:59 2023 +0100 wifi: rtw88: pci: Change queue datatype to enum rtw_tx_queue_type This makes it easier to understand which values are allowed for the "queue" variable when using the enum instead of an u8. Acked-by: Ping-Ke Shih Signed-off-by: Martin Blumenstingl Reviewed-by: Simon Horman Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230204233001.1511643-3-martin.blumenstingl@googlemail.com commit 6152b649a70861e72220de9f9abf2fe570967493 Author: Martin Blumenstingl Date: Sun Feb 5 00:29:58 2023 +0100 wifi: rtw88: pci: Use enum type for rtw_hw_queue_mapping() and ac_to_hwq rtw_hw_queue_mapping() and ac_to_hwq[] hold values of type enum rtw_tx_queue_type. Change their types to reflect this to make it easier to understand this part of the code. While here, also change the array to be static const as it is not supposed to be modified at runtime. Signed-off-by: Martin Blumenstingl Reviewed-by: Simon Horman Reviewed-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230204233001.1511643-2-martin.blumenstingl@googlemail.com commit 900cad6ef12e1cfacedddf125ba72386e33bc4a6 Author: Jonathan Neuschäfer Date: Sun Jan 29 13:49:18 2023 +0100 wifi: wl1251: Fix a typo ("boradcast") It should be "broadcast". Signed-off-by: Jonathan Neuschäfer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230129124919.1305057-1-j.neuschaefer@gmx.net commit e6a1c4b9884f1c917e505e5663bdeff489ff1c36 Author: Doug Brown Date: Sun Jan 22 21:31:32 2023 -0800 wifi: libertas: add support for WPS enrollee IE in probe requests Add compatibility with WPS by passing on WPS enrollee information in probe requests. Ignore other IEs supplied in the scan request. This also has the added benefit of restoring compatibility with newer wpa_supplicant versions that always add scan IEs. Previously, with max_scan_ie_len set to 0, scans would always fail. Suggested-by: Dan Williams Signed-off-by: Doug Brown Reviewed-by: Dan Williams Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123053132.30710-5-doug@schmorgal.com commit 5fb2a7854a9e6cad3f665cf290864c858cbc68d5 Author: Doug Brown Date: Sun Jan 22 21:31:31 2023 -0800 wifi: libertas: add new TLV type for WPS enrollee IE Add a define for the TLV type that will be used to add WPS enrollee information to probe requests. Suggested-by: Dan Williams Signed-off-by: Doug Brown Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123053132.30710-4-doug@schmorgal.com commit 57db1ba357368b4de0ed3ede334a83929febb5d0 Author: Doug Brown Date: Sun Jan 22 21:31:30 2023 -0800 wifi: libertas: only add RSN/WPA IE in lbs_add_wpa_tlv The existing code only converts the first IE to a TLV, but it returns a value that takes the length of all IEs into account. When there is more than one IE (which happens with modern wpa_supplicant versions for example), the returned length is too long and extra junk TLVs get sent to the firmware, resulting in an association failure. Fix this by finding the first RSN or WPA IE and only adding that. This has the extra benefit of working properly if the RSN/WPA IE isn't the first one in the IE buffer. While we're at it, clean up the code to use the available structs like the other lbs_add_* functions instead of directly manipulating the TLV buffer. Signed-off-by: Doug Brown Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123053132.30710-3-doug@schmorgal.com commit 53d3a735875e35ccaf7a21b643feb167229515f1 Author: Doug Brown Date: Sun Jan 22 21:31:29 2023 -0800 wifi: libertas: fix code style in Marvell structs Several of the structs are using the deprecated convention of items[1] for a dynamically sized trailing element. Convert these structs to the modern C99 style of items[]. Also fix a couple of camel case struct element names. Signed-off-by: Doug Brown Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230123053132.30710-2-doug@schmorgal.com commit 41204a607679ccca7eabff9f2871b969d6ef2ce3 Author: Rafael J. Wysocki Date: Tue Feb 7 20:59:59 2023 +0100 cpuidle: driver: Update microsecond values of state parameters as needed If the cpuidle driver provides the target residency and exit latency in nanoseconds, the corresponding values in microseconds need to be set to reflect the provided numbers in order for the sysfs interface to show them correctly, so make __cpuidle_driver_init() do that. Signed-off-by: Rafael J. Wysocki Tested-by: Artem Bityutskiy commit 384fcb0bd15ec3d458268294346f4e30e1baeafc Merge: 9330e13e6b802 480ba14b9a956 Author: Arnd Bergmann Date: Mon Feb 13 15:57:32 2023 +0100 Merge tag 'qcom-arm64-defconfig-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig More ARM64 defconfig updates for v6.3 Here are two more defconfig updates for 6.3, enabling the SM8450 Display clock controller driver, as well as the SDAM driver, a driver exposing SRAM on newer Qualcomm PMICs to other devices. * tag 'qcom-arm64-defconfig-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: enable Qualcomm SDAM nvmem driver arm64: defconfig: enable SM8450 DISPCC clock driver arm64: defconfig: enable the clock driver for Qualcomm SA8775P platforms arm64: defconfig: enable Visionox VTDR6130 DSI Panel driver arm64: defconfig: enable SM8550 DISPCC clock driver arm64: defconfig: enable Qualcomm PCIe modem drivers arm64: defconfig: Enable SC8280XP Display Clock Controller arm64: defconfig: Enable GCC, TCSRCC, pinctrl and interconnect for SM8550 arm64: defconfig: enable crypto userspace API arm64: defconfig: build SDM_LPASSCC_845 as a module arm64: defconfig: enable camera on Thundercomm RB5 platform arm64: defconfig: build PINCTRL_SM8250_LPASS_LPI as module arm64: defconfig: Enable Qualcomm EUD Link: https://lore.kernel.org/r/20230210181516.2021902-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 7dbdc16fc85bcd89a2f3698df37a7202ea266454 Merge: fc54e13d71250 f069ede81ef43 Author: Arnd Bergmann Date: Mon Feb 13 15:47:21 2023 +0100 Merge tag 'qcom-arm64-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/dt More Qualcomm ARM64 DT updates for 6.3 The new Qualcomm QDU1000 and QRU1000 platforms, and the IDP device on these are introduced. New support for a couple of USB modem sticks from THWC are introduced, so is support for Xiaomi Mi Pad 5 Pro and the Pro SKU of the Herobrine device. The Core Bus Fabric (CBF) is introduced on MSM8996. Interconnect paths for UFS are also described. A few fixes related to the power-grid of herobrine, on SC7280, are introduced. QFPROM is introduced on IPQ8074 and Interconnect providers are added for SDM670. On SDM845 the duplicated wcd9340 audio coded description is moved from devices to a common file, audio devices are added to the OnePlus 6 and 6T. On SM6115 debug UART, SMP2P, watchdog nodes are introduced, and the platform is switched to use #address/size-cells of 2, in line with most other platforms. Camera control interface and clock controllers are added for SM6350, and the CCI interface is enabled on the Fairphone FP4. On SM8350 the interconnect reference of SDHCI controller is corrected, DSI1 PHY clocks are properly described as sources for the Display clock controller and DSI1 is wired up to the display controller. The firmware paths are corrected for the Sony Xperia Nagara platform. The GPR bus, audio servic3es and LPASS pinctrl nodes are added for the SM8550 platform. Additionally a few small typos/errors are corrected. gpio-ranges are corrected across MSM8953, SM6115 and SC8280XP and a range of DT validation issues are corrected. * tag 'qcom-arm64-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (81 commits) arm64: dts: qcom: sc7280: Power herobrine's 3.3 eDP/TS rail more properly arm64: dts: qcom: pmk8550: fix PON compatible arm64: dts: qcom: sm8550: fix DSI controller compatible arm64: dts: qcom: sc7280: Hook up the touchscreen IO rail on evoker arm64: dts: qcom: sc7280: Hook up the touchscreen IO rail on villager arm64: dts: qcom: sc7280: Add 3ms ramp to herobrine's pp3300_left_in_mlb arm64: dts: qcom: sc7280: On QCard, regulator L3C should be 1.8V arm64: dts: qcom: sc8280xp: correct LPASS GPIO gpio-ranges arm64: dts: qcom: msm8992-lg-bullhead: Enable regulators arm64: dts: qcom: sm6115: correct TLMM gpio-ranges arm64: dts: qcom: msm8953: correct TLMM gpio-ranges arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with the SMEM and MPSS memory regions arm64: dts: qcom: sm8350-hdk: correct LT9611 pin function arm64: dts: qcom: sm8350-hdk: align pin config node names with bindings arm64: dts: qcom: sm6350: Use specific qmpphy compatible arm64: dts: qcom: sm6115: Add smp2p nodes arm64: dts: qcom: sm7225-fairphone-fp4: Enable CCI busses arm64: dts: qcom: sm6350: Add CCI nodes arm64: dts: qcom: sm6350: Add camera clock controller dt-bindings: clock: add QCOM SM6350 camera clock bindings ... Link: https://lore.kernel.org/r/20230210192908.2039976-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit fc54e13d712501cd2ad99ac015c5ff8a0c6ae184 Merge: 59b05cfa5323f 68e8dd352adc2 Author: Arnd Bergmann Date: Mon Feb 13 15:44:37 2023 +0100 Merge tag 'qcom-dts-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/dt More Qualcomm ARM32 DTS updates for 6.3 This adds backlight, notification LED, vibrator, volume keys and hall sensor to the OnePlus One, and provides a range of Devicetree validation fixes across various platforms. * tag 'qcom-dts-for-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (22 commits) ARM: dts: qcom: align OPP table names with DT schema ARM: dts: qcom: msm8974-oneplus-bacon: Add notification LED ARM: dts: qcom: msm8974-oneplus-bacon: Add backlight ARM: dts: qcom: msm8974-oneplus-bacon: Add volume keys and hall sensor ARM: dts: qcom: msm8974-oneplus-bacon: Add vibrator ARM: dts: qcom: pm8941: Add vibrator node ARM: dts: qcom: sdx55: correct TLMM gpio-ranges dt-bindings: arm: qcom: add the sa8775p-ride board ARM: dts: qcom: apq8064: add second DSI host and PHY ARM: dts: qcom: apq8060-dragonboard: align MPP pin node names with DT schema dt-bindings: arm: qcom: Add Xiaomi Mi Pad 5 Pro (xiaomi-elish) ARM: dts: qcom-sdx65: align RPMh regulator nodes with bindings ARM: dts: qcom-sdx55: align RPMh regulator nodes with bindings ARM: dts: qcom: use "okay" for status ARM: dts: qcom: sdx65: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: qcom: sdx55: Add Qcom SMMU-500 as the fallback for IOMMU node ARM: dts: qcom: apq8064: use hdmi_phy for the MMCC's hdmipll clock ARM: dts: qcom: apq8064: add #clock-cells to the HDMI PHY node ARM: dts: qcom: ipq8064: move reg-less nodes outside soc node dt-bindings: qcom: Document msm8916-thwc-uf896 and ufi001c ... Link: https://lore.kernel.org/r/20230210185846.2032601-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 59b05cfa5323ffefcd5c2f97d6e01f040e7dc637 Merge: 306b8201b0bb6 301d3dd05525e Author: Arnd Bergmann Date: Mon Feb 13 15:38:57 2023 +0100 Merge tag 'samsung-dt-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into arm/dt Samsung DTS ARM changes for v6.3, part two Several cleanups pointed out by `make dtbs_check`: 1. Align LED status node name with bindings. 2. Drop redundant properties. 3. Move i2c-gpio node out of soc to top-level, as soc node is expected to have only MMIO nodes. 4. Correct SPI NOR flash compatible in SMDK5250 and SMDKv310. 5. Align GPIO property names in WM1811-family codec nodes with bindings. 6. Correct MAX98090 codec DAI cells in Snow. * tag 'samsung-dt-6.3-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: exynos: correct max98090 DAI argument in Snow ARM: dts: s5pv210: add "gpios" suffix to wlf,ldo1ena on Aries ARM: dts: exynos: add "gpios" suffix to wlf,ldo1ena on Arndale ARM: dts: exynos: add "gpios" suffix to wlf,ldo1ena on Midas ARM: dts: exynos: correct SPI nor compatible in SMDK5250 ARM: dts: exynos: correct SPI nor compatible in SMDKv310 ARM: dts: exynos: move I2C10 out of soc node on Arndale ARM: dts: exynos: drop redundant address/size cells from I2C10 on Arndale ARM: dts: exynos: drop default status from I2C10 on Arndale ARM: dts: exynos: align status led name with bindings on Origen4210 Link: https://lore.kernel.org/r/20230211113103.58894-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 3004e8d2a0a98bbf4223ae146464fadbff68bf78 Author: Shyam Sundar S K Date: Mon Feb 13 17:44:57 2023 +0530 platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY It is reported that amd_pmf driver is missing "depends on" for CONFIG_POWER_SUPPLY causing the following build error. ld: drivers/platform/x86/amd/pmf/core.o: in function `amd_pmf_remove': core.c:(.text+0x10): undefined reference to `power_supply_unreg_notifier' ld: drivers/platform/x86/amd/pmf/core.o: in function `amd_pmf_probe': core.c:(.text+0x38f): undefined reference to `power_supply_reg_notifier' make[1]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 1 make: *** [Makefile:1248: vmlinux] Error 2 Add this to the Kconfig file. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217028 Fixes: c5258d39fc4c ("platform/x86/amd/pmf: Add helper routine to update SPS thermals") Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20230213121457.1764463-1-Shyam-sundar.S-k@amd.com Cc: stable@vger.kernel.org Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 4827aae061337251bb91801b316157a78b845ec7 Author: Andy Shevchenko Date: Sun Feb 12 16:13:55 2023 +0200 gpio: sim: Use %pfwP specifier instead of calling fwnode API directly Instead of calling fwnode_get_name() and supply as %s, use %pfwP which will do the same inside printf() call. Signed-off-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 816477edfba6e7ab9411acec5f07cfa00e0882f7 Author: Ira Weiny Date: Fri Feb 3 20:06:35 2023 -0800 mm: Remove get_kernel_pages() The only caller to get_kernel_pages() [shm_get_kernel_pages()] has been updated to not need it. Remove get_kernel_pages(). Cc: Mel Gorman Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Christoph Hellwig Cc: Andrew Morton Acked-by: John Hubbard Signed-off-by: Ira Weiny Acked-by: Andrew Morton Reviewed-by: Christoph Hellwig Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 0249a75b365911f91b87935bc08a4795a6fa7dd0 Author: Ira Weiny Date: Fri Feb 3 20:06:34 2023 -0800 tee: Remove call to get_kernel_pages() The kernel pages used by shm_get_kernel_pages() are allocated using GFP_KERNEL through the following call stack: trusted_instantiate() trusted_payload_alloc() -> GFP_KERNEL tee_shm_register_kernel_buf() register_shm_helper() shm_get_kernel_pages() Where is one of: trusted_key_unseal() trusted_key_get_random() trusted_key_seal() Because the pages can't be from highmem get_kernel_pages() boils down to a get_page() call. Remove the get_kernel_pages() call and open code the get_page(). In case a highmem page does slip through warn on once for a kmap'ed address. Cc: Jens Wiklander Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Christoph Hellwig Cc: Linus Torvalds Signed-off-by: Ira Weiny Reviewed-by: Christoph Hellwig Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit c83900393aa133d5fefdbf2ab3377c7fbeec0c07 Author: Ira Weiny Date: Fri Feb 3 20:06:33 2023 -0800 tee: Remove vmalloc page support The kernel pages used by shm_get_kernel_pages() are allocated using GFP_KERNEL through the following call stack: trusted_instantiate() trusted_payload_alloc() -> GFP_KERNEL tee_shm_register_kernel_buf() register_shm_helper() shm_get_kernel_pages() Where is one of: trusted_key_unseal() trusted_key_get_random() trusted_key_seal() Remove the vmalloc page support from shm_get_kernel_pages(). Replace with a warn on once. Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Christoph Hellwig Cc: Linus Torvalds Reviewed-by: Jens Wiklander Signed-off-by: Ira Weiny Reviewed-by: Christoph Hellwig Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit f3837ab7adbc1799a3c5648d34e3e27eb70709a6 Author: Ira Weiny Date: Fri Feb 3 20:06:32 2023 -0800 highmem: Enhance is_kmap_addr() to check kmap_local_page() mappings is_kmap_addr() is only looking at the kmap() address range which may cause check_heap_object() to miss checking an overflow on a kmap_local_page() page. Add a check for the kmap_local_page() address range to is_kmap_addr(). Cc: Matthew Wilcox Cc: Al Viro Cc: "Fabio M. De Francesco" Cc: Thomas Gleixner Cc: Christoph Hellwig Cc: Andrew Morton Signed-off-by: Ira Weiny Acked-by: Andrew Morton Signed-off-by: Jens Wiklander commit d227116c0e216da2eceba1d51a364ff025dffa58 Author: Yang Li Date: Mon Feb 13 09:05:47 2023 +0800 ASoC: codecs: Remove unneeded semicolon ./sound/soc/codecs/peb2466.c:1851:2-3: Unneeded semicolon ./sound/soc/codecs/peb2466.c:1887:2-3: Unneeded semicolon Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4045 Signed-off-by: Yang Li Acked-by: Herve Codina Link: https://lore.kernel.org/r/20230213010547.105312-1-yang.lee@linux.alibaba.com Signed-off-by: Mark Brown commit 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d Author: Steffen Aschbacher Date: Mon Feb 13 09:38:05 2023 +0200 ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init When the 'ti,gpio-config' property is not defined, the device_property_count_u32() will return an error, rather than zero. The current check, only handles a return value of zero, which assumes that the property is defined and has nothing defined. This change extends the check to also check for an error case (most likely to be hit by the case that the 'ti,gpio-config' is not defined). In case that the 'ti,gpio-config' and the returned 'gpio_count' is not correct, there is a 'if (gpio_count != ADCX140_NUM_GPIO_CFGS)' check, a few lines lower that will return -EINVAL. This means that someone tried to define 'ti,gpio-config', but with the wrong number of GPIOs. Fixes: d5214321498a ("ASoC: tlv320adcx140: Add support for configuring GPIO pin") Signed-off-by: Steffen Aschbacher Signed-off-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20230213073805.14640-1-alex@shruggie.ro Signed-off-by: Mark Brown commit 937ca916bf4de427242fb78105a0089af0dd43b3 Author: William Zhang Date: Sun Feb 12 12:50:54 2023 -0800 MAINTAINERS: Remove file reference for Broadcom Broadband SoC HS SPI driver entry brcm,bcm63xx-hsspi-peripheral-props.yaml is not in use at least for now. Remove it from the maintainer entry. Fixes: 80323599e33f ("MAINTAINERS: Add entry for Broadcom Broadband SoC HS SPI drivers") Reported-by: kernel test robot https://lore.kernel.org/oe-kbuild-all/202302121840.GtduUT37-lkp@intel.com/ Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20230212205054.26348-1-william.zhang@broadcom.com Signed-off-by: Mark Brown commit 2cca486cad4bf51da57cdad150697476a702ab69 Author: William Zhang Date: Fri Feb 10 19:27:59 2023 -0800 spi: bcm63xx-hsspi: bcmbca-hsspi: fix _be16 type usage sparse tool report warnings: drivers/spi/spi-bcm63xx-hsspi.c:197:31: sparse: sparse: cast from restricted __be16. The controller requires big endian 16 bit data. Define an intermediate u16 value and use __be16 piointer dereferncing for the data to avoid directly casting to u16 and sparse warning. Fixes: 85a84a616999 ("spi: bcm63xx-hsspi: Endianness fix for ARM based SoC") Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302110438.sQwQnU54-lkp@intel.com/ Signed-off-by: William Zhang Link: https://lore.kernel.org/r/20230211032759.72967-1-william.zhang@broadcom.com Signed-off-by: Mark Brown commit 9d1c73191f94c79076b5f46a31b8a1e12b18bc79 Author: Axel Lin Date: Sat Feb 11 23:00:19 2023 +0800 regulator: max20411: Fix off-by-one for n_voltages setting Otherwise regulator_list_voltage returns -EINVAL for MAX20411_MAX_SEL. Signed-off-by: Axel Lin Link: https://lore.kernel.org/r/20230211150019.1545542-1-axel.lin@ingics.com Signed-off-by: Mark Brown commit 4680716d6a33f50c96eb7ce6ae9cb868baa04438 Author: Weidong Wang Date: Mon Feb 13 17:36:49 2023 +0800 ASoC: codecs: Modify error implicit declaration of function 'gpiod_set_value_cansleep' Add select GPIOLIB to the sound/soc/codecs/Kconfig file Signed-off-by: Ben Yi Signed-off-by: Weidong Wang Link: https://lore.kernel.org/r/20230213093649.22928-4-wangweidong.a@awinic.com Signed-off-by: Mark Brown commit 14d5d454547adae64a76731c90c37fe33f7d1d44 Author: Weidong Wang Date: Mon Feb 13 17:36:48 2023 +0800 ASoC: codecs: Modify the log print statement Change hdrlen to hdr_len Signed-off-by: Ben Yi Signed-off-by: Weidong Wang Link: https://lore.kernel.org/r/20230213093649.22928-3-wangweidong.a@awinic.com Signed-off-by: Mark Brown commit 27db41a1f73ad18ed6540e1f8a7083422e5b53d6 Author: Weidong Wang Date: Mon Feb 13 17:36:47 2023 +0800 ASoC: codecs: Fixed a spelling error in the function name Change the function name aw88395_plack_event to aw88395_playback_event Signed-off-by: Ben Yi Signed-off-by: Weidong Wang Link: https://lore.kernel.org/r/20230213093649.22928-2-wangweidong.a@awinic.com Signed-off-by: Mark Brown commit 46f5c98e158449a1ddbf9b22e046810184c92d43 Author: Krzysztof Kozlowski Date: Sat Feb 11 14:47:55 2023 +0100 ASoC: dt-bindings: maxim,max98095: Convert to dtschema Convert the Maxim Integrated MAX98095 audio codec bindings to DT schema. Add missing sound-dai-cells during conversion. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230211134755.86061-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 66dc3b9b9a6f4b5c7013f15c66073ddd20852b66 Author: Alexander Sverdlin Date: Sun Feb 12 23:09:23 2023 +0100 ASoC: ep93xx: ignore 0 Hz sysclk Commit 2458adb8f92a ("SoC: simple-card-utils: set 0Hz to sysclk when shutdown") added a call to snd_soc_dai_set_sysclk() with 0 Hz frequency. Being propagated further it causes a division by zero in clk-ep93xx driver: Division by zero in kernel. CPU: 0 PID: 52 Comm: aplay Tainted: G W 6.2.0-rc4-... #1 Hardware name: Generic DT based system unwind_backtrace from show_stack+0x10/0x18 show_stack from dump_stack_lvl+0x28/0x34 dump_stack_lvl from __div0+0x10/0x1c __div0 from Ldiv0+0x8/0x1c Ldiv0 from ep93xx_mux_determine_rate+0x78/0x1d0 ep93xx_mux_determine_rate from clk_core_round_rate_nolock+0x48/0xc8 clk_core_round_rate_nolock from clk_core_set_rate_nolock+0x48/0x160 clk_core_set_rate_nolock from clk_set_rate+0x30/0x8c clk_set_rate from ep93xx_i2s_set_sysclk+0x30/0x6c ep93xx_i2s_set_sysclk from snd_soc_dai_set_sysclk+0x3c/0xa4 snd_soc_dai_set_sysclk from asoc_simple_shutdown+0xb8/0x164 asoc_simple_shutdown from snd_soc_link_shutdown+0x44/0x54 snd_soc_link_shutdown from soc_pcm_clean+0x78/0x180 soc_pcm_clean from soc_pcm_close+0x28/0x40 soc_pcm_close from snd_pcm_release_substream.part.0+0x3c/0x84 snd_pcm_release_substream.part.0 from snd_pcm_release+0x40/0x88 snd_pcm_release from __fput+0x74/0x278 There has been commit f1879d7b98dc ("ASoC: rockchip: ignore 0Hz sysclk"), but it prepared by far not all drivers. Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20230212220923.258414-1-alexander.sverdlin@gmail.com Signed-off-by: Mark Brown commit 8222d5910dae08213b6d9d4bc9a7f8502855e624 Author: Herbert Xu Date: Thu Feb 9 09:09:52 2023 +0800 xfrm: Zero padding when dumping algos and encap When copying data to user-space we should ensure that only valid data is copied over. Padding in structures may be filled with random (possibly sensitve) data and should never be given directly to user-space. This patch fixes the copying of xfrm algorithms and the encap template in xfrm_user so that padding is zeroed. Reported-by: syzbot+fa5414772d5c445dac3c@syzkaller.appspotmail.com Reported-by: Hyunwoo Kim Signed-off-by: Herbert Xu Reviewed-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit f18bd6f539469970a7e6d79377e5cb2c11855cae Merge: b187c70b0366b 518c5d778e985 Author: Kalle Valo Date: Mon Feb 13 14:38:27 2023 +0200 Merge tag 'mt76-for-kvalo-2023-02-03' of https://github.com/nbd168/wireless mt76 patches for 6.3 - fixes - mt7996 cleanups - switch to page pool allocator - mt7996 eht support - WED reset support commit 0e84f918fac8ae61dcb790534fad5e3555ca2930 Author: Eugenio Pérez Date: Wed Jan 18 17:43:58 2023 +0100 vdpa_sim: not reset state in vdpasim_queue_ready vdpasim_queue_ready calls vringh_init_iotlb, which resets split indexes. But it can be called after setting a ring base with vdpasim_set_vq_state. Fix it by stashing them. They're still resetted in vdpasim_vq_reset. This was discovered and tested live migrating the vdpa_sim_net device. Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator") Signed-off-by: Eugenio Pérez Message-Id: <20230118164359.1523760-2-eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Tested-by: Lei Yang commit 5ccb51b06c8bfcfca99d3f68e671eead7318301d Author: Yangtao Li Date: Thu Feb 9 12:02:39 2023 +0800 clocksource/drivers/timer-sun4i: Add CLOCK_EVT_FEAT_DYNIRQ Add CLOCK_EVT_FEAT_DYNIRQ to allow the IRQ could be runtime set affinity to the cores that needs wake up, otherwise saying core0 has to send IPI to wakeup core1. With CLOCK_EVT_FEAT_DYNIRQ set, when broadcast timer could wake up the cores, IPI is not needed. After enabling this feature, especially the scene where cpuidle is enabled can benefit. Signed-off-by: Yangtao Li Link: https://lore.kernel.org/r/20230209040239.24710-1-frank.li@vivo.com Signed-off-by: Daniel Lezcano commit cf16f631b0bbd98df4b2ccc13346f564412eae68 Author: Uwe Kleine-König Date: Tue Feb 7 20:30:10 2023 +0100 clocksource/drivers/em_sti: Mark driver as non-removable The comment in the remove callback suggests that the driver is not supposed to be unbound. However returning an error code in the remove callback doesn't accomplish that. Instead set the suppress_bind_attrs property (which makes it impossible to unbind the driver via sysfs). The only remaining way to unbind a em_sti device would be module unloading, but that doesn't apply here, as the driver cannot be built as a module. Also drop the useless remove callback. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230207193010.469495-1-u.kleine-koenig@pengutronix.de Signed-off-by: Daniel Lezcano commit d8c695d310a8607fd1d6a2750368467c4e0cef6a Author: Uwe Kleine-König Date: Tue Feb 7 20:36:14 2023 +0100 clocksource/drivers/sh_tmu: Mark driver as non-removable The comment in the remove callback suggests that the driver is not supposed to be unbound. However returning an error code in the remove callback doesn't accomplish that. Instead set the suppress_bind_attrs property (which makes it impossible to unbind the driver via sysfs). The only remaining way to unbind a sh_tmu device would be module unloading, but that doesn't apply here, as the driver cannot be built as a module. Also drop the useless remove callback. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230207193614.472060-1-u.kleine-koenig@pengutronix.de Signed-off-by: Daniel Lezcano commit 225b9596cb0227c1c1b1e4a836dad43595c3e61a Author: Matt Evans Date: Wed Feb 1 19:49:42 2023 +0000 clocksource/drivers/riscv: Patch riscv_clock_next_event() jump before first use A static key is used to select between SBI and Sstc timer usage in riscv_clock_next_event(), but currently the direction is resolved after cpuhp_setup_state() is called (which sets the next event). The first event will therefore fall through the sbi_set_timer() path; this breaks Sstc-only systems. So, apply the jump patching before first use. Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available") Signed-off-by: Matt Evans Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/CDDAB2D0-264E-42F3-8E31-BA210BEB8EC1@rivosinc.com Signed-off-by: Daniel Lezcano commit f3af3dc7cc351bd22742eac992c72c76749ce8c3 Author: Claudiu Beznea Date: Fri Feb 3 15:05:37 2023 +0200 clocksource/drivers/timer-microchip-pit64b: Add delay timer Add delay timer. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230203130537.1921608-3-claudiu.beznea@microchip.com Signed-off-by: Daniel Lezcano commit d19c8b2ed176c6aaf3dfefd149c740f73ce4875e Author: Claudiu Beznea Date: Fri Feb 3 15:05:36 2023 +0200 clocksource/drivers/timer-microchip-pit64b: Select driver only on ARM Microchip PIT64B is currently available on ARM based devices. Thus select it only for ARM. This allows implementing delay timer. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230203130537.1921608-2-claudiu.beznea@microchip.com Signed-off-by: Daniel Lezcano commit abd873afc889c0b4348ec4b567d83f97df8edaf6 Author: Icenowy Zheng Date: Thu Feb 2 15:28:14 2023 +0800 dt-bindings: timer: sifive,clint: add comaptibles for T-Head's C9xx T-Head C906/C910 CLINT is not compliant to SiFive ones (and even not compliant to the newcoming ACLINT spec) because of lack of mtime register. Add a compatible string formatted like the C9xx-specific PLIC compatible, and do not allow a SiFive one as fallback because they're not really compliant. Signed-off-by: Icenowy Zheng Acked-by: Krzysztof Kozlowski Reviewed-by: Samuel Holland Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230202072814.319903-1-uwu@icenowy.me Signed-off-by: Daniel Lezcano commit 27788e01a6507c882946b9aa87318c3185cd83e6 Author: Bernhard Rosenkränzer Date: Wed Jan 25 15:35:01 2023 +0100 dt-bindings: timer: mediatek,mtk-timer: add MT8365 Add binding description for mediatek,mt8365-systimer Signed-off-by: Bernhard Rosenkränzer Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230125143503.1015424-8-bero@baylibre.com Signed-off-by: Daniel Lezcano commit 3aff0403f814df6ce2377a6ecf61dd7750a3925f Author: Lad Prabhakar Date: Thu Dec 29 22:46:01 2022 +0000 clocksource/drivers/riscv: Get rid of clocksource_arch_init() callback Having a clocksource_arch_init() callback always sets vdso_clock_mode to VDSO_CLOCKMODE_ARCHTIMER if GENERIC_GETTIMEOFDAY is enabled, this is required for the riscv-timer. This works for platforms where just riscv-timer clocksource is present. On platforms where other clock sources are available we want them to register with vdso_clock_mode set to VDSO_CLOCKMODE_NONE. On the Renesas RZ/Five SoC OSTM block can be used as clocksource [0], to avoid multiple clock sources being registered as VDSO_CLOCKMODE_ARCHTIMER move setting of vdso_clock_mode in the riscv-timer driver instead of doing this in clocksource_arch_init() callback as done similarly for ARM/64 architecture. [0] drivers/clocksource/renesas-ostm.c Signed-off-by: Lad Prabhakar Tested-by: Samuel Holland Reviewed-by: Conor Dooley Reviewed-by: Samuel Holland Link: https://lore.kernel.org/r/20221229224601.103851-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Daniel Lezcano commit c3daa4754f3c57231bf47dcf4bdf897bc5c5f1f1 Author: Uwe Kleine-König Date: Mon Jan 23 23:02:21 2023 +0100 clocksource/drivers/sh_cmt: Mark driver as non-removable The comment in the remove callback suggests that the driver is not supposed to be unbound. However returning an error code in the remove callback doesn't accomplish that. Instead set the suppress_bind_attrs property (which makes it impossible to unbind the driver via sysfs). The only remaining way to unbind a sh_cmt device would be module unloading, but that doesn't apply here, as the driver cannot be built as a module. Also drop the useless remove callback. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230123220221.48164-1-u.kleine-koenig@pengutronix.de Signed-off-by: Daniel Lezcano commit 8d17aca90bcf36833271de6531edb58a91c40e9f Author: Jean Delvare Date: Sat Jan 21 18:29:11 2023 +0100 clocksource/drivers/timer-microchip-pit64b: Drop obsolete dependency on COMPILE_TEST Since commit 0166dc11be91 ("of: make CONFIG_OF user selectable"), it is possible to test-build any driver which depends on OF on any architecture by explicitly selecting OF. Therefore depending on COMPILE_TEST as an alternative is no longer needed. Signed-off-by: Jean Delvare Cc: Claudiu Beznea Cc: Daniel Lezcano Cc: Thomas Gleixner Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230121182911.4e47a5ff@endymion.delvare Signed-off-by: Daniel Lezcano commit 674402b0098b66b8ba91fe93c0d27af703256098 Author: Samuel Holland Date: Tue Dec 27 18:44:44 2022 -0600 clocksource/drivers/riscv: Increase the clock source rating RISC-V provides an architectural clock source via the time CSR. This clock source exposes a 64-bit counter synchronized across all CPUs. Because it is accessed using a CSR, it is much more efficient to read than MMIO clock sources. For example, on the Allwinner D1, reading the sun4i timer in a loop takes 131 cycles/iteration, while reading the RISC-V time CSR takes only 5 cycles/iteration. Adjust the RISC-V clock source rating so it is preferred over the various platform-specific MMIO clock sources. Signed-off-by: Samuel Holland Acked-by: Palmer Dabbelt Reviewed-by: Palmer Dabbelt Reviewed-by: Anup Patel Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/r/20221228004444.61568-1-samuel@sholland.org Signed-off-by: Daniel Lezcano commit 8932a9533a9cdd1fa2924a061dc87277991507ca Author: Anup Patel Date: Tue Jan 3 19:41:02 2023 +0530 clocksource/drivers/timer-riscv: Set CLOCK_EVT_FEAT_C3STOP based on DT We should set CLOCK_EVT_FEAT_C3STOP for a clock_event_device only when riscv,timer-cannot-wake-cpu DT property is present in the RISC-V timer DT node. This way CLOCK_EVT_FEAT_C3STOP feature is set for clock_event_device based on RISC-V platform capabilities rather than having it set for all RISC-V platforms. Signed-off-by: Anup Patel Reviewed-by: Conor Dooley Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230103141102.772228-4-apatel@ventanamicro.com Signed-off-by: Daniel Lezcano commit e2bcf2d876fd7ca6ecca09794ac58d7e3a544794 Author: Anup Patel Date: Tue Jan 3 19:41:01 2023 +0530 dt-bindings: timer: Add bindings for the RISC-V timer device We add DT bindings for a separate RISC-V timer DT node which can be used to describe implementation specific behaviour (such as timer interrupt not triggered during non-retentive suspend). Signed-off-by: Anup Patel Reviewed-by: Conor Dooley Reviewed-by: Rob Herring Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230103141102.772228-3-apatel@ventanamicro.com Signed-off-by: Daniel Lezcano commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 Author: Conor Dooley Date: Tue Jan 3 19:41:00 2023 +0530 RISC-V: time: initialize hrtimer based broadcast clock event device Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize broadcast hrtimer based clock event device"), RISC-V needs to initiate hrtimer based broadcast clock event device before C3STOP can be used. Otherwise, the introduction of C3STOP for the RISC-V arch timer in commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") leaves us without any broadcast timer registered. This prevents the kernel from entering oneshot mode, which breaks timer behaviour, for example clock_nanosleep(). A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250 & C3STOP enabled, the sleep times are rounded up to the next jiffy: == CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 == Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179 Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193 Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000 Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000 Samples: 521 Samples: 521 Samples: 521 Samples: 521 Link: https://lore.kernel.org/linux-riscv/YzYTNQRxLr7Q9JR0@spud/ Fixes: 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") Suggested-by: Samuel Holland Signed-off-by: Conor Dooley Signed-off-by: Anup Patel Reviewed-by: Samuel Holland Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230103141102.772228-2-apatel@ventanamicro.com Signed-off-by: Daniel Lezcano commit b3cbfb7927922e4586f890a70a22f13130247b4e Author: Jagan Teki Date: Thu Nov 24 00:01:18 2022 +0530 dt-bindings: timer: rk-timer: Add rktimer for rv1126 Add rockchip timer compatible string for rockchip rv1126. Signed-off-by: Jagan Teki Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20221123183124.6911-3-jagan@edgeble.ai Signed-off-by: Daniel Lezcano commit 08273c9f619cb32fb041935724f576e607101f3b Author: Nathan Lynch Date: Fri Feb 10 12:42:08 2023 -0600 powerpc/rtas: arch-wide function token lookup conversions With the tokens for all implemented RTAS functions now available via rtas_function_token(), which is optimal and safe for arbitrary contexts, there is no need to use rtas_token() or cache its result. Most conversions are trivial, but a few are worth describing in more detail: * Error injection token comparisons for lockdown purposes are consolidated into a simple predicate: token_is_restricted_errinjct(). * A couple of special cases in block_rtas_call() do not use rtas_token() but perform string comparisons against names in the function table. These are converted to compare against token values instead, which is logically equivalent but less expensive. * The lookup for the ibm,os-term token can be deferred until needed, instead of caching it at boot to avoid device tree traversal during panic. * Since rtas_function_token() accesses a read-only data structure without taking any locks, xmon's lookup of set-indicator can be performed as needed instead of cached at startup. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-20-26929c8cce78@linux.ibm.com commit 716bfc97bd5fb7b442cdd06081f49df097f2e27b Author: Nathan Lynch Date: Fri Feb 10 12:42:07 2023 -0600 powerpc/rtas: introduce rtas_function_token() API Users of rtas_token() supply a string argument that can't be validated at build time. A typo or misspelling has to be caught by inspection or by observing wrong behavior at runtime. Since the core RTAS code now has consolidated the names of all possible RTAS functions and mapped them to their tokens, token lookup can be implemented using symbolic constants to index a static array. So introduce rtas_function_token(), a replacement API which does that, along with a rtas_service_present()-equivalent helper, rtas_function_implemented(). Callers supply an opaque predefined function handle which is used internally to index the function table. Typos or other inappropriate arguments yield build errors, and the function handle is a type that can't be easily confused with RTAS tokens or other integer types. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-19-26929c8cce78@linux.ibm.com commit e58d9e17b11b776e32b1d3d80bdc63d39de3463d Author: Nathan Lynch Date: Fri Feb 10 12:42:06 2023 -0600 powerpc/pseries/lpar: convert to papr_sysparm API Convert the TLB block invalidate characteristics discovery to the new papr_sysparm API. This occurs too early in boot to use papr_sysparm_buf_alloc(), so use a static buffer. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-18-26929c8cce78@linux.ibm.com commit 69b9f5a5b2c04ce5993fe43da938f065571bdb25 Author: Nathan Lynch Date: Fri Feb 10 12:42:05 2023 -0600 powerpc/pseries/hv-24x7: convert to papr_sysparm API The new papr_sysparm API handles the details of system parameter retrieval. Use that instead of open-coding the RTAS call, work area management, and retries. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-17-26929c8cce78@linux.ibm.com commit fff9846be00c467b4a277492af5be8487b6540e9 Author: Nathan Lynch Date: Fri Feb 10 12:42:04 2023 -0600 powerpc/pseries/lparcfg: convert to papr_sysparm API /proc/powerpc/lparcfg derives the LPAR name and SPLPAR characteristics it reports using bare calls to the RTAS ibm,get-system-parameter function. Convert these to the higher-level papr_sysparm API, which handles the tedious details. While the SPLPAR string parsing code could stand to be updated, that should be done in a separate change. It is minimally modified here to reduce the risk of changing behavior. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-16-26929c8cce78@linux.ibm.com commit b8dc71774a51182185ae197ed2f8bd085ce6c848 Author: Nathan Lynch Date: Fri Feb 10 12:42:03 2023 -0600 powerpc/pseries: convert CMO probe to papr_sysparm API Convert the direct invocation of the ibm,get-system-parameter RTAS function to papr_sysparm_get(). Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-15-26929c8cce78@linux.ibm.com commit 419e27f32b6dc13c3e6f443d1ad104f2845c444b Author: Nathan Lynch Date: Fri Feb 10 12:42:02 2023 -0600 powerpc/pseries: PAPR system parameter API Introduce a set of APIs for retrieving and updating PAPR system parameters. This encapsulates the toil of temporary RTAS work area management, RTAS function call retries, and translation of RTAS call statuses to conventional error values. There are several places in the kernel that already retrieve system parameters by calling the RTAS ibm,get-system-parameter function directly. These will be converted to papr_sysparm_get() in changes to follow. As for updating system parameters, current practice is to use sys_rtas() from user space; there are no in-kernel users of the RTAS ibm,set-system-parameter function. However this will become deprecated in time because it is not compatible with lockdown. The papr_sysparm_* APIs will form the common basis for in-kernel and user space access to system parameters. The code to expose the set/get capabilities to user space will follow. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-14-26929c8cce78@linux.ibm.com commit e27e14231eb541899efc11c33d6eeddcb74767c3 Author: Nathan Lynch Date: Fri Feb 10 12:42:01 2023 -0600 powerpc/pseries/dlpar: use RTAS work area API Hold a work area object for the duration of the RTAS ibm,configure-connector sequence, eliminating locking and copying around each RTAS call. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-13-26929c8cce78@linux.ibm.com commit 43033bc62d349d8d852855a336c91d046de819bd Author: Nathan Lynch Date: Fri Feb 10 12:42:00 2023 -0600 powerpc/pseries: add RTAS work area allocator Various pseries-specific RTAS functions take a temporary "work area" parameter - a buffer in memory accessible to RTAS. Typically such functions are passed the statically allocated rtas_data_buf buffer as the argument. This buffer is protected by a global spinlock. So users of rtas_data_buf cannot perform sleeping operations while accessing the buffer. Most RTAS functions that have a work area parameter can return a status (-2/990x) that indicates that the caller should retry. Before retrying, the caller may need to reschedule or sleep (see rtas_busy_delay() for details). This combination of factors leads to uncomfortable constructions like this: do { spin_lock(&rtas_data_buf_lock); rc = rtas_call(token, __pa(rtas_data_buf, ...); if (rc == 0) { /* parse or copy out rtas_data_buf contents */ } spin_unlock(&rtas_data_buf_lock); } while (rtas_busy_delay(rc)); Another unfortunately common way of handling this is for callers to blithely ignore the possibility of a -2/990x status and hope for the best. If users were allowed to perform blocking operations while owning a work area, the programming model would become less tedious and error-prone. Users could schedule away, sleep, or perform other blocking operations without having to release and re-acquire resources. We could continue to use a single work area buffer, and convert rtas_data_buf_lock to a mutex. But that would impose an unnecessarily coarse serialization on all users. As awkward as the current design is, it prevents longer running operations that need to repeatedly use rtas_data_buf from blocking the progress of others. There are more considerations. One is that while 4KB is fine for all current in-kernel uses, some RTAS calls can take much smaller buffers, and some (VPD, platform dumps) would likely benefit from larger ones. Another is that at least one RTAS function (ibm,get-vpd) has *two* work area parameters. And finally, we should expect the number of work area users in the kernel to increase over time as we introduce lockdown-compatible ABIs to replace less safe use cases based on sys_rtas/librtas. So a special-purpose allocator for RTAS work area buffers seems worth trying. Properties: * The backing memory for the allocator is reserved early in boot in order to satisfy RTAS addressing requirements, and then managed with genalloc. * Allocations can block, but they never fail (mempool-like). * Prioritizes first-come, first-serve fairness over throughput. * Early boot allocations before the allocator has been initialized are served via an internal static buffer. Intended to replace rtas_data_buf. New code that needs RTAS work area buffers should prefer this API. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-12-26929c8cce78@linux.ibm.com commit 24098f580e2b5ceb2cec4f02833e0a0bb5d46d2e Author: Nathan Lynch Date: Fri Feb 10 12:41:59 2023 -0600 powerpc/rtas: add tracepoints around RTAS entry Decompose the RTAS entry C code into tracing and non-tracing variants, calling the just-added tracepoints in the tracing-enabled path. Skip tracing in contexts known to be unsafe (real mode, CPU offline). Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-11-26929c8cce78@linux.ibm.com commit 2c81ca7fbaea06c2aed1aec66a88208d67e1e2de Author: Nathan Lynch Date: Fri Feb 10 12:41:58 2023 -0600 powerpc/tracing: tracepoints for RTAS entry and exit Add two sets of tracepoints to be used around RTAS entry: * rtas_input/rtas_output, which emit the function name, its inputs, the returned status, and any other outputs. These produce an API-level record of OS<->RTAS activity. * rtas_ll_entry/rtas_ll_exit, which are lower-level and emit the entire contents of the parameter block (aka rtas_args) on entry and exit. Likely useful only for debugging. With uses of these tracepoints in do_enter_rtas() to be added in the following patch, examples of get-time-of-day and event-scan functions as rendered by trace-cmd (with some multi-line formatting manually imposed on the rtas_ll_* entries to avoid extremely long lines in the commit message): cat-36800 [059] 4978.518303: rtas_input: get-time-of-day arguments: cat-36800 [059] 4978.518306: rtas_ll_entry: token=3 nargs=0 nret=8 params: [0]=0x00000000 [1]=0x00000000 [2]=0x00000000 [3]=0x00000000 [4]=0x00000000 [5]=0x00000000 [6]=0x00000000 [7]=0x00000000 [8]=0x00000000 [9]=0x00000000 [10]=0x00000000 [11]=0x00000000 [12]=0x00000000 [13]=0x00000000 [14]=0x00000000 [15]=0x00000000 cat-36800 [059] 4978.518366: rtas_ll_exit: token=3 nargs=0 nret=8 params: [0]=0x00000000 [1]=0x000007e6 [2]=0x0000000b [3]=0x00000001 [4]=0x00000000 [5]=0x0000000e [6]=0x00000008 [7]=0x2e0dac40 [8]=0x00000000 [9]=0x00000000 [10]=0x00000000 [11]=0x00000000 [12]=0x00000000 [13]=0x00000000 [14]=0x00000000 [15]=0x00000000 cat-36800 [059] 4978.518366: rtas_output: get-time-of-day status: 0, other outputs: 2022 11 1 0 14 8 772648000 kworker/39:1-336 [039] 4982.731623: rtas_input: event-scan arguments: 4294967295 0 80484920 2048 kworker/39:1-336 [039] 4982.731626: rtas_ll_entry: token=6 nargs=4 nret=1 params: [0]=0xffffffff [1]=0x00000000 [2]=0x04cc1a38 [3]=0x00000800 [4]=0x00000000 [5]=0x0000000e [6]=0x00000008 [7]=0x2e0dac40 [8]=0x00000000 [9]=0x00000000 [10]=0x00000000 [11]=0x00000000 [12]=0x00000000 [13]=0x00000000 [14]=0x00000000 [15]=0x00000000 kworker/39:1-336 [039] 4982.731676: rtas_ll_exit: token=6 nargs=4 nret=1 params: [0]=0xffffffff [1]=0x00000000 [2]=0x04cc1a38 [3]=0x00000800 [4]=0x00000001 [5]=0x0000000e [6]=0x00000008 [7]=0x2e0dac40 [8]=0x00000000 [9]=0x00000000 [10]=0x00000000 [11]=0x00000000 [12]=0x00000000 [13]=0x00000000 [14]=0x00000000 [15]=0x00000000 kworker/39:1-336 [039] 4982.731677: rtas_output: event-scan status: 1, other outputs: Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-10-26929c8cce78@linux.ibm.com commit 77f85f69a97ac5f24537261a893436926c3e0cdc Author: Nathan Lynch Date: Fri Feb 10 12:41:57 2023 -0600 powerpc/rtas: strengthen do_enter_rtas() type safety, drop inline Make do_enter_rtas() take a pointer to struct rtas_args and do the __pa() conversion in one place instead of leaving it to callers. This also makes it possible to introduce enter/exit tracepoints that access the rtas_args struct fields. There's no apparent reason to force inlining of do_enter_rtas() either, and it seems to bloat the code a bit. Let the compiler decide. Signed-off-by: Nathan Lynch Reviewed-by: Andrew Donnellan Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-9-26929c8cce78@linux.ibm.com commit 8252b88294d2a744df6e3c6d85909ade403a5f2c Author: Nathan Lynch Date: Fri Feb 10 12:41:56 2023 -0600 powerpc/rtas: improve function information lookups The core RTAS support code and its clients perform two types of lookup for RTAS firmware function information. First, mapping a known function name to a token. The typical use case invokes rtas_token() to retrieve the token value to pass to rtas_call(). rtas_token() relies on of_get_property(), which performs a linear search of the /rtas node's property list under a lock with IRQs disabled. Second, and less common: given a token value, looking up some information about the function. The primary example is the sys_rtas filter path, which linearly scans a small table to match the token to a rtas_filter struct. Another use case to come is RTAS entry/exit tracepoints, which will require efficient lookup of function names from token values. Currently there is no general API for this. We need something much like the existing rtas_filters table, but more general and organized to facilitate efficient lookups. Introduce: * A new rtas_function type, aggregating function name, token, and filter. Other function characteristics could be added in the future. * An array of rtas_function, where each element corresponds to a known RTAS function. All information in the table is static save the token values, which are derived from the device tree at boot. The array is sorted by function name to allow binary search. * A named constant for each known RTAS function, used to index the function array. These also will be used in a client-facing API to be added later. * An xarray that maps valid tokens to rtas_function objects. Fold the existing rtas_filter table into the new rtas_function array, with the appropriate adjustments to block_rtas_call(). Remove now-redundant fields from struct rtas_filter. Preserve the function of the CONFIG_CPU_BIG_ENDIAN guard in the current filter table by introducing a per-function flag that is set for the function entries related to pseries LPAR migration. These have never had working users via sys_rtas on ppc64le; see commit de0f7349a0dd ("powerpc/rtas: prevent suspend-related sys_rtas use on LE"). Convert rtas_token() to use a lockless binary search on the function table. Fall back to the old behavior for lookups against names that are not known to be RTAS functions, but issue a warning. rtas_token() is for function names; it is not a general facility for accessing arbitrary properties of the /rtas node. All known misuses of rtas_token() have been converted to more appropriate of_ APIs in preceding changes. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-8-26929c8cce78@linux.ibm.com commit d6f7fe3b25f26213953066ce8109ea47dbd33cfa Author: Nathan Lynch Date: Fri Feb 10 12:41:55 2023 -0600 powerpc/pseries: drop RTAS-based timebase synchronization The pseries platform has been LPAR-only for several generations, and the PAPR spec: * Guarantees that timebase synchronization is performed by the platform ("The timebase registers are synchronized by the platform before CPUs are given to the OS" - 7.3.8 SMP Support). * Completely omits the RTAS freeze-time-base and thaw-time-base RTAS functions, which are CHRP artifacts. This code is effectively unused on currently supported models, so drop it. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-7-26929c8cce78@linux.ibm.com commit 836b5b9fcc8e09cea7e8a59a070349a00e818308 Author: Nathan Lynch Date: Fri Feb 10 12:41:54 2023 -0600 powerpc/rtas: ensure 4KB alignment for rtas_data_buf Some RTAS functions that have work area parameters impose alignment requirements on the work area passed to them by the OS. Examples include: - ibm,configure-connector - ibm,update-nodes - ibm,update-properties 4KB is the greatest alignment required by PAPR for such buffers. rtas_data_buf used to have a __page_aligned attribute in the arch/ppc64 days, but that was changed to __cacheline_aligned for unknown reasons by commit 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"). That works out to 128-byte alignment on ppc64, which isn't right. This was found by inspection and I'm not aware of any real problems caused by this. Either current RTAS implementations don't enforce the alignment constraints, or rtas_data_buf is always being placed at a 4KB boundary by accident (or both, perhaps). Use __aligned(SZ_4K) to ensure the rtas_data_buf has alignment appropriate for all users. Signed-off-by: Nathan Lynch Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-6-26929c8cce78@linux.ibm.com commit b7d5333c48a21fd6a20f54b6887bcc191d21c273 Author: Nathan Lynch Date: Fri Feb 10 12:41:53 2023 -0600 powerpc/pseries/setup: add missing RTAS retry status handling The ibm,get-system-parameter RTAS function may return -2 or 990x, which indicate that the caller should try again. pSeries_cmo_feature_init() ignores this, making it possible to fail to detect cooperative memory overcommit capabilities during boot. Move the RTAS call into a conventional rtas_busy_delay()-based loop, dropping unnecessary clearing of rtas_data_buf. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-5-26929c8cce78@linux.ibm.com commit 5d08633e5f6564b60f1cbe09af3af40a74d66431 Author: Nathan Lynch Date: Fri Feb 10 12:41:52 2023 -0600 powerpc/pseries/lparcfg: add missing RTAS retry status handling The ibm,get-system-parameter RTAS function may return -2 or 990x, which indicate that the caller should try again. lparcfg's parse_system_parameter_string() ignores this, making it possible to intermittently report incorrect SPLPAR characteristics. Move the RTAS call into a coventional rtas_busy_delay()-based loop. Signed-off-by: Nathan Lynch Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-4-26929c8cce78@linux.ibm.com commit daa8ab59044610aa8ef2ee45a6c157b5e11635e9 Author: Nathan Lynch Date: Fri Feb 10 12:41:51 2023 -0600 powerpc/pseries/lpar: add missing RTAS retry status handling The ibm,get-system-parameter RTAS function may return -2 or 990x, which indicate that the caller should try again. pseries_lpar_read_hblkrm_characteristics() ignores this, making it possible to incorrectly detect TLB block invalidation characteristics at boot. Move the RTAS call into a coventional rtas_busy_delay()-based loop. Signed-off-by: Nathan Lynch Fixes: 1211ee61b4a8 ("powerpc/pseries: Read TLB Block Invalidate Characteristics") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-3-26929c8cce78@linux.ibm.com commit cc4b26eab1859fa1a70711872caaf6414809973f Author: Nathan Lynch Date: Fri Feb 10 12:41:50 2023 -0600 powerpc/perf/hv-24x7: add missing RTAS retry status handling The ibm,get-system-parameter RTAS function may return -2 or 990x, which indicate that the caller should try again. read_24x7_sys_info() ignores this, allowing transient failures in reporting processor module information. Move the RTAS call into a coventional rtas_busy_delay()-based loop, along with the parsing of results on success. Signed-off-by: Nathan Lynch Fixes: 8ba214267382 ("powerpc/hv-24x7: Add rtas call in hv-24x7 driver to get processor details") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-2-26929c8cce78@linux.ibm.com commit 09d1ea72c88198ef5a9e6b8208f544fe18acbff1 Author: Nathan Lynch Date: Fri Feb 10 12:41:49 2023 -0600 powerpc/rtas: handle extended delays safely in early boot Some code that runs early in boot calls RTAS functions that can return -2 or 990x statuses, which mean the caller should retry. An example is pSeries_cmo_feature_init(), which invokes ibm,get-system-parameter but treats these benign statuses as errors instead of retrying. pSeries_cmo_feature_init() and similar code should be made to retry until they succeed or receive a real error, using the usual pattern: do { rc = rtas_call(token, etc...); } while (rtas_busy_delay(rc)); But rtas_busy_delay() will perform a timed sleep on any 990x status. This isn't safe so early in boot, before the CPU scheduler and timer subsystem have initialized. The -2 RTAS status is much more likely to occur during single-threaded boot than 990x in practice, at least on PowerVM. This is because -2 usually means that RTAS made progress but exhausted its self-imposed timeslice, while 990x is associated with concurrent requests from the OS causing internal contention. Regardless, according to the language in PAPR, the OS should be prepared to handle either type of status at any time. Add a fallback path to rtas_busy_delay() to handle this as safely as possible, performing a small delay on 990x. Include a counter to detect retry loops that aren't making progress and bail out. Add __ref to rtas_busy_delay() since it now conditionally calls an __init function. This was found by inspection and I'm not aware of any real failures. However, the implementation of rtas_busy_delay() before commit 38f7b7067dae ("powerpc/rtas: rtas_busy_delay() improvements") was not susceptible to this problem, so let's treat this as a regression. Signed-off-by: Nathan Lynch Fixes: 38f7b7067dae ("powerpc/rtas: rtas_busy_delay() improvements") Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230125-b4-powerpc-rtas-queue-v3-1-26929c8cce78@linux.ibm.com commit 4b3e71e9a34c48f370b6281e9477515d588e7b26 Author: Russell Currey Date: Fri Feb 10 19:04:01 2023 +1100 integrity/powerpc: Support loading keys from PLPKS Add support for loading keys from the PLPKS on pseries machines, with the "ibm,plpks-sb-v1" format. The object format is expected to be the same, so there shouldn't be any functional differences between objects retrieved on powernv or pseries. Unlike on powernv, on pseries the format string isn't contained in the device tree. Use secvar_ops->format() to fetch the format string in a generic manner, rather than searching the device tree ourselves. (The current code searches the device tree for a node compatible with "ibm,edk2-compat-v1". This patch switches to calling secvar_ops->format(), which in the case of OPAL/powernv means opal_secvar_format(), which searches the device tree for a node compatible with "ibm,secvar-backend" and checks its "format" property. These are equivalent, as skiboot creates a node with both "ibm,edk2-compat-v1" and "ibm,secvar-backend" as compatible strings.) Signed-off-by: Russell Currey Signed-off-by: Andrew Donnellan Reviewed-by: Stefan Berger Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230210080401.345462-27-ajd@linux.ibm.com commit 3c8069b0c3832674abd80a5cf019c913e62de9a5 Author: Russell Currey Date: Fri Feb 10 19:04:00 2023 +1100 integrity/powerpc: Improve error handling & reporting when loading certs A few improvements to load_powerpc.c: - include integrity.h for the pr_fmt() - move all error reporting out of get_cert_list() - use ERR_PTR() to better preserve error detail - don't use pr_err() for missing keys Reviewed-by: Mimi Zohar Signed-off-by: Russell Currey Signed-off-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230210080401.345462-26-ajd@linux.ibm.com commit ccadf154cb00b9ee9618d209aa3efc54b35a34b4 Author: Russell Currey Date: Fri Feb 10 19:03:59 2023 +1100 powerpc/pseries: Implement secvars for dynamic secure boot The pseries platform can support dynamic secure boot (i.e. secure boot using user-defined keys) using variables contained with the PowerVM LPAR Platform KeyStore (PLPKS). Using the powerpc secvar API, expose the relevant variables for pseries dynamic secure boot through the existing secvar filesystem layout. The relevant variables for dynamic secure boot are signed in the keystore, and can only be modified using the H_PKS_SIGNED_UPDATE hcall. Object labels in the keystore are encoded using ucs2 format. With our fixed variable names we don't have to care about encoding outside of the necessary byte padding. When a user writes to a variable, the first 8 bytes of data must contain the signed update flags as defined by the hypervisor. When a user reads a variable, the first 4 bytes of data contain the policies defined for the object. Limitations exist due to the underlying implementation of sysfs binary attributes, as is the case for the OPAL secvar implementation - partial writes are unsupported and writes cannot be larger than PAGE_SIZE. (Even when using bin_attributes, which can be larger than a single page, sysfs only gives us one page's worth of write buffer at a time, and the hypervisor does not expose an interface for partial writes.) Co-developed-by: Nayna Jain Signed-off-by: Nayna Jain Co-developed-by: Andrew Donnellan Signed-off-by: Andrew Donnellan Signed-off-by: Russell Currey [mpe: Add NLS dependency to fix build errors, squash fix from ajd] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20230210080401.345462-25-ajd@linux.ibm.com commit 9b0bf4f77162e5423bc08aff7be0cb80134a2884 Merge: 79cdf17e5131c 8b68710a3121e Author: David S. Miller Date: Mon Feb 13 11:12:31 2023 +0000 Merge branch 'ksz9477-eee-support' Oleksij Rempel says: ==================== net: add EEE support for KSZ9477 switch family changes v8: - fix comment for linkmode_to_mii_eee_cap1_t() function - add Acked-by: Arun Ramadoss - add Reviewed-by: Alexander Duyck changes v7: - update documentation for genphy_c45_eee_is_active() - address review comments on "net: dsa: microchip: enable EEE support" patch changes v6: - split patch set and send only first 9 patches - Add Reviewed-by: Andrew Lunn - use 0xffff instead of GENMASK - Document @supported_eee - use "()" with function name in comments changes v5: - spell fixes - move part of genphy_c45_read_eee_abilities() to genphy_c45_read_eee_cap1() - validate MDIO_PCS_EEE_ABLE register against 0xffff val. - rename *eee_100_10000* to *eee_cap1* - use linkmode_intersects(phydev->supported, PHY_EEE_CAP1_FEATURES) instead of !linkmode_empty() - add documentation to linkmode/register helpers changes v4: - remove following helpers: mmd_eee_cap_to_ethtool_sup_t mmd_eee_adv_to_ethtool_adv_t ethtool_adv_to_mmd_eee_adv_t and port drivers from this helpers to linkmode helpers. - rebase against latest net-next - port phy_init_eee() to genphy_c45_eee_is_active() changes v3: - rework some parts of EEE infrastructure and move it to c45 code. - add supported_eee storage and start using it in EEE code and by the micrel driver. - add EEE support for ar8035 PHY - add SmartEEE support to FEC i.MX series. changes v2: - use phydev->supported instead of reading MII_BMSR regiaster - fix @get_eee > @set_eee With this patch series we provide EEE control for KSZ9477 family of switches and AR8035 with i.MX6 configuration. According to my tests, on a system with KSZ8563 switch and 100Mbit idle link, we consume 0,192W less power per port if EEE is enabled. ==================== Signed-off-by: David S. Miller commit 8b68710a3121e0475b123a20c4220f66a728770e Author: Oleksij Rempel Date: Sat Feb 11 08:41:13 2023 +0100 net: phy: start using genphy_c45_ethtool_get/set_eee() All preparations are done. Now we can start using new functions and remove the old code. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 6340f9fd43d503ed5675facd5f9958a063651482 Author: Oleksij Rempel Date: Sat Feb 11 08:41:12 2023 +0100 net: phy: migrate phy_init_eee() to genphy_c45_eee_is_active() Reduce code duplicated by migrating phy_init_eee() to genphy_c45_eee_is_active(). Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 5827b168125d16d93fe14284c2c377f32d13fce6 Author: Oleksij Rempel Date: Sat Feb 11 08:41:11 2023 +0100 net: phy: c45: migrate to genphy_c45_write_eee_adv() Migrate from genphy_config_eee_advert() to genphy_c45_write_eee_adv(). It should work as before except write operation to the EEE adv registers will be done only if some EEE abilities was detected. If some driver will have a regression, related driver should provide own .get_features callback. See micrel.c:ksz9477_get_features() as example. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 9b01c885be364526d8c05794f8358b3e563b7ff8 Author: Oleksij Rempel Date: Sat Feb 11 08:41:10 2023 +0100 net: phy: c22: migrate to genphy_c45_write_eee_adv() Migrate from genphy_config_eee_advert() to genphy_c45_write_eee_adv(). It should work as before except write operation to the EEE adv registers will be done only if some EEE abilities was detected. If some driver will have a regression, related driver should provide own .get_features callback. See micrel.c:ksz9477_get_features() as example. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 022c3f87f88e2d68e90be7687d981c9cb893a3b1 Author: Oleksij Rempel Date: Sat Feb 11 08:41:09 2023 +0100 net: phy: add genphy_c45_ethtool_get/set_eee() support Add replacement for phy_ethtool_get/set_eee() functions. Current phy_ethtool_get/set_eee() implementation is great and it is possible to make it even better: - this functionality is for devices implementing parts of IEEE 802.3 specification beyond Clause 22. The better place for this code is phy-c45.c - currently it is able to do read/write operations on PHYs with different abilities to not existing registers. It is better to use stored supported_eee abilities to avoid false read/write operations. - the eee_active detection will provide wrong results on not supported link modes. It is better to validate speed/duplex properties against supported EEE link modes. - it is able to support only limited amount of link modes. We have more EEE link modes... By refactoring this code I address most of this point except of the last one. Adding additional EEE link modes will need more work. Signed-off-by: Oleksij Rempel Signed-off-by: David S. Miller commit cf9f6079696840093aa6ea3c0ee405a553afe2fb Author: Oleksij Rempel Date: Sat Feb 11 08:41:08 2023 +0100 net: phy: export phy_check_valid() function This function will be needed for genphy_c45_ethtool_get_eee() provided by next patch. Signed-off-by: Oleksij Rempel Reviewed-by: Alexander Duyck Signed-off-by: David S. Miller commit 48fb19940f2ba6b50dfea70f671be9340fb63d60 Author: Oleksij Rempel Date: Sat Feb 11 08:41:07 2023 +0100 net: phy: micrel: add ksz9477_get_features() KSZ8563R, which has same PHYID as KSZ9477 family, will change "EEE control and capability 1" (Register 3.20) content depending on configuration of "EEE advertisement 1" (Register 7.60). Changes on the 7.60 will affect 3.20 register. So, instead of depending on register 3.20, driver should set supported_eee. Proper supported_eee configuration is needed to make use of generic PHY c45 set/get_eee functions provided by next patches. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 14e47d1fb8f9596acc90a06a66808657a9c512b5 Author: Oleksij Rempel Date: Sat Feb 11 08:41:06 2023 +0100 net: phy: add genphy_c45_read_eee_abilities() function Add generic function for EEE abilities defined by IEEE 802.3 specification. For now following registers are supported: - IEEE 802.3-2018 45.2.3.10 EEE control and capability 1 (Register 3.20) - IEEE 802.3cg-2019 45.2.1.186b 10BASE-T1L PMA status register (Register 1.2295) Since I was not able to find any flag signaling support of these registers, we should detect link mode abilities first and then based on these abilities doing EEE link modes detection. Results of EEE ability detection will be stored into new variable phydev->supported_eee. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit 69d3b36ca045582356fc3d2c92366b200506f936 Author: Oleksij Rempel Date: Sat Feb 11 08:41:05 2023 +0100 net: dsa: microchip: enable EEE support Some of KSZ9477 family switches provides EEE support. To enable it, we just need to register set_mac_eee/set_mac_eee handlers and validate supported chip version and port. Currently supported chip variants are: KSZ8563, KSZ9477, KSZ9563, KSZ9567, KSZ9893, KSZ9896, KSZ9897. KSZ8563 supports EEE only with 100BaseTX/Full. Other chips support 100BaseTX/Full and 1000BaseTX/Full. Low Power Idle configuration is not supported and currently not documented in the datasheets. EEE PHY specific tunings are not documented in the switch datasheets, but can overlap with KSZ9131 specification. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Acked-by: Arun Ramadoss Signed-off-by: David S. Miller commit 6113bd52443f3f9035acf27d8793b0246a692e81 Author: Armin Wolf Date: Thu Feb 9 22:15:03 2023 +0100 platform/x86: dell-ddv: Prefer asynchronous probing During probe, both sensor buffers need to be queried to initialize the hwmon channels. This might be slow on some machines, causing a unnecessary delay during boot. Mark the driver with PROBE_PREFER_ASYNCHRONOUS so that it can be probed asynchronously. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230209211503.2739-3-W_Armin@gmx.de Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 3b7eeff93d291299841f943a5e9b43bb160b3992 Author: Armin Wolf Date: Thu Feb 9 22:15:02 2023 +0100 platform/x86: dell-ddv: Add hwmon support Thanks to bugreport 216655 on bugzilla triggered by the dell-smm-hwmon driver, the contents of the sensor buffers could be almost completely decoded. Add an hwmon interface for exposing the fan and thermal sensor values. Since the WMI interface can be quite slow on some machines, the sensor buffers are cached for 1 second to lessen the performance impact. The debugfs interface remains in place to aid in reverse-engineering of unknown sensor types and the thermal buffer. Tested-by: Antonín Skala Tested-by: Gustavo Walbon Signed-off-by: Armin Wolf Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230209211503.2739-2-W_Armin@gmx.de Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit e7210563432a6c6fa65a9c5c11ece2a0adbeeda2 Author: Vadim Pasternak Date: Wed Feb 8 08:33:30 2023 +0200 Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces Add description for new attributes added for rack manager switch and NG800 family systems. Attributes related to power converter board: - reset_pwr_converter_fail; - pwr_converter_prog_en; Attributes related to External Root of Trust (EROT) devices recovery: - erot1_ap_reset; - erot2_ap_reset; - erot1_recovery; - erot2_recovery; - erot1_reset; - erot2_reset; - erot1_wp; - erot2_wp; - spi_chnl_select; Attributes related to clock board failures and recovery: - clk_brd1_boot_fail; - clk_brd2_boot_fail; - clk_brd_fail; - clk_brd_prog_en; Attributes related to power failures: - reset_ac_ok_fail; - asic_pg_fail; Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230208063331.15560-14-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 50b823fdd357ec0f2fd0a1a0b5104704916fd620 Author: Vadim Pasternak Date: Wed Feb 8 08:33:29 2023 +0200 platform: mellanox: mlx-platform: Move bus shift assignment out of the loop Move assignment of bus shift setting out of the loop to avoid redundant operation. Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230208063331.15560-13-vadimp@nvidia.com Signed-off-by: Hans de Goede commit cefdbc7815660be4d0f2d290860dcfb0f9d285e4 Author: Vadim Pasternak Date: Wed Feb 8 08:33:28 2023 +0200 platform: mellanox: mlx-platform: Add mux selection register to regmap Extend writeable, readable, volatile registers of the 'regmap' object with for I2C mux selector registers. The motivation is to pass this object extended with selector registers to I2C mux driver working over ‘regmap’. Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230208063331.15560-12-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 26917eab144c8515435ef9175fdd5dddf9f0f000 Author: Vadim Pasternak Date: Wed Feb 8 08:33:27 2023 +0200 platform_data/mlxreg: Add field with mapped resource address Add field with PCIe remapped based address for passing it across relevant platform drivers sharing common system resources. Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230208063331.15560-11-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 26e118ea98cf5ec0b53198e643d5fa8d99b73b49 Author: Vadim Pasternak Date: Wed Feb 8 08:33:26 2023 +0200 platform/mellanox: mlxreg-hotplug: Allow more flexible hotplug events configuration Currently hotplug configuration in logic device assumes that all items are provided with no holes. Thus, any group of hotplug events, associated with the specific status/event/mask registers is configured in those registers successively from bit zero to bit #n (#n < 8). This logic is changed int order to allow non-successive definition to support configuration with the skipped bits – for example bits 3, 5, 7 in status/event/mask registers can be associated with hotplug events, while others can be skipped. Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230208063331.15560-10-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 233fd7e44cd7363ede8025619291b98475024c30 Author: Vadim Pasternak Date: Wed Feb 8 08:33:25 2023 +0200 platform: mellanox: Extend all systems with I2C notification callback Motivation is to provide synchronization between I2C main bus and other platform drivers using this notification callback. Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230208063331.15560-9-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 158cd83207768abdba86e408fed3169bb3ad3e9f Author: Vadim Pasternak Date: Wed Feb 8 08:33:24 2023 +0200 platform: mellanox: Split logic in init and exit flow Split logic in mlxplat_init()/mlxplat_exit() routines. Separate initialization of I2C infrastructure and others platform drivers. Motivation is to provide synchronization between I2C bus and mux drivers and other drivers using this infrastructure. I2C main bus and MUX busses are implemented in FPGA logic. On some new systems the numbers allocated for these busses could be variable depending on order of initialization of I2C native busses. Since bus numbers are passed to some other platform drivers during initialization flow, it is necessary to synchronize completion of I2C infrastructure drivers and activation of rest of drivers. Thus initialization flow will be performed in synchronized order. Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230208063331.15560-8-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 79cdf17e5131ccdee0792f6f25d3db0e34861998 Merge: 8024edf3590c8 40bc471dc7140 Author: David S. Miller Date: Mon Feb 13 11:05:12 2023 +0000 Merge branch 'ionic-on-chip-desc' Shannon Nelson says: ==================== ionic: on-chip descriptors We start with a couple of house-keeping patches that were originally presented for 'net', then we add support for on-chip descriptor rings for tx-push, as well as adding support for rx-push. I have a patch for the ethtool userland utility that I can send out once this has been accepted. v4: added rx-push attributes to ethtool netlink converted CMB feature from using a priv-flag to using ethtool tx/rx-push v3: edited commit message to describe interface-down limitation added warn msg if cmb_inuse alloc fails removed unnecessary clearing of phy_cmb_pages and cmb_npages changed cmb_rings_toggle to use cmb_inuse removed unrelated pci_set_drvdata() removed unnecessary (u32) cast added static inline func for writing CMB descriptors v2: dropped the rx buffers patch ==================== Signed-off-by: David S. Miller commit 40bc471dc714036c8ed223f9aa04b1b2072fb9db Author: Shannon Nelson Date: Fri Feb 10 16:50:17 2023 -0800 ionic: add tx/rx-push support with device Component Memory Buffers The ionic device has on-board memory (CMB) that can be used for descriptors as a way to speed descriptor access for faster packet processing. It is rumored to improve latency and/or packets-per-second for some profiles of small packet traffic, although your mileage may vary. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 5b4e9a7a71ab912d150cb2276cb23af51c863150 Author: Shannon Nelson Date: Fri Feb 10 16:50:16 2023 -0800 net: ethtool: extend ringparam set/get APIs for rx_push Similar to what was done for TX_PUSH, add an RX_PUSH concept to the ethtool interfaces. Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit 896de449f80476dc64b9167c41284532a4cccfec Author: Shannon Nelson Date: Fri Feb 10 16:50:15 2023 -0800 ionic: remove unnecessary void casts Minor Code cleanup details. Signed-off-by: Shannon Nelson Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 7bb990097db7ade1467c731fe4d80223e00004d8 Author: Shannon Nelson Date: Fri Feb 10 16:50:14 2023 -0800 ionic: remove unnecessary indirection We have the pointer already, don't need to go through the lif struct for it. Signed-off-by: Shannon Nelson Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit d3777ceaad080716f6d2c1a4c62020d494df00db Author: Herbert Xu Date: Tue Feb 7 16:18:36 2023 +0800 tls: Pass rec instead of aead_req into tls_encrypt_done The function tls_encrypt_done only uses aead_req to get ahold of the tls_rec object. So we could pass that in instead of aead_req to simplify the code. Suggested-by: Jakub Kicinski Signed-off-by: Herbert Xu Reviewed-by: Jakub Kicinski Signed-off-by: Herbert Xu commit 846366b0df0ad19051fbdd38734b1f7690d814c3 Author: Herbert Xu Date: Mon Feb 6 18:22:46 2023 +0800 crypto: api - Remove completion function scaffolding This patch removes the temporary scaffolding now that the comletion function signature has been converted. Signed-off-by: Herbert Xu Acked-by: Jarkko Sakkinen Signed-off-by: Herbert Xu commit 8580e55aa85f5000065450add82707a5ee7f88f5 Author: Herbert Xu Date: Mon Feb 6 18:22:44 2023 +0800 tls: Remove completion function scaffolding This patch removes the temporary scaffolding now that the comletion function signature has been converted. Signed-off-by: Herbert Xu commit 65cb4657bac776967f1f794fb45d2fa419565c63 Author: Herbert Xu Date: Mon Feb 6 18:22:42 2023 +0800 tipc: Remove completion function scaffolding This patch removes the temporary scaffolding now that the comletion function signature has been converted. Signed-off-by: Herbert Xu commit 6002e20dd0f85cfaedc2f2f54a60119f84a60838 Author: Herbert Xu Date: Mon Feb 6 18:22:40 2023 +0800 net: ipv6: Remove completion function scaffolding This patch removes the temporary scaffolding now that the comletion function signature has been converted. Signed-off-by: Herbert Xu commit fd5dabf764f79ced0b128ddad39fb272e884a5b8 Author: Herbert Xu Date: Mon Feb 6 18:22:38 2023 +0800 net: ipv4: Remove completion function scaffolding This patch removes the temporary scaffolding now that the comletion function signature has been converted. Signed-off-by: Herbert Xu commit 23b8b93ba94bff36fb35454df1c93481fc47c160 Author: Herbert Xu Date: Mon Feb 6 18:22:36 2023 +0800 net: macsec: Remove completion function scaffolding This patch removes the temporary scaffolding now that the comletion function signature has been converted. Signed-off-by: Herbert Xu commit dcfe653d7cd4f3891aa0a471a1afdae884941bee Author: Herbert Xu Date: Mon Feb 6 18:22:34 2023 +0800 dm: Remove completion function scaffolding This patch removes the temporary scaffolding now that the comletion function signature has been converted. Signed-off-by: Herbert Xu Acked-by: Mike Snitzer Signed-off-by: Herbert Xu commit 255e48eb17684157336bd6dd98d22c1b2d9e3f43 Author: Herbert Xu Date: Wed Feb 8 13:58:44 2023 +0800 crypto: api - Use data directly in completion function This patch does the final flag day conversion of all completion functions which are now all contained in the Crypto API. Signed-off-by: Herbert Xu commit 234650bd22b4a875a359c83066fd723704aaa7b2 Author: Herbert Xu Date: Tue Jan 31 16:02:50 2023 +0800 crypto: talitos - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 555c5661317e9c3090b9d181106d8bc31dd8e29a Author: Herbert Xu Date: Tue Jan 31 16:02:48 2023 +0800 crypto: sahara - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit e94c1c9b43bcb6a6f094b36fcee0bdf6d0712cd5 Author: Herbert Xu Date: Tue Jan 31 16:02:46 2023 +0800 crypto: s5p-sss - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 0cbe89d5d17393f4ef3d5c25af8bc730fd507cf5 Author: Herbert Xu Date: Tue Jan 31 16:02:44 2023 +0800 crypto: qce - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 6c621864554c9b767df6839999d5e0465c8be097 Author: Herbert Xu Date: Tue Jan 31 16:02:42 2023 +0800 crypto: qat - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d Author: Randy Dunlap Date: Wed Feb 8 17:08:25 2023 -0800 m68k: /proc/hardware should depend on PROC_FS When CONFIG_PROC_FS is not set, there is a build error for an unused function. Make PROC_HARDWARE depend on PROC_FS to prevent this error. In file included from ../arch/m68k/kernel/setup.c:3: ../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function] 477 | static int hardware_proc_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~~~~~~~ Fixes: 66d857b08b8c ("m68k: merge m68k and m68knommu arch directories") # v3.0 Signed-off-by: Randy Dunlap Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230209010825.24136-1-rdunlap@infradead.org Signed-off-by: Geert Uytterhoeven commit 25c9d2c358aec584bbbc7dfd09a55f123c4b8258 Author: Herbert Xu Date: Tue Jan 31 16:02:40 2023 +0800 crypto: mxs-dcp - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 25085ba5a77b80dbf3b2b06c64452cf748c3cf01 Author: Herbert Xu Date: Tue Jan 31 16:02:38 2023 +0800 crypto: octeontx2 - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit d80bcdf297e8b03caaaa868941cab47ec2768750 Author: Herbert Xu Date: Tue Jan 31 16:02:35 2023 +0800 crypto: octeontx - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 25e3159c79fc1c35ed6bea076d151786e198cf64 Author: Herbert Xu Date: Tue Jan 31 16:02:33 2023 +0800 crypto: marvell/cesa - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 0d07ae6ae9cb902214c925778d748af805a0c7f0 Author: Herbert Xu Date: Tue Jan 31 16:02:31 2023 +0800 crypto: ixp4xx - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 47c32286fbc6399812b8b10f4f45473f82f16730 Author: Herbert Xu Date: Tue Jan 31 16:02:29 2023 +0800 crypto: safexcel - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit a712bff02333821639ff4b19ceed5a988ea8c50a Author: Herbert Xu Date: Tue Jan 31 16:02:27 2023 +0800 crypto: img-hash - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit e2b537b7706284afba9b780e21f879e1c0a0ec20 Author: Herbert Xu Date: Tue Jan 31 16:02:25 2023 +0800 crypto: hisilicon - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 17fcc82eebd92a510b2124ae5544491af950a315 Author: Herbert Xu Date: Tue Jan 31 16:02:23 2023 +0800 crypto: hifn_795x - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 13c20754c664796a697859d5d329810236cdc131 Author: Herbert Xu Date: Tue Jan 31 16:02:21 2023 +0800 crypto: chelsio - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 0c18d05463315ce144c2d72a2699fa54ef429f52 Author: Herbert Xu Date: Tue Jan 31 16:02:19 2023 +0800 crypto: ccp - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit ea2fbe3b1a317498d2c66d6b97bc281db1a18b45 Author: Herbert Xu Date: Tue Jan 31 16:02:17 2023 +0800 crypto: nitrox - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit b34a6416728812b5ca283598100516852646a133 Author: Herbert Xu Date: Tue Jan 31 16:02:15 2023 +0800 crypto: cpt - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 33ccbfd2e02a04d2fdbf8f48a80230f6235493bd Author: Herbert Xu Date: Tue Jan 31 16:02:12 2023 +0800 crypto: bcm - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 51bdb2fe01dfad5447b9cb6f565c73b32b519b2e Author: Herbert Xu Date: Tue Jan 31 16:02:10 2023 +0800 crypto: artpec6 - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu Acked-by: Jesper Nilsson Signed-off-by: Herbert Xu commit 7d19abdcb7b3443021ce744ded8db1a0203f1594 Author: Herbert Xu Date: Tue Jan 31 16:02:08 2023 +0800 crypto: atmel - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit f27c94aac5b071f402c0ff8ef439d4b2058502fd Author: Herbert Xu Date: Wed Feb 8 13:56:00 2023 +0800 crypto: cryptd - Use request_complete helpers Use the request_complete helpers instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 Author: Herbert Xu Date: Tue Jan 31 16:02:04 2023 +0800 crypto: rsa-pkcs1pad - Use akcipher_request_complete Use the akcipher_request_complete helper instead of calling the completion function directly. In fact the previous code was buggy in that EINPROGRESS was never passed back to the original caller. Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm") Signed-off-by: Herbert Xu commit 6909823d47c17cba84e9244d04050b5db8d53789 Author: Herbert Xu Date: Tue Jan 31 16:02:02 2023 +0800 crypto: engine - Use crypto_request_complete Use the crypto_request_complete helper instead of calling the completion function directly. Signed-off-by: Herbert Xu commit d5770679ad5abc8d62dc5aff7b3f888dfe8a05fa Author: Herbert Xu Date: Tue Jan 31 16:02:00 2023 +0800 crypto: skcipher - Use crypto_request_complete Use the crypto_request_complete helper instead of calling the completion function directly. Signed-off-by: Herbert Xu commit ba354b2fdb1068495ffeabc9f48b799407300f92 Author: Herbert Xu Date: Tue Jan 31 16:01:58 2023 +0800 crypto: kpp - Use crypto_request_complete Use the crypto_request_complete helper instead of calling the completion function directly. Signed-off-by: Herbert Xu commit d9588045f540157e36d8d6aeb54d6ce769a89b5b Author: Herbert Xu Date: Fri Feb 10 20:20:20 2023 +0800 crypto: hash - Use crypto_request_complete Use the crypto_request_complete helper instead of calling the completion function directly. This patch also removes the voodoo programming previously used for unaligned ahash operations and replaces it with a sub-request. Signed-off-by: Herbert Xu commit 700d507805727635e8f57882a7f9641e8ca1eb19 Author: Herbert Xu Date: Tue Jan 31 16:01:53 2023 +0800 crypto: akcipher - Use crypto_request_complete Use the crypto_request_complete helper instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 372e6b80bafe1269f43c750885aa32baa34cd017 Author: Herbert Xu Date: Tue Jan 31 16:01:51 2023 +0800 crypto: aead - Use crypto_request_complete Use the crypto_request_complete helper instead of calling the completion function directly. Signed-off-by: Herbert Xu commit 4cc01c7f3df10a4f7aa11266e8406f7e16898769 Author: Herbert Xu Date: Tue Jan 31 16:01:49 2023 +0800 crypto: acompress - Use crypto_request_complete Use the crypto_request_complete helper instead of calling the completion function directly. Signed-off-by: Herbert Xu Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 256f9e53ae129c9536226b485a8c4e98223088d0 Author: Herbert Xu Date: Wed Feb 8 13:53:24 2023 +0800 crypto: cryptd - Use subreq for AEAD AEAD reuses the existing request object for its child. This is error-prone and unnecessary. This patch adds a subrequest object just like we do for skcipher and hash. This patch also restores the original completion function as we do for skcipher/hash. Signed-off-by: Herbert Xu commit 5419f2b27ea594f97cbeb743789448a9872f283f Author: Herbert Xu Date: Mon Feb 6 18:22:29 2023 +0800 KEYS: DH: Use crypto_wait_req This patch replaces the custom crypto completion function with crypto_req_done. Signed-off-by: Herbert Xu commit 8d338c76f7cfe0eb4bc46078b1c09c8c5fc75353 Author: Herbert Xu Date: Mon Feb 6 18:22:27 2023 +0800 tls: Only use data field in crypto completion function The crypto_async_request passed to the completion is not guaranteed to be the original request object. Only the data field can be relied upon. Fix this by storing the socket pointer with the AEAD request. Signed-off-by: Herbert Xu commit 1dbab1312254602175c805863eaace59ebf162ba Author: Herbert Xu Date: Mon Feb 6 18:22:25 2023 +0800 tipc: Add scaffolding to change completion function signature This patch adds temporary scaffolding so that the Crypto API completion function can take a void * instead of crypto_async_request. Once affected users have been converted this can be removed. Signed-off-by: Herbert Xu commit ec2964e807d1d53dbc7a23d7b2c9019245ae121b Author: Herbert Xu Date: Mon Feb 6 18:22:23 2023 +0800 net: ipv6: Add scaffolding to change completion function signature This patch adds temporary scaffolding so that the Crypto API completion function can take a void * instead of crypto_async_request. Once affected users have been converted this can be removed. Signed-off-by: Herbert Xu commit 14d3109c9c5aa993c46c2219d222fc40eaff113e Author: Herbert Xu Date: Mon Feb 6 18:22:21 2023 +0800 net: ipv4: Add scaffolding to change completion function signature This patch adds temporary scaffolding so that the Crypto API completion function can take a void * instead of crypto_async_request. Once affected users have been converted this can be removed. Signed-off-by: Herbert Xu commit fe93d841dda6885f4cdf40de676f1adf81b4fb45 Author: Herbert Xu Date: Mon Feb 6 18:22:19 2023 +0800 Bluetooth: Use crypto_wait_req This patch replaces the custom crypto completion function with crypto_req_done. Signed-off-by: Herbert Xu commit 20066bf70034007874c546e456c9546bfad3759a Author: Herbert Xu Date: Mon Feb 6 18:22:17 2023 +0800 fs: ecryptfs: Use crypto_wait_req This patch replaces the custom crypto completion function with crypto_req_done. Signed-off-by: Herbert Xu Acked-by: Jarkko Sakkinen Signed-off-by: Herbert Xu commit 30859e97e06ac15d77ee2fc26bfe2583c01f3fc7 Author: Herbert Xu Date: Mon Feb 6 18:22:15 2023 +0800 net: macsec: Add scaffolding to change completion function signature This patch adds temporary scaffolding so that the Crypto API completion function can take a void * instead of crypto_async_request. Once affected users have been converted this can be removed. Signed-off-by: Herbert Xu Acked-by: Jarkko Sakkinen Signed-off-by: Herbert Xu commit 96747228b72509e981c146b06f652e0f17a26675 Author: Herbert Xu Date: Mon Feb 6 18:22:12 2023 +0800 dm: Add scaffolding to change completion function signature This patch adds temporary scaffolding so that the Crypto API completion function can take a void * instead of crypto_async_request. Once affected users have been converted this can be removed. Signed-off-by: Herbert Xu Acked-by: Mike Snitzer Signed-off-by: Herbert Xu commit c35e03eaece71101ff6cbf776b86403860ac8cc3 Author: Herbert Xu Date: Tue Jan 31 16:01:45 2023 +0800 crypto: api - Add scaffolding to change completion function signature The crypto completion function currently takes a pointer to a struct crypto_async_request object. However, in reality the API does not allow the use of any part of the object apart from the data field. For example, ahash/shash will create a fake object on the stack to pass along a different data field. This leads to potential bugs where the user may try to dereference or otherwise use the crypto_async_request object. This patch adds some temporary scaffolding so that the completion function can take a void * instead. Once affected users have been converted this can be removed. The helper crypto_request_complete will remain even after the conversion is complete. It should be used instead of calling the completion function directly. Signed-off-by: Herbert Xu Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 8024edf3590c83f467374857d7c3082d4b3bf079 Merge: 4fab64126891d 5791a73c89165 Author: David S. Miller Date: Mon Feb 13 09:56:17 2023 +0000 Merge branch 'net-ipa-GSI-regs' Alex Elder says: ==================== net: ipa: determine GSI register offsets differently This series changes the way GSI register offset are specified, using the "reg" mechanism currently used for IPA registers. A follow-on series will extend this work so fields within GSI registers are also specified this way. The first patch rearranges the GSI register initialization code so it is similar to the way it's done for the IPA registers. The second identifies all the GSI registers in an enumerated type. The third introduces "gsi_reg-v3.1.c" and uses the "reg" code to define one GSI register offset. The second-to-last patch just adds "gsi_reg-v3.5.1.c", because that version introduces a new register not previously defined. All the rest just define the rest of the GSI register offsets using the "reg" mechanism. Note that, to have continued lines align with an open parenthesis, new files created in this series cause some checkpatch warnings. ==================== Signed-off-by: David S. Miller commit 5791a73c891656b49d89b52fca77c231b4fa56c0 Author: Alex Elder Date: Fri Feb 10 13:36:55 2023 -0600 net: ipa: define IPA remaining GSI register offsets Add the remaining GSI register offset definitions. Use gsi_reg() rather than the corresponding GSI_*_OFFSET() macros to get the offsets for these registers, and get rid of the macros. Note that we are now defining information for the HW_PARAM_2 register, and that doesn't appear until IPA v3.5.1. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 465d1bc9823d842cd5d9236d253487c0953aa54c Author: Alex Elder Date: Fri Feb 10 13:36:54 2023 -0600 net: ipa: add "gsi_v3.5.1.c" The next patch adds a GSI register field that is only valid starting at IPA v3.5.1. Create "gsi_v3.5.1.c" from "gsi_v3.1.c", changing only the name of the public regs structure it defines. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 7ba51aa2d09b50546d29a178f51103a23311cf84 Author: Alex Elder Date: Fri Feb 10 13:36:53 2023 -0600 net: ipa: define IPA v3.1 GSI interrupt register offsets Add definitions of the offsets for IRQ-related GSI registers. Use gsi_reg() rather than the corresponding GSI_CNTXT_*_OFFSET() macros to get the offsets for these registers, and get rid of the macros. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit d1ce6395d4648b41cf762714934e34ae57f0d1a4 Author: Alex Elder Date: Fri Feb 10 13:36:52 2023 -0600 net: ipa: define IPA v3.1 GSI event ring register offsets Add definitions of the offsets and strides for registers whose offset depends on an event ring ID, and use gsi_reg() and its returned value to determine offsets for these registers. Get rid of the corresponding GSI_EV_CH_E_*_OFFSET() macros. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 76924eb92801e6893eb59be7b3a999bc9bd24891 Author: Alex Elder Date: Fri Feb 10 13:36:51 2023 -0600 net: ipa: add more GSI register definitions Continue populating with GSI register definitions, adding remaining registers whose offset depends on a channel ID. Use gsi_reg() and reg_n_offset() to determine offsets for those registers, and get rid of the corresponding GSI_CH_C_*_OFFSET() macros. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit d2bb6e657f164e37fe6d170cac869904d9cc26bc Author: Alex Elder Date: Fri Feb 10 13:36:50 2023 -0600 net: ipa: start creating GSI register definitions Create a new register definition file in the "reg" subdirectory, and begin populating it with GSI register definitions based on IPA version. The GSI registers haven't changed much, so several IPA versions can share the same GSI register definitions. As with IPA registers, an array of pointers indexed by GSI register ID refers to these register definitions, and a new "regs" field in the GSI structure is initialized in gsi_reg_init() to refer to register information based on the IPA version (though for now there's only one). The new function gsi_reg() returns register information for a given GSI register, and the result can be used to look up that register's offset. This patch is meant only to put the infrastructure in place, so only eon register (CH_C_QOS) is defined for each version, and only the offset and stride are defined for that register. Use new function gsi_reg() to look up that register's information to get its offset, This makes the GSI_CH_C_QOS_OFFSET() unnecessary, so get rid of it. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 8f0fece65d9e6c7254cb030487cd5789af36caff Author: Alex Elder Date: Fri Feb 10 13:36:49 2023 -0600 net: ipa: introduce GSI register IDs Create a new gsi_reg_id enumerated type, which identifies each GSI register with a symbolic identifier. Create a function that indicates whether a register ID is valid. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 3c506add35c74acbe5a42d0a86963d11bef10d25 Author: Alex Elder Date: Fri Feb 10 13:36:48 2023 -0600 net: ipa: introduce gsi_reg_init() Create a new source file "gsi_reg.c", and in it, introduce a new function to encapsulate initializing GSI registers, including looking up and I/O mapping their memory. Create gsi_reg_exit() as the inverse of the init function. Signed-off-by: Alex Elder Signed-off-by: David S. Miller commit 4fab64126891d413f207dacd5762a839b3470315 Author: Eric Dumazet Date: Fri Feb 10 15:26:05 2023 +0000 net/sched: fix error recovery in qdisc_create() If TCA_STAB attribute is malformed, qdisc_get_stab() returns an error, and we end up calling ops->destroy() while ops->init() has not been called yet. While we are at it, call qdisc_put_stab() after ops->destroy(). Fixes: 1f62879e3632 ("net/sched: make stab available before ops->init() call") Reported-by: syzbot+d44d88f1d11e6ca8576b@syzkaller.appspotmail.com Signed-off-by: Eric Dumazet Cc: Vladimir Oltean Cc: Kurt Kanzenbach Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit cafc3662ee3fe29a0027e0a947e6c6493cccaf60 Author: Horatiu Vultur Date: Fri Feb 10 11:27:01 2023 +0100 net: micrel: Add PHC support for lan8841 Add support for PHC and timestamping operations for the lan8841 PHY. PTP 1-step and 2-step modes are supported, over Ethernet and UDP both ipv4 and ipv6. Signed-off-by: Horatiu Vultur Signed-off-by: David S. Miller commit 238052e0449d23d9a8aca811242882b27a26c231 Merge: 170677fee45ba 6b4bfa43ce291 Author: David S. Miller Date: Mon Feb 13 09:49:14 2023 +0000 Merge branch 'devlink-params-cleanup' Jiri Pirko says: ==================== devlink: params cleanups and devl_param_driverinit_value_get() fix The primary motivation of this patchset is the patch #6, which fixes an issue introduced by 075935f0ae0f ("devlink: protect devlink param list by instance lock") and reported by Kim Phillips (https://lore.kernel.org/netdev/719de4f0-76ac-e8b9-38a9-167ae239efc7@amd.com/) and my colleagues doing mlx5 driver regression testing. The basis idea is that devl_param_driverinit_value_get() could be possible to the called without holding devlink intance lock in most of the cases (all existing ones in the current codebase), which would fix some mlx5 flows where the lock is not held. To achieve that, make sure that the param value does not change between reloads with patch #2. Also, convert the param list to xarray which removes the worry about list_head consistency when doing lockless lookup. The rest of the patches are doing some small related cleanup of things that poke me in the eye during the work. --- v1->v2: - a small bug was fixed in patch #2, the rest of the code stays the same so I left review/ack tags attached to them ==================== Signed-off-by: David S. Miller commit 6b4bfa43ce29165fb0a2a8ef770d94c1d93e5ad8 Author: Jiri Pirko Date: Fri Feb 10 11:01:31 2023 +0100 devlink: add forgotten devlink instance lock assertion to devl_param_driverinit_value_set() Driver calling devl_param_driverinit_value_set() has to hold devlink instance lock while doing that. Put an assertion there. Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Acked-by: Jakub Kicinski Reviewed-by: Jacob Keller Signed-off-by: David S. Miller commit 280f7b2adca09c8d5f34b99f49e5c570aa81daad Author: Jiri Pirko Date: Fri Feb 10 11:01:30 2023 +0100 devlink: allow to call devl_param_driverinit_value_get() without holding instance lock If the driver maintains following basic sane behavior, the devl_param_driverinit_value_get() function could be called without holding instance lock: 1) Driver ensures a call to devl_param_driverinit_value_get() cannot race with registering/unregistering the parameter with the same parameter ID. 2) Driver ensures a call to devl_param_driverinit_value_get() cannot race with devl_param_driverinit_value_set() call with the same parameter ID. 3) Driver ensures a call to devl_param_driverinit_value_get() cannot race with reload operation. By the nature of params usage, these requirements should be trivially achievable. If the driver for some off reason is not able to comply, it has to take the devlink->lock while calling devl_param_driverinit_value_get(). Remove the lock assertion and add comment describing the locking requirements. This fixes a splat in mlx5 driver introduced by the commit referenced in the "Fixes" tag. Lore: https://lore.kernel.org/netdev/719de4f0-76ac-e8b9-38a9-167ae239efc7@amd.com/ Reported-by: Kim Phillips Fixes: 075935f0ae0f ("devlink: protect devlink param list by instance lock") Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Acked-by: Jakub Kicinski Reviewed-by: Jacob Keller Tested-by: Kim Phillips Signed-off-by: David S. Miller commit a72e17b4523223015d3b3fd79bac2b065d6d09a9 Author: Jiri Pirko Date: Fri Feb 10 11:01:29 2023 +0100 devlink: convert param list to xarray Loose the linked list for params and use xarray instead. Note that this is required to be eventually possible to call devl_param_driverinit_value_get() without holding instance lock. Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Acked-by: Jakub Kicinski Reviewed-by: Jacob Keller Signed-off-by: David S. Miller commit fbcf938150ecd686c6a6195573957db25b43a182 Author: Jiri Pirko Date: Fri Feb 10 11:01:28 2023 +0100 devlink: use xa_for_each_start() helper in devlink_nl_cmd_port_get_dump_one() As xarray has an iterator helper that allows to start from specified index, use this directly and avoid repeated iteration from 0. Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Acked-by: Jakub Kicinski Reviewed-by: Jacob Keller Signed-off-by: David S. Miller commit 94ba1c316b9c0f9b017f7cd7eac84adae693e80f Author: Jiri Pirko Date: Fri Feb 10 11:01:27 2023 +0100 devlink: fix the name of value arg of devl_param_driverinit_value_get() Probably due to copy-paste error, the name of the arg is "init_val" which is misleading, as the pointer is used to point to struct where to store the current value. Rename it to "val" and change the arg comment a bit on the way. Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Acked-by: Jakub Kicinski Reviewed-by: Jacob Keller Signed-off-by: David S. Miller commit afd888c3e19ceb5247158fe2fabbf7234937a515 Author: Jiri Pirko Date: Fri Feb 10 11:01:26 2023 +0100 devlink: make sure driver does not read updated driverinit param before reload The driverinit param purpose is to serve the driver during init/reload time to provide a value, either default or set by user. Make sure that driver does not read value updated by user before the reload is performed. Hold the new value in a separate struct and switch it during reload. Note that this is required to be eventually possible to call devl_param_driverinit_value_get() without holding instance lock. Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit fa2f921f3bf1ed98956ad341b920a55aab69bc35 Author: Jiri Pirko Date: Fri Feb 10 11:01:25 2023 +0100 devlink: don't use strcpy() to copy param value No need to treat string params any different comparing to other types. Rely on the struct assign to copy the whole struct, including the string. Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Acked-by: Jakub Kicinski Reviewed-by: Jacob Keller Signed-off-by: David S. Miller commit 170677fee45baa955b3f7c1f41e6031d1d1e2272 Author: Yu Xiao Date: Fri Feb 10 10:53:19 2023 +0100 nfp: ethtool: supplement nfp link modes supported Add support for the following modes to the nfp driver: NFP_MEDIA_10GBASE_LR NFP_MEDIA_25GBASE_LR NFP_MEDIA_25GBASE_ER These modes are supported by the hardware and, support for them was recently added to firmware. Signed-off-by: Yu Xiao Signed-off-by: Simon Horman Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 6d86bb0a5cb82bd459b017f180bdc47bec561b2d Author: Jacob Keller Date: Thu Feb 9 14:20:45 2023 -0800 devlink: stop using NL_SET_ERR_MSG_MOD NL_SET_ERR_MSG_MOD inserts the KBUILD_MODNAME and a ':' before the actual extended error message. The devlink feature hasn't been able to be compiled as a module since commit f4b6bcc7002f ("net: devlink: turn devlink into a built-in"). Stop using NL_SET_ERR_MSG_MOD, and just use the base NL_SET_ERR_MSG. This aligns the extended error messages better with the NL_SET_ERR_MSG_ATTR messages as well. Signed-off-by: Jacob Keller Acked-by: Jakub Kicinski Signed-off-by: David S. Miller commit 68762148d1b011d47bc2ceed7321739b5aea1e63 Author: Pietro Borrello Date: Thu Feb 9 12:26:23 2023 +0000 rds: rds_rm_zerocopy_callback() correct order for list_add_tail() rds_rm_zerocopy_callback() uses list_add_tail() with swapped arguments. This links the list head with the new entry, losing the references to the remaining part of the list. Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") Suggested-by: Paolo Abeni Signed-off-by: Pietro Borrello Signed-off-by: David S. Miller commit 04df97e150c83d4640540008e95d0229cb188135 Author: Bagas Sanjaya Date: Mon Feb 13 15:59:20 2023 +0700 Documentation: rust: Fix arch support table Stephen Rothwell reported htmldocs warning when merging uml tree: Documentation/rust/arch-support.rst:20: WARNING: Blank line required after table. Fix the arch support table by removing extraneous simple table marker. Link: https://lore.kernel.org/linux-next/20230213152714.78b844f4@canb.auug.org.au/ Fixes: 0438aadfa69a34 ("rust: arch/um: Add support for CONFIG_RUST under x86_64 UML") Reported-by: Stephen Rothwell Signed-off-by: Bagas Sanjaya Signed-off-by: Richard Weinberger commit 6c7667c9bc12778d5566137fd4b34f03e1f36909 Author: Carlos Bilbao Date: Thu Feb 9 12:16:38 2023 -0600 uml: vector: Remove unused definitions VECTOR_{WRITE,HEADERS} Remove definitions of VECTOR_WRITE and VECTOR_HEADERS since no longer used. Signed-off-by: Carlos Bilbao Acked-By: Anton Ivanov Signed-off-by: Richard Weinberger commit 339b84dcd7113dd076419ea2a47128cc53450305 Author: Benjamin Berg Date: Thu Feb 9 10:00:05 2023 +0100 um: virt-pci: properly remove PCI device from bus Triggering a bus rescan will not cause the PCI device to be removed. It is required to explicitly stop and remove the device from the bus. Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Benjamin Berg Signed-off-by: Richard Weinberger commit abdeb4fa5e1b5b4918034f02236fd886f40c20c1 Author: Benjamin Berg Date: Thu Feb 9 10:00:04 2023 +0100 um: virtio_uml: move device breaking into workqueue We should not be calling virtio_break_device from an IRQ context. Move breaking the device into the workqueue so that it is done from a reasonable context. Fixes: af9fb41ed315 ("um: virtio_uml: Fix broken device handling in time-travel") Signed-off-by: Benjamin Berg Signed-off-by: Richard Weinberger commit 8e9cd85139a2149d5a7c121b05e0cdb8287311f9 Author: Benjamin Berg Date: Thu Feb 9 10:00:03 2023 +0100 um: virtio_uml: mark device as unregistered when breaking it Mark the device as not registered anymore when scheduling the work to remove it. Otherwise we could end up scheduling the work multiple times in a row, including scheduling it while it is already running. Fixes: af9fb41ed315 ("um: virtio_uml: Fix broken device handling in time-travel") Signed-off-by: Benjamin Berg Signed-off-by: Richard Weinberger commit 8a6ca543646f2940832665dbf4e04105262505e2 Author: Benjamin Berg Date: Thu Feb 9 10:00:02 2023 +0100 um: virtio_uml: free command if adding to virtqueue failed If adding the command fails (i.e. the virtqueue is broken) then free it again if the function allocated a new buffer for it. Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") Signed-off-by: Benjamin Berg Signed-off-by: Richard Weinberger commit b99ddbe8336ee680257c8ab479f75051eaa49dcf Author: Masahiro Yamada Date: Wed Feb 8 01:41:56 2023 +0900 UML: define RUNTIME_DISCARD_EXIT With CONFIG_VIRTIO_UML=y, GNU ld < 2.36 fails to link UML vmlinux (w/wo CONFIG_LD_SCRIPT_STATIC). `.exit.text' referenced in section `.uml.exitcall.exit' of arch/um/drivers/virtio_uml.o: defined in discarded section `.exit.text' of arch/um/drivers/virtio_uml.o collect2: error: ld returned 1 exit status This fix is similar to the following commits: - 4b9880dbf3bd ("powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT") - a494398bde27 ("s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36") - c1c551bebf92 ("sh: define RUNTIME_DISCARD_EXIT") Fixes: 99cb0d917ffa ("arch: fix broken BuildID for arm64 and riscv") Reported-by: SeongJae Park Signed-off-by: Masahiro Yamada Tested-by: SeongJae Park Signed-off-by: Richard Weinberger commit 522c532c4fe730258118fb146577ec9bedf6b807 Author: Vincent Whitchurch Date: Fri Jan 27 15:30:27 2023 +0100 virt-pci: add platform bus support This driver registers PCI busses, but the underlying virtio protocol could just as easily be used to provide a platform bus instead. If the virtio device node in the devicetree indicates that it's compatible with simple-bus, register platform devices instead of handling it as a PCI bus. Only one platform bus is allowed and the logic MMIO region for the platform bus is placed at an arbitrarily-chosen address away from the PCI region. Signed-off-by: Vincent Whitchurch Signed-off-by: Richard Weinberger commit 935f8f7a0123ffa0a2dd7234713dc2ebeeb08955 Author: Vincent Whitchurch Date: Thu Jan 26 11:47:10 2023 +0100 um-virt-pci: Make max delay configurable There is a hard coded maximum time for which the driver busy-loops waiting for a response from the virtio device. This default time may be too short for some systems, so make it a module parameter so that it can be set via the kernel command line. Signed-off-by: Vincent Whitchurch Signed-off-by: Richard Weinberger commit 314a1408b79a844dafdcde867d90de5d509409b7 Author: Vincent Whitchurch Date: Fri Jan 20 09:02:32 2023 +0100 um: virt-pci: implement pcibios_get_phb_of_node() Implement pcibios_get_phb_of_node() as x86 does in order to allow PCI busses to be associated with devicetree nodes. Signed-off-by: Vincent Whitchurch Acked-by: Johannes Berg Signed-off-by: Richard Weinberger commit 83e913f52aba69149261742aa9ea4ceea7bf182d Author: Peter Foley Date: Fri Jan 13 12:03:00 2023 -0500 um: Support LTO Only a handful of changes are necessary to get it to work. Signed-off-by: Peter Foley Signed-off-by: Richard Weinberger commit f09c3fcf67a3294c981b861981143e38895c5a59 Author: Peter Foley Date: Fri Jan 13 11:56:11 2023 -0500 um: put power options in a menu Because having them all dumped at top-level is a bit messy. Signed-off-by: Peter Foley Signed-off-by: Richard Weinberger commit 6aa56115c73b37270e53aa91984bdb8b60164ec7 Author: Peter Foley Date: Thu Jan 12 23:49:10 2023 -0500 um: Use CFLAGS_vmlinux link-vmlinux.sh doesn't use LDFLAGS_vmlinux when linking the kernel for UML. Move the LDFLAGS_EXESTACK options into CFLAGS_vmlinux so they're actually respected. e.g. /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: warning: .tmp_vmlinux.kallsyms3.o: missing .note.GNU-stack section implies executable stack /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../x86_64-pc-linux-gnu/bin/ld: warning: vmlinux has a LOAD segment with RWX permissions Reviewed-by: David Gow Signed-off-by: Peter Foley Signed-off-by: Richard Weinberger commit 910dba41239224069c17bb6c30c9d43c1ba229f1 Author: Peter Foley Date: Thu Jan 12 23:49:09 2023 -0500 um: Prevent building modules incompatible with MODVERSIONS The manual ld invocation in arch/um/drivers doesn't play nicely with genksyms. Given the problematic modules are deprecated anyway, just prevent building them when using MODVERSIONS. e.g. MODPOST Module.symvers arch/um/drivers/.pcap.o.cmd: No such file or directory Signed-off-by: Peter Foley Signed-off-by: Richard Weinberger commit 2c4d3841a82b88ae8a7b518dc6206f84f68e705a Author: Peter Foley Date: Thu Jan 12 23:49:08 2023 -0500 um: Avoid pcap multiple definition errors Change the function name in pcap_kern to avoid conflicting with libpcap.a. e.g. ld: /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../lib64/libpcap.a(pcap.o): in function `pcap_init': (.text+0x7f0): multiple definition of `pcap_init'; arch/um/drivers/pcap_kern.o:pcap_kern.c:(.text.unlikely+0x0): first defined here Signed-off-by: Peter Foley Signed-off-by: Richard Weinberger commit 9a0450ada86e842997db6296244e159879fb6ef9 Author: Gustavo A. R. Silva Date: Thu Feb 2 19:28:23 2023 -0600 xen: Replace one-element array with flexible-array member One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct xen_page_directory. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1]. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/255 Link: https://gcc.gnu.org/pipermail/gcc-patches/2022-October/602902.html [1] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/Y9xjN6Wa3VslgXeX@work Signed-off-by: Juergen Gross commit 85b93bbd1c9768d09adebbe9f33bab0d4ec94404 Author: Julien Gomes Date: Wed Feb 8 11:58:36 2023 -0800 tpm: add vendor flag to command code validation Some TPM 2.0 devices have support for additional commands which are not part of the TPM 2.0 specifications. These commands are identified with bit 29 of the 32 bits command codes. Contrarily to other fields of the TPMA_CC spec structure used to list available commands, the Vendor flag also has to be present in the command code itself (TPM_CC) when called. Add this flag to tpm_find_cc() mask to prevent blocking vendor command codes that can actually be supported by the underlying TPM device. Signed-off-by: Julien Gomes Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 1e2714bb83fc783d58701967391bea242c65eaff Author: Eddie James Date: Thu Jan 26 15:08:10 2023 -0600 tpm: Add reserved memory event log Some platforms may desire to pass the event log up to Linux in the form of a reserved memory region. In particular, this is desirable for embedded systems or baseboard management controllers (BMCs) booting with U-Boot. IBM OpenBMC BMCs will be the first user. Add support for the reserved memory in the TPM core to find the region and map it. Signed-off-by: Eddie James [jarkko: removed spurious dev_info()'s from tpm_read_log_memory_region()] Reviewed-by: Jarkko Sakkinen [yang: return -ENOMEM when devm_memremap() fails] Signed-off-by: Yang Yingliang Signed-off-by: Jarkko Sakkinen commit 441b7152729f4a2bdb100135a58625fa0aeb69e4 Author: Eddie James Date: Thu Jan 26 15:08:09 2023 -0600 tpm: Use managed allocation for bios event log Since the bios event log is freed in the device release function, let devres handle the deallocation. This will allow other memory allocation/mapping functions to be used for the bios event log. Signed-off-by: Eddie James Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 40078327f6045185775eb7442a02f8edad2dea52 Author: Uwe Kleine-König Date: Fri Nov 18 23:35:39 2022 +0100 tpm: tis_i2c: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 8f3fb73b8b8dbac9803952086710fc32de377b8e Author: Uwe Kleine-König Date: Fri Nov 18 23:35:38 2022 +0100 tpm: tpm_i2c_nuvoton: Convert to i2c's .probe_new() .probe_new() doesn't get the i2c_device_id * parameter, so determine that explicitly in the probe function. Signed-off-by: Uwe Kleine-König Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit d5ae2f4760c5b332a805f1caae9eb10101152ddd Author: Uwe Kleine-König Date: Fri Nov 18 23:35:37 2022 +0100 tpm: tpm_i2c_infineon: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit d787c95b565fd72259082ca771bfdc1a55ae3960 Author: Uwe Kleine-König Date: Fri Nov 18 23:35:36 2022 +0100 tpm: tpm_i2c_atmel: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 376f88f44ec03e8df573888056f1992602498df1 Author: Uwe Kleine-König Date: Fri Nov 18 23:35:35 2022 +0100 tpm: st33zp24: Convert to i2c's .probe_new() The probe function doesn't make use of the i2c_device_id * parameter so it can be trivially converted. Signed-off-by: Uwe Kleine-König Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 10de7b54293995368c52d9aa153f3e7a359f04a1 Author: Denis Kenzior Date: Fri Aug 26 09:51:19 2022 -0500 KEYS: asymmetric: Fix ECDSA use via keyctl uapi When support for ECDSA keys was added, constraints for data & signature sizes were never updated. This makes it impossible to use such keys via keyctl API from userspace. Update constraint on max_data_size to 64 bytes in order to support SHA512-based signatures. Also update the signature length constraints per ECDSA signature encoding described in RFC 5480. Fixes: 299f561a6693 ("x509: Add support for parsing x509 certs with ECDSA keys") Signed-off-by: Denis Kenzior Reviewed-by: Stefan Berger Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit c95e8f6fd157b45ef0685c221931561e943e82da Author: Thomas Weißschuh Date: Mon Jan 9 23:59:43 2023 +0000 certs: don't try to update blacklist keys When the same key is blacklisted repeatedly logging at pr_err() level is excessive as no functionality is impaired. When these duplicates are provided by buggy firmware there is nothing the user can do to fix the situation. Instead of spamming the bootlog with errors we use a warning that can still be seen by OEMs when testing their firmware. Link: https://lore.kernel.org/all/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de/ Link: https://lore.kernel.org/all/20221104014704.3469-1-linux@weissschuh.net/ Signed-off-by: Thomas Weißschuh Tested-by: Paul Menzel Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 6c1976addf3623e979b7a954e216004d559bcb42 Author: Thomas Weißschuh Date: Mon Jan 9 23:59:42 2023 +0000 KEYS: Add new function key_create() key_create() works like key_create_or_update() but does not allow updating an existing key, instead returning ERR_PTR(-EEXIST). key_create() will be used by the blacklist keyring which should not create duplicate entries or update existing entries. Instead a dedicated message with appropriate severity will be logged. Signed-off-by: Thomas Weißschuh Signed-off-by: Jarkko Sakkinen commit 06b53b02945e3021addc6af2da3ac999d2221d23 Author: Thomas Weißschuh Date: Mon Jan 9 23:59:41 2023 +0000 certs: make blacklisted hash available in klog One common situation triggering this log statement are duplicate hashes reported by the system firmware. These duplicates should be removed from the firmware. Without logging the blacklisted hash triggering the issue however the users can not report it properly to the firmware vendors and the firmware vendors can not easily see which specific hash is duplicated. While changing the log message also use the dedicated ERR_PTR format placeholder for the returned error value. Signed-off-by: Thomas Weißschuh Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 4d2732882703791ea4b670df433f88fc4b40a5cb Author: Matthew Garrett Date: Sat Dec 31 01:14:32 2022 -0800 tpm_crb: Add support for CRB devices based on Pluton Pluton is an integrated security processor present in some recent Ryzen parts. If it's enabled, it presents two devices - an MSFT0101 ACPI device that's broadly an implementation of a Command Response Buffer TPM2, and an MSFT0200 ACPI device whose functionality I haven't examined in detail yet. This patch only attempts to add support for the TPM device. There's a few things that need to be handled here. The first is that the TPM2 ACPI table uses a previously undefined start method identifier. The table format appears to include 16 bytes of startup data, which corresponds to one 64-bit address for a start message and one 64-bit address for a completion response. The second is that the ACPI tables on the Thinkpad Z13 I'm testing this on don't define any memory windows in _CRS (or, more accurately, there are two empty memory windows). This check doesn't seem strictly necessary, so I've skipped that. Finally, it seems like chip needs to be explicitly asked to transition into ready status on every command. Failing to do this means that if two commands are sent in succession without an idle/ready transition in between, everything will appear to work fine but the response is simply the original command. I'm working without any docs here, so I'm not sure if this is actually the required behaviour or if I'm missing something somewhere else, but doing this results in the chip working reliably. Reviewed-by: Jarkko Sakkinen Signed-off-by: Matthew Garrett Signed-off-by: Jarkko Sakkinen commit 0f5d4a0b995faa6537c4de79973817a4f8da206a Author: Arnd Bergmann Date: Thu Dec 15 18:02:52 2022 +0100 crypto: certs: fix FIPS selftest dependency The selftest code is built into the x509_key_parser module, and depends on the pkcs7_message_parser module, which in turn has a dependency on the key parser, creating a dependency loop and a resulting link failure when the pkcs7 code is a loadable module: ld: crypto/asymmetric_keys/selftest.o: in function `fips_signature_selftest': crypto/asymmetric_keys/selftest.c:205: undefined reference to `pkcs7_parse_message' ld: crypto/asymmetric_keys/selftest.c:209: undefined reference to `pkcs7_supply_detached_data' ld: crypto/asymmetric_keys/selftest.c:211: undefined reference to `pkcs7_verify' ld: crypto/asymmetric_keys/selftest.c:215: undefined reference to `pkcs7_validate_trust' ld: crypto/asymmetric_keys/selftest.c:219: undefined reference to `pkcs7_free_message' Avoid this by only allowing the selftest to be enabled when either both parts are loadable modules, or both are built-in. Signed-off-by: Arnd Bergmann Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit b187c70b0366b465faa6e78c84feb5817561105f Merge: 75da437a2f172 9cbd5a8abca90 Author: Kalle Valo Date: Mon Feb 13 08:58:37 2023 +0200 Merge tag 'iwlwifi-next-for-kalle-2023-01-30' of http://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next iwlwifi updates towards v6.3, this patch-set contains: * EHT rate reporting * Sniffer support for EHT and a few fixes in the related code * A few general cleanups and small bugfixes * Bump FW API to 74 for AX devices * Fix a compilation error in mei (it still depends on BROKEN) * STEP equalizer support - transfer some Phy related parameters from the BIOS to the firmware commit 2062f9fb6445451b189595e295765c69f43bc12e Author: Oleksandr Tyshchenko Date: Wed Feb 8 17:36:49 2023 +0200 xen/grant-dma-iommu: Implement a dummy probe_device() callback Update stub IOMMU driver (which main purpose is to reuse generic IOMMU device-tree bindings by Xen grant DMA-mapping layer on Arm) according to the recent changes done in the following commit 57365a04c921 ("iommu: Move bus setup to IOMMU device registration"). With probe_device() callback being called during IOMMU device registration, the uninitialized callback just leads to the "kernel NULL pointer dereference" issue during boot. Fix that by adding a dummy callback. Looks like the release_device() callback is not mandatory to be implemented as IOMMU framework makes sure that callback is initialized before dereferencing. Reported-by: Viresh Kumar Fixes: 57365a04c921 ("iommu: Move bus setup to IOMMU device registration") Signed-off-by: Oleksandr Tyshchenko Tested-by: Viresh Kumar Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20230208153649.3604857-1-olekstysh@gmail.com Signed-off-by: Juergen Gross commit c70b7741dda7586529cc270e0f2c4cae3921b9b1 Author: Volodymyr Babchuk Date: Thu Jan 19 21:11:15 2023 +0000 xen/pvcalls-back: fix permanently masked event channel There is a sequence of events that can lead to a permanently masked event channel, because xen_irq_lateeoi() is newer called. This happens when a backend receives spurious write event from a frontend. In this case pvcalls_conn_back_write() returns early and it does not clears the map->write counter. As map->write > 0, pvcalls_back_ioworker() returns without calling xen_irq_lateeoi(). This leaves the event channel in masked state, a backend does not receive any new events from a frontend and the whole communication stops. Move atomic_set(&map->write, 0) to the very beginning of pvcalls_conn_back_write() to fix this issue. Signed-off-by: Volodymyr Babchuk Reported-by: Oleksii Moisieiev Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230119211037.1234931-1-volodymyr_babchuk@epam.com Signed-off-by: Juergen Gross commit 3e8cd711c3da6c3d724076048038cd666bdbb2b5 Author: David Woodhouse Date: Wed Jan 18 12:22:38 2023 +0000 xen: Allow platform PCI interrupt to be shared When we don't use the per-CPU vector callback, we ask Xen to deliver event channel interrupts as INTx on the PCI platform device. As such, it can be shared with INTx on other PCI devices. Set IRQF_SHARED, and make it return IRQ_HANDLED or IRQ_NONE according to whether the evtchn_upcall_pending flag was actually set. Now I can share the interrupt: 11: 82 0 IO-APIC 11-fasteoi xen-platform-pci, ens4 Drop the IRQF_TRIGGER_RISING. It has no effect when the IRQ is shared, and besides, the only effect it was having even beforehand was to trigger a debug message in both I/OAPIC and legacy PIC cases: [ 0.915441] genirq: No set_type function for IRQ 11 (IO-APIC) [ 0.951939] genirq: No set_type function for IRQ 11 (XT-PIC) Signed-off-by: David Woodhouse Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/f9a29a68d05668a3636dd09acd94d970269eaec6.camel@infradead.org Signed-off-by: Juergen Gross commit caea091e48ed9d3951506507abf26e9918d08e35 Author: Krister Johansen Date: Fri Dec 16 08:21:18 2022 -0800 x86/xen/time: prefer tsc as clocksource when it is invariant Kvm elects to use tsc instead of kvm-clock when it can detect that the TSC is invariant. (As of commit 7539b174aef4 ("x86: kvmguest: use TSC clocksource if invariant TSC is exposed")). Notable cloud vendors[1] and performance engineers[2] recommend that Xen users preferentially select tsc over xen-clocksource due the performance penalty incurred by the latter. These articles are persuasive and tailored to specific use cases. In order to understand the tradeoffs around this choice more fully, this author had to reference the documented[3] complexities around the Xen configuration, as well as the kernel's clocksource selection algorithm. Many users may not attempt this to correctly configure the right clock source in their guest. The approach taken in the kvm-clock module spares users this confusion, where possible. Both the Intel SDM[4] and the Xen tsc documentation explain that marking a tsc as invariant means that it should be considered stable by the OS and is elibile to be used as a wall clock source. In order to obtain better out-of-the-box performance, and reduce the need for user tuning, follow kvm's approach and decrease the xen clock rating so that tsc is preferable, if it is invariant, stable, and the tsc will never be emulated. [1] https://aws.amazon.com/premiumsupport/knowledge-center/manage-ec2-linux-clock-source/ [2] https://www.brendangregg.com/blog/2021-09-26/the-speed-of-time.html [3] https://xenbits.xen.org/docs/unstable/man/xen-tscmode.7.html [4] Intel 64 and IA-32 Architectures Sofware Developer's Manual Volume 3b: System Programming Guide, Part 2, Section 17.17.1, Invariant TSC Signed-off-by: Krister Johansen Code-reviewed-by: David Reaver Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20221216162118.GB2633@templeofstupid.com Signed-off-by: Juergen Gross commit f697cb00afa90b68748f246540270b5865c801ba Author: Juergen Gross Date: Fri Nov 25 07:32:48 2022 +0100 x86/xen: mark xen_pv_play_dead() as __noreturn Mark xen_pv_play_dead() and related to that xen_cpu_bringup_again() as "__noreturn". Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20221125063248.30256-3-jgross@suse.com Signed-off-by: Juergen Gross commit 336f560a8917fd60bcdb71b97263257611411453 Author: Juergen Gross Date: Fri Nov 25 07:32:47 2022 +0100 x86/xen: don't let xen_pv_play_dead() return A function called via the paravirt play_dead() hook should not return to the caller. xen_pv_play_dead() has a problem in this regard, as it currently will return in case an offlined cpu is brought to life again. This can be changed only by doing basically a longjmp() to cpu_bringup_and_idle(), as the hypercall for bringing down the cpu will just return when the cpu is coming up again. Just re-initializing the cpu isn't possible, as the Xen hypervisor will deny that operation. So introduce xen_cpu_bringup_again() resetting the stack and calling cpu_bringup_and_idle(), which can be called after HYPERVISOR_vcpu_op() in xen_pv_play_dead(). Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20221125063248.30256-2-jgross@suse.com Signed-off-by: Juergen Gross commit 415dab3c179632d098aadc756b39cebceb977978 Author: Per Bilse Date: Tue Jan 3 13:02:13 2023 +0000 drivers/xen/hypervisor: Expose Xen SIF flags to userspace /proc/xen is a legacy pseudo filesystem which predates Xen support getting merged into Linux. It has largely been replaced with more normal locations for data (/sys/hypervisor/ for info, /dev/xen/ for user devices). We want to compile xenfs support out of the dom0 kernel. There is one item which only exists in /proc/xen, namely /proc/xen/capabilities with "control_d" being the signal of "you're in the control domain". This ultimately comes from the SIF flags provided at VM start. This patch exposes all SIF flags in /sys/hypervisor/start_flags/ as boolean files, one for each bit, returning '1' if set, '0' otherwise. Two known flags, 'privileged' and 'initdomain', are explicitly named, and all remaining flags can be accessed via generically named files, as suggested by Andrew Cooper. Signed-off-by: Per Bilse Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230103130213.2129753-1-per.bilse@citrix.com Signed-off-by: Juergen Gross commit 2b188a2cfc4d8f319ad23832ec1390bdae52daf6 Author: Thomas Weißschuh Date: Fri Feb 10 02:14:44 2023 +0000 zonefs: make kobj_type structure constant Since commit ee6d3dd4ed48 ("driver core: make kobj_type constant.") the driver core allows the usage of const struct kobj_type. Take advantage of this to constify the structure definition to prevent modification at runtime. Signed-off-by: Thomas Weißschuh Reviewed-by: Johannes Thumshirn Signed-off-by: Damien Le Moal commit 5aa52ccf692bfef7ddc23c2be1d48524a4427527 Author: Geert Uytterhoeven Date: Mon Dec 19 14:40:29 2022 +0100 m68k: nommu: Fix misspellings of "DragonEngine" Exys produced the "DragonEngine II" board. Signed-off-by: Geert Uytterhoeven Signed-off-by: Greg Ungerer commit 8f6077272910d1c7b2ccaacbb02119e18aabecb8 Author: Geert Uytterhoeven Date: Tue Dec 13 09:18:50 2022 +0100 m68k: nommu: Fix misspellings of "uCdimm" Arcturus Networks produced the "uCsimm" and "uCdimm" modules. Signed-off-by: Geert Uytterhoeven Signed-off-by: Greg Ungerer commit bd4f5d09cc93c8ca51e4efea86ac90a4bb553d6e Author: Dave Chinner Date: Mon Feb 13 09:14:56 2023 +1100 xfs: refactor the filestreams allocator pick functions Now that the filestreams allocator is largely rewritten, restructure the main entry point and pick function to seperate out the different operations cleanly. The MRU lookup function should not handle the start AG selection on MRU lookup failure, and nor should the pick function handle building the association that is inserted into the MRU. This leaves the filestreams allocator fairly clean and easy to understand, returning to the caller with an active perag reference and a target block to allocate at. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit f8f1ed1ab3babad46b25e2dbe8de43b33fe7aaa6 Author: Dave Chinner Date: Mon Feb 13 09:14:56 2023 +1100 xfs: return a referenced perag from filestreams allocator Now that the filestreams AG selection tracks active perags, we need to return an active perag to the core allocator code. This is because the file allocation the filestreams code will run are AG specific allocations and so need to pin the AG until the allocations complete. We cannot rely on the filestreams item reference to do this - the filestreams association can be torn down at any time, hence we need to have a separate reference for the allocation process to pin the AG after it has been selected. This means there is some perag juggling in allocation failure fallback paths as they will do all AG scans in the case the AG specific allocation fails. Hence we need to track the perag reference that the filestream allocator returned to make sure we don't leak it on repeated allocation failure. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 571e259282a43f58b1f70dcbf2add20d8c83a72b Author: Dave Chinner Date: Mon Feb 13 09:14:56 2023 +1100 xfs: pass perag to filestreams tracing Pass perags instead of raw ag numbers, avoiding the need for the special peek function for the tracing code. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit eb70aa2d8ed9a6fc3525f305226c550524390cd2 Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: use for_each_perag_wrap in xfs_filestream_pick_ag xfs_filestream_pick_ag() is now ready to rework to use for_each_perag_wrap() for iterating the perags during the AG selection scan. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 3054face139f9c77566a90a0524dd85c2f38c7f2 Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: track an active perag reference in filestreams Rather than just track the agno of the reference, track a referenced perag pointer instead. This will allow active filestreams to prevent AGs from going away until the filestreams have been torn down. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit f38b46bbfa76a854c4c2a27b1617d66fefbb3f80 Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: factor out MRU hit case in xfs_filestream_select_ag Because it now stands out like a sore thumb. Factoring out this case starts the process of simplifying xfs_filestream_select_ag() again. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 3e43877a9dac13771ac722462c87bea0bdc50759 Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: remove xfs_filestream_select_ag() longest extent check Picking a new AG checks the longest free extent in the AG is valid, so there's no need to repeat the check in xfs_filestream_select_ag(). Remove it. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit ba34de8defe013e4062bdc2ed57d748d6807a96a Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: merge new filestream AG selection into xfs_filestream_select_ag() This is largely a wrapper around xfs_filestream_pick_ag() that repeats a lot of the lookups that we just merged back into xfs_filestream_select_ag() from the lookup code. Merge the xfs_filestream_new_ag() code back into _select_ag() to get rid of all the unnecessary logic. Indeed, this makes it obvious that if we have no parent inode, the filestreams allocator always selects AG 0 regardless of whether it is fit for purpose or not. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit a52dc2ad363088d0e0ab05a71f0496e2377e5cc9 Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: merge filestream AG lookup into xfs_filestream_select_ag() The lookup currently either returns the cached filestream AG or it calls xfs_filestreams_select_lengths() to looks up a new AG. This has verify the AG that is selected, so we end up doing "select a new AG loop in a couple of places when only one really is needed. Merge the initial lookup functionality with the length selection so that we only need to do a single pick loop on lookup or verification failure. This undoes a lot of the factoring that enabled the selection to be moved over to the filestreams code. It makes xfs_filestream_select_ag() an awful messier, but it has to be made worse before it can get better in future patches... Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 8f7747ad8c52cde585b9456f6dbd1984af7b97bc Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: move xfs_bmap_btalloc_filestreams() to xfs_filestreams.c xfs_bmap_btalloc_filestreams() calls two filestreams functions to select the AG to allocate from. Both those functions end up in the same selection function that iterates all AGs multiple times. Worst case, xfs_bmap_btalloc_filestreams() can iterate all AGs 4 times just to select the initial AG to allocate in. Move the AG selection to fs/xfs/xfs_filestreams.c as a single interface so that the inefficient AG interation is contained entirely within the filestreams code. This will allow the implementation to be simplified and made more efficient in future patches. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 05cf492a8d01f48d4b8d8f0b93f2d75de7349f12 Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: use xfs_bmap_longest_free_extent() in filestreams The code in xfs_bmap_longest_free_extent() is open coded in xfs_filestream_pick_ag(). Export xfs_bmap_longest_free_extent and call it from the filestreams code instead. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 6b637ad0c7be85ecb795697ea51051039b753da2 Author: Dave Chinner Date: Mon Feb 13 09:14:55 2023 +1100 xfs: get rid of notinit from xfs_bmap_longest_free_extent It is only set if reading the AGF gets a EAGAIN error. Just return the EAGAIN error and handle that error in the callers. This means we can remove the not_init parameter from xfs_bmap_select_minlen(), too, because the use of not_init there is pessimistic. If we can't read the agf, it won't increase blen. The only time we actually care whether we checked all the AGFs for contiguous free space is when the best length is less than the minimum allocation length. If not_init is set, then we ignore blen and set the minimum alloc length to the absolute minimum, not the best length we know already is present. However, if blen is less than the minimum we're going to ignore it anyway, regardless of whether we scanned all the AGFs or not. Hence not_init can go away, because we only use if blen is good from the scanned AGs otherwise we ignore it altogether and use minlen. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 89563e7dc099343bf7792515452e1a24005d98a6 Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: factor out filestreams from xfs_bmap_btalloc_nullfb There's many if (filestreams) {} else {} branches in this function. Split it out into a filestreams specific function so that we can then work directly on cleaning up the filestreams code without impacting the rest of the allocation algorithms. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 35bf2b1abc9a753321db3b3787f5b5de6bd2b370 Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: convert trim to use for_each_perag_range To convert it to using active perag references and hence make it shrink safe. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 3432ef6111997f39d2f708dd508159dfaca72942 Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: convert xfs_alloc_vextent_iterate_ags() to use perag walker Now that the AG iteration code in the core allocation code has been cleaned up, we can easily convert it to use a for_each_perag..() variant to use active references and skip AGs that it can't get active references on. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 8b81356825ffb96b3b167b4dabbbbdb506bb0e0b Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: move the minimum agno checks into xfs_alloc_vextent_check_args All of the allocation functions now extract the minimum allowed AG from the transaction and then use it in some way. The allocation functions that are restricted to a single AG all check if the AG requested can be allocated from and return an error if so. These all set args->agno appropriately. All the allocation functions that iterate AGs use it to calculate the scan start AG. args->agno is not set until the iterator starts walking AGs. Hence we can easily set up a conditional check against the minimum AG allowed in xfs_alloc_vextent_check_args() based on whether args->agno contains NULLAGNUMBER or not and move all the repeated setup code to xfs_alloc_vextent_check_args(), further simplifying the allocation functions. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 230e8fe8462ffda0849ea40b61dcf9f233854076 Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: fold xfs_alloc_ag_vextent() into callers We don't need the multiplexing xfs_alloc_ag_vextent() provided anymore - we can just call the exact/near/size variants directly. This allows us to remove args->type completely and stop using args->fsbno as an input to the allocator algorithms. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit e4d174260779ff0e2dc5de951c2e235721b02b05 Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: move allocation accounting to xfs_alloc_vextent_set_fsbno() Move it from xfs_alloc_ag_vextent() so we can get rid of that layer. Rename xfs_alloc_vextent_set_fsbno() to xfs_alloc_vextent_finish() to indicate that it's function is finishing off the allocation that we've run now that it contains much more functionality. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 74b9aa63193b288191d6f01b61c819cef2807138 Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: introduce xfs_alloc_vextent_prepare() Now that we have wrapper functions for each type of allocation we can ask for, we can start unravelling xfs_alloc_ag_vextent(). That is essentially just a prepare stage, the allocation multiplexer and a post-allocation accounting step is the allocation proceeded. The current xfs_alloc_vextent*() wrappers all have a prepare stage, the allocation operation and a post-allocation accounting step. We can consolidate this by moving the AG alloc prep code into the wrapper functions, the accounting code in the wrapper accounting functions, and cut out the multiplexer layer entirely. This patch consolidates the AG preparation stage. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 5f36b2ce79f254dd00cdc88374271df7ce843d56 Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: introduce xfs_alloc_vextent_exact_bno() Two of the callers to xfs_alloc_vextent_this_ag() actually want exact block number allocation, not anywhere-in-ag allocation. Split this out from _this_ag() as a first class citizen so no external extent allocation code needs to care about args->type anymore. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit db4710fd12248e5d4c3842520cd13f034136576b Author: Dave Chinner Date: Mon Feb 13 09:14:54 2023 +1100 xfs: introduce xfs_alloc_vextent_near_bno() The remaining callers of xfs_alloc_vextent() are all doing NEAR_BNO allocations. We can replace that function with a new xfs_alloc_vextent_near_bno() function that does this explicitly. We also multiplex NEAR_BNO allocations through xfs_alloc_vextent_this_ag via args->type. Replace all of these with direct calls to xfs_alloc_vextent_near_bno(), too. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 2a7f6d41d8b72412228ede538bdf0e81bf9738f4 Author: Dave Chinner Date: Mon Feb 13 09:14:53 2023 +1100 xfs: use xfs_alloc_vextent_start_bno() where appropriate Change obvious callers of single AG allocation to use xfs_alloc_vextent_start_bno(). Callers no long need to specify XFS_ALLOCTYPE_START_BNO, and so the type can be driven inward and removed. While doing this, also pass the allocation target fsb as a parameter rather than encoding it in args->fsbno. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 319c9e874ac8721acdb6583e3459ef595e5ed0a6 Author: Dave Chinner Date: Mon Feb 13 09:14:53 2023 +1100 xfs: use xfs_alloc_vextent_first_ag() where appropriate Change obvious callers of single AG allocation to use xfs_alloc_vextent_first_ag(). This gets rid of XFS_ALLOCTYPE_FIRST_AG as the type used within xfs_alloc_vextent_first_ag() during iteration is _THIS_AG. Hence we can remove the setting of args->type from all the callers of _first_ag() and remove the alloctype. While doing this, pass the allocation target fsb as a parameter rather than encoding it in args->fsbno. This starts the process of making args->fsbno an output only variable rather than input/output. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 85843327094f9de9cf0129cd9a3a43128c6f5ac8 Author: Dave Chinner Date: Mon Feb 13 09:14:53 2023 +1100 xfs: factor xfs_bmap_btalloc() There are several different contexts xfs_bmap_btalloc() handles, and large chunks of the code execute independent allocation contexts. Try to untangle this mess a bit. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 74c36a8689d3d8ca9d9e96759c9bbf337e049097 Author: Dave Chinner Date: Mon Feb 13 09:14:53 2023 +1100 xfs: use xfs_alloc_vextent_this_ag() where appropriate Change obvious callers of single AG allocation to use xfs_alloc_vextent_this_ag(). Drive the per-ag grabbing out to the callers, too, so that callers with active references don't need to do new lookups just for an allocation in a context that already has a perag reference. The only remaining caller that does single AG allocation through xfs_alloc_vextent() is xfs_bmap_btalloc() with XFS_ALLOCTYPE_NEAR_BNO. That is going to need more untangling before it can be converted cleanly. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 4811c933ea1ab7de86507dc9f7c9d3d9d71cafb5 Author: Dave Chinner Date: Mon Feb 13 09:14:53 2023 +1100 xfs: combine __xfs_alloc_vextent_this_ag and xfs_alloc_ag_vextent There's a bit of a recursive conundrum around xfs_alloc_ag_vextent(). We can't first call xfs_alloc_ag_vextent() without preparing the AGFL for the allocation, and preparing the AGFL calls xfs_alloc_ag_vextent() to prepare the AGFL for the allocation. This "double allocation" requirement is not really clear from the current xfs_alloc_fix_freelist() calls that are sprinkled through the allocation code. It's not helped that xfs_alloc_ag_vextent() can actually allocate from the AGFL itself, but there's special code to prevent AGFL prep allocations from allocating from the free list it's trying to prep. The naming is also not consistent: args->wasfromfl is true when we allocated _from_ the free list, but the indication that we are allocating _for_ the free list is via checking that (args->resv == XFS_AG_RESV_AGFL). So, lets make this "allocation required for allocation" situation clear by moving it all inside xfs_alloc_ag_vextent(). The freelist allocation is a specific XFS_ALLOCTYPE_THIS_AG allocation, which translated directly to xfs_alloc_ag_vextent_size() allocation. This enables us to replace __xfs_alloc_vextent_this_ag() with a call to xfs_alloc_ag_vextent(), and we drive the freelist fixing further into the per-ag allocation algorithm. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit 2edf06a50f5bbe664283f3c55c480fc013221d70 Author: Dave Chinner Date: Mon Feb 13 09:14:53 2023 +1100 xfs: factor xfs_alloc_vextent_this_ag() for _iterate_ags() The core of the per-ag iteration is effectively doing a "this ag" allocation on one AG at a time. Use the same code to implement the core "this ag" allocation in both xfs_alloc_vextent_this_ag() and xfs_alloc_vextent_iterate_ags(). This means we only call xfs_alloc_ag_vextent() from one place so we can easily collapse the call stack in future patches. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong commit ecd788a92460eef44c5444290757bfd0f38d91b4 Author: Dave Chinner